Privacy

Effective 23 April 2026 · POPIA-aligned · plain English

I.Who we are

cheekyleaf is an independent product provenance registry for South African cannabis, operated by Xfold Development. The responsible party under the Protection of Personal Information Act, 2013 ("POPIA") is:

• Kyle Gradus-Samson
• Contact: hello@cheekyleaf.co.za

Written identity verification requests are handled on a case-by-case basis via that email address.

II.What we collect

If you submit the interest form on cheekyleaf.co.za, we collect:

• The role you selected (supplier, retailer, customer, partner, other)
• Your name or business name
• Your email address
• Optional free-text notes you add about how you hope to use cheekyleaf
• A one-way cryptographic hash of your IP address (not your raw IP) and your browser user-agent string, for basic abuse prevention
• The verbatim consent text you agreed to, stored as legal evidence of your POPIA consent
• Timestamp of submission

We do not use cookies, analytics trackers, or advertising pixels on this site. There is no hidden tracking.

III.Why we collect it

One purpose only: to contact you about the cheekyleaf registry when your lane opens, and to send you a confirmation of your interest. We do not sell, rent, or share your contact details with any third party for marketing.

IV.Legal basis

Your explicit consent, given when you ticked the POPIA consent checkbox on the form. Under POPIA section 11(1)(a), that consent is the lawful basis for processing. You can withdraw consent at any time by replying to any cheekyleaf email with the word "remove", or emailing hello@cheekyleaf.co.za. On withdrawal, we delete your record within seven days.

V.Who else processes your information

cheekyleaf uses several operators (POPIA term for sub-processors) to run the service. We've picked infrastructure providers that operate under strong data-protection regimes — mostly EU, which offers protection equal to or stronger than POPIA.

Each of these operators is bound by its own data-processing agreement and is contractually required to process your information only on cheekyleaf's instructions. None of them use your information for their own marketing.

VI.How long we keep it

Until one of the following happens:

• You ask us to delete it.
• cheekyleaf discontinues the waitlist (in which case records are deleted within 30 days of the discontinuation announcement).
• Three years elapse from your submission date without any contact — whichever comes first.

VII.Your rights

Under POPIA you are entitled to:

• Know whether cheekyleaf holds your personal information (section 23)
• Request a copy of it
• Request correction or deletion of inaccurate, incomplete, misleading or excessive information (section 24)
• Object to processing (section 11(3))
• Withdraw consent at any time (section 11(2))
• Lodge a complaint with the Information Regulator if you believe cheekyleaf has mishandled your information

To exercise any right, email hello@cheekyleaf.co.za with the subject line "POPIA request". We respond within seven working days.

VIII.Security

All traffic to cheekyleaf.co.za uses HTTPS. Database access is restricted by row-level security policies and authenticated API keys. Raw IP addresses are never stored; only a salted one-way SHA-256 hash that cannot be reversed. Secret credentials are held in the hosting platform's secret vault, not in source code.

IX.Information Regulator

If you are not satisfied with how cheekyleaf has handled your information, you may contact:

• The Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001
• Email: enquiries@inforegulator.org.za
• Web: inforegulator.org.za

X.Changes to this notice

We'll update this page as cheekyleaf grows and adds features. Meaningful changes will be reflected in the Effective date above, and notified to existing waitlist members by email where practical.