Information we collect
- Account and contact details: name, email and any phone number or contact links you choose to provide.
- Profile information: city, profession, experience, education, skills, achievements, age range, pronouns, languages, interests, personal statements and design preferences.
- Uploaded material: reference headshots, optional CVs and portfolio content, together with AI-generated portraits and text.
- Historical profile-review records may remain where needed for support or a dispute. New profiles do not require third-party vetting and new review invitations are disabled.
- Payment records: plan, amount, payment reference, transaction status and subscription identifiers. PayFast processes card details; myLongo does not directly store full card numbers.
- Service and safety information: account activity, technical logs, email delivery events, Rotation preferences, introductions, written answers and replies, shared contact details, private connection decisions, ongoing messages, blocks and reports.
Why we use it
- Create and display your profile, process uploaded CV information and generate your chosen content.
- Verify your email and keep you informed about your account.
- Provide Discover and Rotation, where available to your account, and help people connect.
- Process subscriptions, enforce plan allowances and resolve payment problems.
- Prevent fraud and abuse, investigate reports, secure the service and improve reliability.
- Manage recruiter requests only where you separately opted in; see Recruiter Data Sharing.
Grounds for processing
We process information where necessary to provide the service you request, comply with legal duties, pursue legitimate service and security interests, or where you have given consent. Optional permissions, including recruiter participation, are separate from the information needed to run your account. You may withdraw consent; this does not undo lawful processing that occurred before withdrawal.
Public profiles and private information
Published profile content is accessible to visitors who have its URL and may be indexed or shared. Discover eligibility is a separate setting determined by your plan and publication status. Only include contact details in public profile fields if you want visitors to see them.
Optional analytics run only after you allow them. Google Analytics receives general page-view information; our administrative traffic reports store a pseudonymous session identifier, general page categories in visit order, visit times, active time, referring website domain, and broad device, browser, operating-system and country categories for up to 90 days. We do not store raw IP addresses in these reports. We exclude names, search text, query strings and private link identifiers from these analytics events.
Authorized administrators can access information needed to operate, support and protect the service. We do not describe administrative access as an automated-only process.
Service providers and other recipients
We use Vercel for application hosting, Supabase for accounts, database and storage, OpenAI for AI processing, Google Analytics for optional usage analytics, Resend for automated email, and PayFast for payments. GoDaddy/Microsoft services handle our support inbox. These providers receive information needed for their functions and operate under their applicable terms and privacy arrangements.
Selecting WhatsApp opens WhatsApp’s own service with the invitation you choose to share. WhatsApp processes that message under its own terms. We may disclose information where legally required, to address fraud or abuse, or with your specific authorization.
We do not sell private account information or provide an unrestricted database of users to recruiters. Optional recruiter services are governed by the separate Recruiter Data Sharing policy and require your separate consent.
Retention and deletion
We keep account and profile information while it is needed to provide your active service. Contact hello@mylongo.io to request access, correction or deletion. We verify the request, remove information no longer needed, and retain only records still required for lawful purposes such as accounting, payment disputes, security or compliance. Retention depends on the record and its purpose; there is no blanket promise that all records disappear on the same day.
Former review invitations are closed. Closing a link does not automatically delete associated historical records. Operational logs and provider backups have their own retention lifecycles. A deletion request includes a review of uploaded assets; deleting a database record alone is not a guarantee that every known public asset URL has been removed.
myLongo currently does not create Rotation call recordings or transcripts. The Recording and Consent Policy explains the current feature scope.
Your privacy rights
Subject to applicable law, you may request access to your information, correction, deletion, withdrawal of consent, or object to processing. Some information is necessary to provide an account or a feature. Tell us which information or processing your request concerns and we will explain any applicable restriction.
Contact hello@mylongo.io for privacy requests, or Fortune Maleba at maleba@longo.africa. You can also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.
Security and international processing
We use access controls, authenticated administrative functions and other reasonable technical and organizational measures to protect information. No online service can guarantee absolute security.
Our providers may process information outside South Africa. International processing must have a lawful basis under POPIA, including the applicable requirements of section 72. Relevant safeguards may arise from law, binding provider terms or an applicable consent or contractual basis. Contact us for information about the arrangements relevant to your request.
Security incidents
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorized person, we will investigate and notify the Information Regulator and affected people as required by POPIA. Notifications will describe the incident and available protective steps, subject to any lawful delay.
Marketing, organizations and policy changes
Account, payment and security emails are service communications. We do not treat an invitation review or account signup as permission for unrelated marketing. Electronic direct marketing requiring consent will use a separate opt-in and a way to withdraw it.
Where we process information about companies or other juristic persons, this policy applies to that information as appropriate under POPIA. We may update this policy and notify users of material changes by account email or an in-app notice.