Legal

Privacy Policy

Effective 14 July 2026 · Protection of Personal Information Act, 2013 (POPIA)

LotMaster runs auctions inside WhatsApp groups. To do that we handle personal information — of the sellers who use us, and of the bidders in their groups. This policy says exactly what we hold, why, who else sees it, and what you can make us do about it. It is written to be read, not to be survived.

1. Who is responsible

The responsible party (POPIA's term for the person who decides why and how your information is processed) is:

• Kelvin Raath, trading as LotMaster
• Information Officer: Kelvin Raath
• Email: hello@lotmasterhq.com
• Website: lotmasterhq.com
• Country: South Africa

Any request under this policy — access, correction, deletion, objection — goes to that email address and is answered by that person.

2. Where we are the responsible party, and where we are not

This distinction decides who you must approach, so we state it plainly.

For sellers — the people and businesses who hold a LotMaster account — we are the responsible party. We decide what account information we need and why.

For bidders — the people in a seller's WhatsApp group — we are an operator. The seller chose the group, admitted its members and runs the auction; we process bids on their instruction and on their behalf, and we do not use that information for our own purposes. If you are a bidder and want your information removed or corrected, the seller running your auction is the responsible party, and asking them is the fastest route. You may also write to us at the address above and we will act on their instruction and tell you we have done so.

3. What we collect

From sellers

• Your email address, used to sign you in — we email a one-tap link, so we never hold a password.
• Your business name, and the WhatsApp number the bot runs on.
• Three optional questions asked at signup: what you sell, how often you auction, and how you heard about us. Every one may be skipped, and skipping costs you nothing.
• Your bank account details, if you choose to accept online payments. These go straight to our payment processor and are stored by them, not by us — see section 6.
• The email addresses of any team members you invite.

From bidders, inside registered groups only

• The bid messages you send — the amount, and the message they came in.
• Your WhatsApp identifier, your phone number where WhatsApp exposes it to us, and your WhatsApp display name.
• WhatsApp's own server timestamp for each message. This is the heart of the product: winners are ranked on Meta's clock, not ours, which is what makes a result checkable rather than merely asserted.
• Auction outcomes, invoices and payment status for lots you win — and, if a seller marks you as not having paid, a defaulter flag. See section 9.

We only read the groups a seller has registered with us. We do not read your other groups, your direct messages, or anything the bot has not been added to. We do not have access to them.

Automatically, when you use the site or dashboard

• Standard technical data: IP address, browser and device type, pages viewed, and the site that referred you.
• Analytics data, only once you accept it — see section 5.

4. Why we process it, and on what basis

POPIA requires a lawful basis for each purpose. Ours are:

• To run your auctions — accepting bids, ranking them on server time, closing lots, deciding winners and issuing invoices. Basis: necessary to perform the contract you have with us (or, for bidders, necessary for the seller's legitimate interest in running an auction you chose to bid in).
• To produce the audit trail — the append-only record that lets any result be checked after the fact. Basis: legitimate interest. An auction nobody can verify is an auction nobody should trust, and this record is the product.
• To take payment — invoices, pay links, and reconciling what was paid. Basis: contractual necessity, and legal obligation for financial records.
• To keep your WhatsApp number safe — pacing messages so automation does not look like spam. Basis: legitimate interest.
• To understand how sellers find us — analytics. Basis: your consent, and nothing else. Decline and we do not do it.
• To meet our legal duties — tax and company records. Basis: legal obligation.

5. Cookies and analytics

We use Google Analytics on this site and on the dashboard atapp.lotmasterhq.com to understand which pages bring sellers to LotMaster and where they get stuck. It tells us about pages and traffic sources. It is not given your auctions, your bidders, or your group.

Analytics cookies are only set once you accept them. Until you do, Google Analytics runs in a consent-denied mode that stores nothing on your device. Your answer is remembered in one cookie of ours,lm_consent, which holds nothing but the wordgranted or denied. You can change your mind by clearing cookies for this site, and you will be asked again.

Creating a LotMaster account also accepts this policy, analytics included. The signup form says so above the button, before you press it.

Cookies and similar storage we use, in full: lm_consent(your consent choice); Google Analytics cookies (_gaand related), only after you accept; a Supabase session token that keeps you signed in to the dashboard; and Cloudflare Turnstile, which tells a human from a bot on the sign-in page. Only the analytics cookies are optional — the rest are strictly necessary to sign you in and keep the account secure, and the site does not work without them.

