Privacy Policy
Last updated: 15 October 2026
1. Introduction
1.1 This Privacy Policy explains how Monique Cloete, a sole proprietor trading as Instead Nutrition (“Instead”, “we”, “us”), collects, uses, shares and protects your personal information when you use www.instead.co.za (“the Website”) and app.instead.co.za (“the App”).
1.2 We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). For the purposes of POPIA, Instead is the responsible party.
1.3 Information Officer: Monique Cloete, info@instead.co.za, 063 906 4248, Pretoria East, Gauteng, South Africa.
2. Information we collect
2.1 Account and contact information: first name, surname, email address, mobile number (optional) and your password, which is stored only in encrypted (hashed) form.
2.2 Profile information: date of birth, gender, height, starting weight, an optional profile photo, and your billing address for invoices.
2.3 Health and body information, which you choose to record: body weight and measurements, progress photos or notes, nutritional goals and calorie targets, food diary entries, water intake, physical activity, and wellbeing check-ins such as sleep, digestion, mood and stress. Under POPIA this is “special personal information” (see section 4).
2.4 Subscription and payment information: the plan you chose, any discount or referral code used, payment amounts, dates and status, the PayFast payment reference and the subscription token PayFast gives us to manage your recurring payments. We never receive or store your card or bank details; PayFast processes these.
2.5 Referral information: if you were referred by an affiliate, which affiliate code you used.
2.6 Communications: emails and messages you send us, including billing, cancellation and deletion requests.
2.7 Technical information: IP address, browser and device type, pages visited and the date and time of visits, collected through cookies and similar technologies (see section 11) and our server logs.
2.8 Website forms: the name, email address and mobile number you give us through the contact form or a sign-up form on the Website.
3. Why we use your information
|
Purpose |
Information used |
Lawful basis under POPIA |
|---|---|---|
|
Creating and running your account |
Account, profile |
Performing our agreement with you |
|
Providing the App’s features (calculators, planner, diary, progress tracking) |
Profile, health and body information |
Your explicit consent (special personal information) |
|
Processing payments, renewals, cancellations and invoices |
Subscription and payment, contact |
Performing our agreement; legal obligation |
|
Keeping financial records for tax |
Payment records |
Legal obligation |
|
Paying affiliate commissions |
Referral, payment amounts |
Performing our agreement with the affiliate; legitimate interest |
|
Responding to your requests and complaints |
Contact, communications |
Performing our agreement; legitimate interest |
|
Sending service emails (verification, welcome, billing, changes to our terms) |
Contact |
Performing our agreement |
|
Sending tips, news and offers |
Contact |
Your consent, or as an existing customer under POPIA section 69 (you may opt out at any time) |
|
Security, fraud and spam prevention (including reCAPTCHA) |
Technical |
Legitimate interest |
|
Understanding how the Website is used (Google Analytics) |
Technical |
Legitimate interest; you may opt out (section 11) |
We only use your information for these purposes, or for purposes compatible with them. We do not sell your personal information, and we do not use it for automated decisions with legal effects on you.
4. Health and body information
4.1 Information about your health and body is special personal information under section 26 of POPIA. We process it only with your explicit consent, which you give by ticking the consent box when you register (or when you accept our updated terms).
4.2 We use this information only to provide the App’s features to you, such as calculating estimated calorie and macro targets and showing your progress. We do not share it with affiliates or advertisers, and we do not use it for marketing.
4.3 You may withdraw your consent at any time by emailing info@instead.co.za. Because the App’s core features depend on this information, withdrawing consent means we will close your account and delete your health and body information, as described in section 8. Withdrawal does not affect processing that happened before it.
4.4 You decide what you record. You do not have to complete every field, but some features will not work without certain information (for example, the calorie calculator needs your height, weight, age and gender).
5. Who we share your information with
We share personal information only with the service providers (“operators”) we need to run Instead. They may use it only to provide their service to us, and they must keep it confidential and secure.
|
Service provider |
What they do |
Where the data is stored |
|---|---|---|
|
Host Africa |
Hosts the Website, the App, its database and our email (info@instead.co.za) |
South Africa |
|
PayFast (Pty) Ltd |
Processes payments and recurring subscriptions |
South Africa |
|
Google (Analytics, reCAPTCHA, Drive) |
Website statistics; spam and bot protection on login and registration; secure storage of business documents and backups |
Outside South Africa (see section 7) |
|
Complianz (WordPress plugin) |
Manages the cookie banner and your cookie choices on the Website |
Stored on our own Website |
|
WhatsApp / Meta |
Only if you choose to contact us on WhatsApp |
Outside South Africa |
We also share information:
- with affiliates: if you joined using an affiliate’s code, that affiliate sees your first name and surname initial, the date you joined and the commission earned. They do not see your contact details, health information or anything else in your account;
- when required by law: for example with the South African Revenue Service or in response to a court order; and
- to protect rights: where necessary to protect the rights, safety or property of Instead, our users or others.
