Legal / Privacy

Privacy policy.

We keep the personal information you give us safe, we use it only to run the club, and you stay in control of it. This policy explains how, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

Last updated 30 September 2026

1. Who we are

Tiny Monsters Club ("the club", "we", "us") runs tinymonstersclub.co.za: an online shop for exotic animals, feeders and gear, a keepers' club with the Creature Log, the Club Market, the Open Market, the Exchange and The Molt Block auction house. We are the responsible party for your personal information under POPIA.

Business: Tiny Monsters Club
Email: [email protected]

2. What we collect

We only collect what we need for the service you use.

Account details: your name, email address, password (stored encrypted, never readable by us), display name, handle, profile picture, bio and province.
Contact and delivery details: phone number, delivery and billing addresses for orders, auctions and courier deliveries.
Verification details for club dealers: a verified phone number and the result of an identity and face check. The identity check is done by a specialised verification provider. We store only whether you passed, not copies of your ID document or face scan.
Your animals: what you record in the Creature Log, such as species, names, photos, feeding, molts, pairings and notes. Creature photos are private unless you make a specimen card public.
Buying and selling: orders, listings, bids, auction results, ratings, Exchange posts and the messages you send to other members on the site.
Payments: payments are processed by Paystack. We never see or store your full card number. Sellers give their bank details to Paystack to receive payouts; we keep only a masked account number and the Paystack reference.
Questions to Peter and photos for the identifier: the questions you ask our AI keeper and the photos you upload for species identification.
Technical information: your IP address, browser type and the pages you visit, used for security, fraud prevention and to keep the site working.

3. How we use it

We use your information for these purposes, and only where POPIA allows it (to perform our agreement with you, to meet legal duties, for our legitimate interests, or with your consent):

to create and run your account and membership;
to process orders, payments, payouts, deliveries, live-arrival claims and refunds;
to run the marketplaces and auctions, including fees, bidding, winners and ratings;
to vet club dealers and keep the club safe from fraud and abuse;
to send feeding reminders, calendar reminders and order updates you asked for;
to answer your questions to Peter using your own Creature Log records;
to answer support requests and handle reports and disputes;
to meet our legal and tax duties; and
to send newsletters and early-access news, only if you asked for them.

We do not sell your personal information.

We share personal information only when it is needed to provide the service, and only with parties that must keep it confidential and secure:

Other members, when you trade: a buyer and seller see each other's display name and the details needed to complete the deal, such as the delivery address for the order. Your public profile shows what you choose to show.
Paystack for card payments, split payments and seller payouts.
Courier companies (such as The Courier Guy) for deliveries and tracking.
Our email provider (useSend) to deliver account, order and reminder emails.
Our identity verification provider for club dealer checks.
Anthropic, the provider of the AI model behind Peter, the species facts and the photo identifier. We send only what is needed to answer the request.
Our hosting and IT providers that run and secure the website.
Authorities, when the law requires it, for example the South African Revenue Service, the police or a court order.

5. Information sent outside South Africa

Some of our service providers (for example our email provider and our AI provider) process information on servers outside South Africa. We use them only where the law of that country, or our agreement with the provider, protects your information to a standard similar to POPIA, as section 72 of POPIA requires.

6. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires. Order, payment and tax records are kept for at least five years. When you close your account, we delete or anonymise your profile, Creature Log and messages within a reasonable time, except records we must keep by law or to resolve a dispute.

7. How we protect it

We use reasonable technical and organisational measures to protect your information: encrypted connections (HTTPS), encrypted passwords, private storage for your photos and uploads, access limited to people who need it, and regular security updates. If we become aware of a data breach that affects you, we will tell you and the Information Regulator as POPIA requires.

8. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and get a copy of it;
ask us to correct information that is wrong or out of date;
ask us to delete information we no longer need or are not allowed to keep;
object to the use of your information for direct marketing, at any time and free of charge;
withdraw your consent where we rely on consent; and
lodge a complaint with the Information Regulator.

You can update most details yourself in your account. For anything else, email [email protected]. We may ask you to confirm your identity before we act on a request.

9. Emails and marketing

We send service emails that you need, such as order updates and password resets. We send newsletters and early-access news only when you sign up for them. Every newsletter has an unsubscribe link, and you can unsubscribe at any time.

10. Cookies

We use essential cookies to keep you logged in, keep your cart and protect forms against misuse. These cookies are needed for the site to work. We also store your cookie choice in a first-party cookie. We only use optional cookies, such as privacy-friendly visitor statistics, if you accept them in the cookie banner. You can change your choice at any time with "Manage preferences" in the cookie banner.

11. Children

Accounts are for people aged 18 and older. Younger keepers may use the club only through a parent or guardian's account and with their consent. We do not knowingly collect personal information from children without that consent.

12. Changes to this policy

We may update this policy when our services or the law change. We will show the new date at the top of this page, and we will tell members by email about important changes.

13. Contact and complaints

If you have a question or a concern about your personal information, contact us first and we will try to resolve it.

You may also complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

Business: Tiny Monsters Club
Email: [email protected]