Privacy Policy

Nightstand (Pty) Ltd ("Nightstand", "we", "us") operates the Nightstand mobile application and the website at www.nightstand.co.za. We are the responsible party for your personal information as defined under the Protection of Personal Information Act, 2013 ("POPIA").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have over it.

We do not collect sensitive personal information (such as race, health data, or financial details) unless explicitly required for a specific feature and with your separate consent.

We use your personal information to:

• Create and manage your account and verify your identity.
• Provide the core features: nearby discovery, messaging, calls, panic alerts, and device recovery.
• Display your profile to other users in accordance with your privacy settings.
• Send you transactional communications (OTPs, account notices, support responses).
• Monitor and improve the safety, security, and performance of the platform.
• Detect and prevent fraud, abuse, and violations of our Terms & Conditions.
• Comply with our legal obligations under South African law.
• Send you updates or promotional communications about Nightstand — you may opt out at any time.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Under POPIA, we process your personal information on the following grounds:

• Contract performance — processing necessary to provide the services you signed up for.
• Legitimate interest — fraud prevention, platform security, service improvement, and analytics.
• Consent — location data, optional profile information, and marketing communications. You may withdraw consent at any time.
• Legal obligation — processing required to comply with applicable law.

Location is central to Nightstand's nearby discovery and panic alert features. When you enable location access:

• Your approximate location is used to show you compatible users nearby.
• When you trigger a panic alert, your precise location is shared with your selected emergency contacts and nearby community members.
• Location data is not stored indefinitely — it is used in real time and retained only for the minimum period necessary to deliver the feature.

You can revoke location permission at any time in your device settings. This will disable location-dependent features but will not affect your account.

We share your personal information only in the following circumstances:

• With other users — your profile information (name, photo, availability status, badges) is visible to other Nightstand users in accordance with your privacy settings.
• With service providers — we engage trusted third-party providers for cloud hosting, SMS delivery, push notifications, analytics, and payment processing. These providers process data only on our behalf and under our instructions.
• With emergency contacts — when you trigger a panic alert, your location and alert status are shared with the contacts and community members you have pre-selected.
• With law enforcement — we may disclose information where required by law, court order, or to protect the safety of our users or the public.
• Business transfers — if Nightstand is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before this occurs.

We do not sell your personal information to any third party.

We implement industry-standard technical and organisational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS / TLS).
• Hashed and salted passwords — we never store your password in plain text.
• OTP-based verification for sensitive account changes.
• Role-based access controls limiting who can access personal data internally.
• Regular security reviews and vulnerability testing.

No method of transmission over the internet is 100% secure. If you suspect unauthorised access to your account, contact us immediately at support@nightstand.co.za.

As a data subject under POPIA, you have the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate or incomplete information be corrected.
• Deletion — request that your personal information be deleted (subject to legal retention obligations).
• Objection — object to the processing of your information where we rely on legitimate interest.
• Withdrawal of consent — withdraw consent for processing based on consent at any time, without affecting the lawfulness of prior processing.
• Complaint — lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated.

To exercise any of these rights, email privacy@nightstand.co.za. We will respond within 30 days.

Our website (www.nightstand.co.za) uses cookies and similar technologies to:

• Keep you signed in and remember your preferences.
• Analyse traffic and user behaviour to improve the site (using anonymised analytics).
• Prevent fraud and protect the security of the site.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website. The Nightstand mobile app does not use browser cookies; it uses secure session tokens stored on your device.

Nightstand is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will immediately delete their account and all associated data.

If you believe a minor has registered on Nightstand, please contact us immediately at support@nightstand.co.za.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification or email before the changes take effect. The "Effective date" at the top of this page will always show when the policy was last updated.

Continued use of Nightstand after changes take effect constitutes acceptance of the updated policy.

For any privacy-related question, request, or complaint, please contact our Information Officer: