Privacy policy

The business you dealt with decides to contact you and is the responsible party under POPIA. RateMate processes your information on that business's behalf as its operator. The business confirms it has your consent before adding your details, and that confirmation is logged.

The business can give its own staff access to RateMate to handle feedback day to day. They see the same details the business does. The business stays responsible for how your information is used.

If you used a business's feedback link or QR code: you enter your own name and number, and you give consent yourself by ticking the consent box. That consent covers storing your details, following up on your feedback, and future service-feedback requests from that business. It is logged the moment you submit, and everything below (opting out, retention, deletion) applies exactly the same.

We process, on the business's instruction:

• your name, mobile number and (optionally) company name;
• the score and any comment you choose to submit;
• message delivery status, whether you opened the review link, and your opt-out status.

This information is used only to send the feedback request, show your answer to the business, alert the business when something went wrong, and, where the business publishes the page described below, to count your score into a public total. It is never sold and never used to market anything else to you.

Public profile pages: a business can choose to publish a public page showing its total number of ratings, its average, the breakdown by star, and the month it started collecting ratings, low ratings included. That page never shows your name, your comment, or anything that identifies you as the person behind any individual rating. A business only gets this option once it has enough real ratings behind the number, and can take the page down again at any time; search engines that have already indexed it may keep their own copy for a while afterwards.

Opting out: reply STOP to any message and you will not hear from that business through RateMate again unless you later give fresh consent. Because more than one business may use RateMate to reach you, a STOP applies to the business that messaged you most recently, and we confirm which one it was. Reply STOP ALL to stop every message sent through RateMate. If we cannot tell which business you meant, we stop them all. Opt-out is re-checked immediately before every send.

Retention and deletion: rating links expire automatically. Free-text comments are deleted automatically after the business's retention period (24 months unless the business sets otherwise). You may ask the business (or us) to delete your details at any time: your name and number are destroyed and only an anonymous score remains. Consent changes, sends, opt-outs and deletions are recorded in an append-only audit log so we can prove they happened.

Message carriers: WhatsApp messages are delivered by Meta Platforms and SMS by SMSPortal. Your number and the message content pass through their systems, which may be located outside South Africa, under their own privacy terms.

A business can list the people who do its jobs, then tag who did each job when it asks a customer for feedback. If you are one of those people, the business you work for is the responsible party and RateMate processes this on its behalf as its operator, the same as it does for customer information.

What is held is your name and which feedback requests the business tagged as your work. From that, RateMate works out how many of your jobs were rated, your average score, and how many came back low. You do not need a RateMate login for any of this and most staff never have one. If you do hold an account, the business can link the two so it is clear you are the same person.

Who can see it: anyone the owner has given access to RateMate's feedback screens can see a piece of feedback or an alert alongside a line naming who did the job, so per-person attribution is visible to the whole portal team, not only the owner. Separately, the owner can generate a personal link for a staff member that shows just that person their own 30-day average and recent comments with the customer's name left out; anyone holding that link can open it, so it should be shared with the staff member it is for.

This is meant to show a business where work is going well and where someone needs support. Scores come from however many customers chose to reply, so they are a partial picture, and they are not designed to be the sole basis for a decision about someone's job. The business remains responsible for how it uses them, and employment decisions stay subject to South African labour law.

Coming off the list: a business removes someone by archiving them, which takes them off the scoreboard and out of the list of people who can be tagged, while leaving the past feedback on record. If you want your name removed altogether, ask the business, or contact us and we will refer it to them.

For account holders, RateMate is the responsible party. We process your name, email address, business details, and subscription status; we use your name only to address you in the messages and emails we send you. Passwords are stored only as a cryptographic hash, so we cannot read them. If you ask us to reset your password, we email your account address a single-use link that expires after an hour; the request and the reset are recorded in our audit log, and a reset signs the account out everywhere. We ask you to confirm your email address with a single-use verification link, and if you change your sign-in email, the new address only takes over once you confirm a link we email there; these events are recorded in the audit log too. Payments are handled by PayFast; your card details never reach RateMate's servers. If you connect Google review tracking, we fetch only your business's public, aggregate review count and rating, never reviewer identities.

Publishing your public profile page: you can choose, from Settings, to publish a page at your own web address showing your business name and logo, your total rating count, your average, the breakdown by star (low ratings included, we never let a business hide those), and the month you started collecting ratings. Nothing about any individual customer is ever shown. We include a published page's address in our public sitemap so search engines can find it. You can take a published page down again at any time from the same Settings screen; once taken down the address stops resolving immediately, though a search engine that already indexed it may keep its own copy for a while afterwards.

If a business owner adds you to their team, they can see your name, your email address and when you last signed in. That is so they can tell who has access to their customers' information and remove people who no longer need it. They cannot see your password, and they cannot see anything you do in another business you belong to.

We only send you product news and offers if you opted in, either at sign-up or later in Settings → Account. That is separate from the account and service emails we always send, like password resets, billing, and low-score alerts. Those keep going regardless. You can opt in or out any time from the same settings page.

Exporting your data: from Settings → Account you can download a full copy of everything your account holds (customers, feedback, alerts, referrals, and your audit history) as a zip of CSV files, any time.

Merging accounts: if you hold two RateMate logins, from Settings → Accountyou can merge the other one into the one you're using. We email the other address a link so its owner can confirm, and nothing moves until they do. Once confirmed, its businesses move under your login, its sessions are signed out everywhere, and any outstanding team invitation to that address is cancelled. That account keeps existing only so far as our records need to show who it was; it can no longer sign in on its own, and we email both addresses to confirm it happened.

Closing your account: also from Settings → Account, you can close your account. Closure takes effect immediately: your team is signed out straight away, your public feedback, walk-in, and referral links stop working, and an active subscription is cancelled with PayFast on the spot (the rest of the paid period is forfeited, no refund). Because closing signs you out immediately, we show you the export link before you confirm. It's your last chance to download your data yourself.

We keep your data for 7 days after closing in case it was a mistake. During that window only our support team can reverse it, since you can no longer sign in yourself. After 7 days an automated job permanently erases it: your name, email, password, and any customer, feedback, and referral data your business held are destroyed or anonymised, the same way a single customer's data is erased on request. We keep two things regardless: the append-only audit log, as our record that the processing (and the closure and erasure themselves) happened, and a minimal financial skeleton (your billing/subscription and payment history). South African law requires financial records to be kept for longer than POPIA requires personal data to be deleted, so we keep only the two obligations separate rather than picking one.

A business owner who uses RateMate can invite other people to help them handle feedback. If someone invited you, we email you a link so you can join. For that email RateMate is the responsible party. We store only your email address, the role you were offered, and who invited you, and we use them solely to send that invitation and to show the business who is on their team.

The invite link expires after 7 days. If you never accept it, we delete the invitation automatically 30 days after it expires. You can ask the business to cancel an invitation at any time, and you can ask us to delete it using the contact details below.

If you do accept, you get your own RateMate account and the section above applies to you. The business you joined stays responsible for the customer information you see there.

A RateMate business can share a referral link. If you open it and enter your own mobile number, you are asking us to text you a one-off invitation to try RateMate, so for that message RateMate is the responsible party. We store only your number and which business referred you, and we use them solely to send that invitation and to credit the referrer if you later sign up. We do not add you to any marketing list. If you never sign up, the referral record is deleted automatically after 90 days. Reply STOP to the invite and we will not message you again.

Under POPIA you may request access to, correction of, or deletion of your personal information, and you may object to processing. Contact us at support@ratemate.co.za. If you believe your information has been mishandled, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.