Auction results pages (/r/…) are counted like any other page. The access key in a results link is never sent to Google. We report the page address with the key stripped off, by design and not by accident.

6. Who else sees it

We do not sell personal information, and we never will. We do not share your member list, or use it for anything but your auctions.

We use these operators — service providers who process information on our instruction, under contract, and for no purpose of their own:

• Supabase — our database and sign-in. Hosted in eu-west-1 (Ireland).
• Hetzner — the server the WhatsApp bot runs on, in Falkenstein, Germany.
• Cloudflare — hosting for this site and the dashboard, and the anti-bot check on sign-in.
• Google — analytics, only with your consent (section 5).
• Paystack — payments, if a seller turns on online payment. Card and bank details go to them directly; they are a licensed payment processor and we never see or store the card number.
• Meta (WhatsApp) — the messages themselves travel over WhatsApp. Their handling of them is governed by their own privacy policy, not ours.

We will also disclose information where the law requires it — a court order, a lawful request from a regulator — and to establish or defend a legal claim.

7. Information sent outside South Africa

Our database and servers are in the European Union (Ireland and Germany), so your information leaves South Africa. POPIA section 72 permits this where the receiving country's law gives protection substantially similar to POPIA's. The EU is governed by the GDPR, which meets that bar, and our providers are bound by written terms requiring at least the protection this policy promises. Cloudflare and Google operate globally and transfer data under standard contractual clauses.

8. How long we keep it

• Account information — while your account is open, and for 12 months after you close it, in case you come back.
• Auction records, bids and audit logs — 5 years. These are the record that a result was fair, and they are also financial records; South African tax law requires 5 years.
• Invoices and payment records — 5 years, for the same reason.
• Defaulter flags — while the seller's account is open, or until the seller removes the flag. They are the seller's record, not ours.
• Analytics — 14 months, Google Analytics' shortest retention setting.

When a period ends we delete the information or de-identify it so it can no longer be traced to you.

9. Defaulter flags and automated decisions

POPIA gives you the right not to be subject to a decision made solely by automatic means that has legal consequences for you. We want to be exact here.

A defaulter flag is not an automated decision. A seller marks a buyer who did not pay; a person decides, and a person can undo it. The bot does not judge you. What the software does automatically is arithmetic — read a bid, rank it by WhatsApp's timestamp, and close a lot on time — and none of that profiles you or decides anything about you as a person.

If you believe you were flagged wrongly, ask the seller first; they can remove it. Write to us and we will put it to them and tell you the outcome.

10. Security

• Every seller's data is isolated at the database level, so one seller's queries cannot reach another's rows.
• Sign-in is by emailed one-tap link. There is no password to steal, and we do not store one.
• All traffic is encrypted in transit; the database is encrypted at rest.
• Public results pages are reachable only with an access key in the link. Anyone without the link sees nothing, and the key is never handed to any third party.

No system is perfectly secure, and we will not pretend otherwise. If personal information is ever compromised in a way that creates a real risk to you, we will notify you and the Information Regulator, as POPIA section 22 requires.

11. Your rights

Under POPIA you may:

• Ask what we hold about you, and get a copy (sections 23 and 24).
• Have it corrected or deleted where it is wrong, misleading, excessive, or no longer needed (section 24).
• Object to processing based on legitimate interest (section 11(3)).
• Withdraw consent to analytics at any time, without any effect on your account.
• Complain — to us first, we would hope, and to the Information Regulator regardless.

Write to hello@lotmasterhq.com. We answer within 30 days. We do not charge for a reasonable request, and we will never make you explain why you are asking.

12. Complaining to the Regulator

You can complain to the Information Regulator of South Africa at any time, whether or not you have come to us first:

• Website: inforegulator.org.za
• Complaints: POPIAComplaints.IR@justice.gov.za
• Enquiries: enquiries.IR@justice.gov.za

13. Children

LotMaster is for businesses and adult buyers. We do not knowingly process the information of anyone under 18. If you believe a child's information has reached us through a group, tell us and we will remove it.

14. Changes

If we change this policy materially we will change the effective date at the top and tell account holders by email before it takes effect. We will not quietly broaden what we do with your information and hope you do not read the diff.