6. What we never do with your information
6.1 We do not sell, rent or trade your personal information.
6.2 We do not share your personal information with advertisers, and we never use your health and body information for advertising or marketing.
7. Information transferred outside South Africa
7.1 Some providers, such as Google, store information on servers outside South Africa. Under section 72 of POPIA, we transfer personal information outside South Africa only where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is necessary to provide the Services to you or you have consented to it.
7.2 The App’s database, including your health and body information, is hosted in South Africa. Any copies kept in our Google Drive backups are protected as described in section 9.
Note for reviewer: confirm the cross-border basis for Google Drive backups of database exports that may contain health information.
8. How long we keep your information
|
Information |
How long we keep it |
|---|---|
|
Account, profile, health and body information |
While your account is active, and for up to 90 days after you cancel or ask for deletion. It is then deleted. |
|
Payment records (name, email, amounts, dates, PayFast reference) and linked affiliate commissions |
5 years from the end of the tax year of the payment, as required by tax law, even if your account is deleted |
|
PayFast payment notification logs |
Up to 12 months |
|
Emails and requests you send us |
Up to 2 years, unless needed longer for a dispute |
|
Website analytics data |
As set in Google Analytics (up to 14 months) |
|
Backups |
Overwritten or deleted on a rolling basis; deleted information may remain in a backup for up to 90 days |
You can ask us to delete your account at any time using the “Request Account Deletion” button on My Profile or by emailing info@instead.co.za. We confirm your request within 2 business days.
9. How we protect your information
We take appropriate, reasonable technical and organisational measures to protect personal information, as required by section 19 of POPIA, including:
- encrypted (HTTPS) connections to the Website and App;
- passwords stored only in hashed form;
- access to the App’s data limited to the founder;
- password-protected backups; and
- payments handled entirely by PayFast, so we never hold card details.
No system is completely secure. If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA.
10. Your rights
Under POPIA, you have the right to:
- ask whether we hold personal information about you and request a copy of it;
- ask us to correct or update inaccurate, incomplete or out-of-date information (you can also edit most information yourself on My Profile);
- ask us to delete your personal information, subject to the legal retention periods in section 8;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time (see section 4.3); and
- lodge a complaint with the Information Regulator.
To use these rights, email info@instead.co.za from the email address on your account. We may ask you to confirm your identity. We confirm receipt within 2 business days and respond within a reasonable time, and within 30 days for a request for access.
Information Regulator (South Africa) Website: inforegulator.org.za General enquiries: enquiries@inforegulator.org.za Complaints: POPIAComplaints@inforegulator.org.za
11. Cookies
11.1 Cookies are small text files stored on your device when you visit a website.
11.2 On the Website (www.instead.co.za) we use:
- essential cookies, which make the Website work and remember your cookie choices; and
- analytics cookies (Google Analytics), which tell us how many people visit, which pages they view and how they found us. This helps us improve the Website.
11.3 Analytics cookies run from your first visit. You can switch them off at any time by choosing “Deny” in the cookie banner, or by changing your choice in the cookie settings link at the bottom of every page. You can also block or delete cookies in your browser settings.
11.4 In the App (app.instead.co.za) we use only essential cookies, such as the session cookie that keeps you logged in. These cannot be switched off without stopping the App from working.
11.5 Google reCAPTCHA on the login and registration pages collects device and usage information to protect against spam and abuse. Its use is subject to Google’s Privacy Policy and Terms of Service.
12. Direct marketing
12.1 We send marketing messages (tips, news and offers by email or WhatsApp) only if you have agreed to receive them, or, as allowed by section 69 of POPIA, if you are an existing customer and the messages are about our own similar services.
12.2 Every marketing message includes a way to opt out. You can also opt out at any time by emailing info@instead.co.za or replying “STOP” on WhatsApp. Opting out does not affect service emails about your account or billing.
13. Children
The App is only for people aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, please contact us and we will delete it.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The “Last updated” date shows the current version. If we make a material change, we will tell you by email or in the App before it takes effect.
15. Contact
For any questions about this Privacy Policy or your personal information, contact our Information Officer, Monique Cloete, at info@instead.co.za or 063 906 4248.