Privacy Policy

FUNXTOURS (Pty) Ltd ("FUNXTOURS", "we") runs funxtours.co.za, a website for finding and booking attractions, hotels and B&Bs in South Africa. We are responsible for the personal information described here, in terms of the Protection of Personal Information Act, 2013 (POPIA).

Company registration number: 2026/689182/07
Physical address: 52 Mlambo section, Phalaborwa, Limpopo, 1392
Information Officer: contact info@funxtours.co.za
Email: info@funxtours.co.za

• Account details: your name, email address, phone number (if you give it) and whether you are a guest or a host. Your password is stored only as a one-way scrambled code (a hash), so nobody at FUNXTOURS can see it.
• If you sign in with Google or Apple: your name, email address and an account reference from them. We never see your Google or Apple password.
• Bookings: what you booked, dates, number of guests, prices, discounts and FunX Coins used, and the booking and refund status.
• Payments: card payments are handled by Paystack. Your card details go directly to Paystack and never pass through or get stored by FUNXTOURS.
• Hosts: business and contact details, listing details and photos, and the answers to our registration questions (for example whether you hold the licences, permits and insurance your business needs). Payouts are made by Paystack, which holds your full bank details; we keep only the bank name and the last 4 digits of the account.
• Build My Trip requests: your name, contact details and the trip preferences you send us.
• Booking chats: the messages you send to your host or guest about a paid booking, and when you last read the chat. Phone numbers, email addresses and links are hidden automatically before a message is saved.
• Reviews, your wishlist and your FunX Coins balance.
• Security information: your internet (IP) address, sign-in times, failed sign-in attempts and important account changes, kept to protect your account and stop fraud.

When you add a listing, you place a pin on a map to show exactly where it is. That location is saved with the listing and shown publicly on its page, so guests can find it. The map may ask to use your current position to start in the right place. If you allow it, your browser uses your position only to move the map on your own device: FUNXTOURS does not receive or store it. If you press "Get directions" on a listing, Google Maps opens in a new tab, and Google may use your location under its own privacy policy.

When you use Ask FUNXTOURS, the question you type is sent to an AI service provided by Anthropic, which works out what you are looking for, such as the type of place or the area. We also use your words to search our listings. We do not send your name, email address or other account details with it, and Anthropic handles it under its own terms and privacy commitments. Please don't put personal information in your question. AI can make mistakes, so check the details of what you find.

When you use Build My Trip, your trip answers (area, interests, dates, number of travellers, budget and notes) are sent to the same AI service to suggest trip options. Your name, email address and phone number are never sent to it.

To keep these features fair and affordable, each person can use the AI a few times a day; after that you get our standard search and trip suggestions instead. To count this, we keep a daily tally linked to your account, or, if you are not signed in, to a scrambled code made from your IP address (we don't store the address itself). These tallies are deleted after 2 days.

• To create and run your account, and to confirm your email address belongs to you.
• To make, manage and pay for bookings, and to pay hosts.
• To keep accounts secure and to prevent fraud and misuse.
• To keep the financial records the law requires.
• To contact you about your bookings, account and enquiries.
• To let guests and hosts message each other about a paid booking, to email you when you have a new message, and to help resolve complaints and disputes.

We do not sell your personal information, and we do not use it for advertising. We will only send you marketing messages if you have asked to receive them.

• The host of a listing you book, who receives the details they need to host you, such as your name, dates and number of guests. Guests with a confirmed booking can see the host's contact details.
• The other person in a booking chat: your host or guest sees the messages you send them. Hosts see a guest's first name only.
• Paystack, to process payments, refunds and host payouts.
• Supabase, which hosts our database and photo storage.
• Resend, which delivers the emails we send you (such as sign-in codes and booking messages), and Zoho, which hosts our email inbox.
• Google or Apple, only if you choose to sign in with them.
• Cloudflare and Render, which host our website and server software, and so handle technical details such as your IP address when you use the site. Cloudflare also gives us simple visitor statistics (how many people visit and which pages), without cookies and without identifying you.
• Anthropic, whose AI service reads the questions you type into Ask FUNXTOURS (see section 4).
• Google Fonts, which supplies our fonts (your browser connects to Google directly to load them).
• OpenStreetMap, whose servers supply the map images on listing pages (your browser connects to them directly to load the map).
• Authorities such as the police or a court, but only where the law requires us to.

Each of these service providers may only use your information to provide their service to FUNXTOURS.

Booking chats are private between the guest and the host. FUNXTOURS staff may read a booking chat only to resolve a complaint or dispute, or to investigate fraud, safety concerns or misuse of the site. Every time this happens it is recorded, with who opened the chat and when.

Our database and photo storage are hosted in the European Union (Frankfurt, Germany). The EU's General Data Protection Regulation gives your information a level of protection comparable to POPIA, as POPIA requires for transfers outside South Africa. Our website and server software run on Netlify and Render, and the AI service for Ask FUNXTOURS is provided by Anthropic. These, and Paystack, Resend, Zoho, Google and Apple, may also process information outside South Africa, including in the United States, under their own data protection commitments.

• Your account details: until you delete your account.
• Booking and payment records: for at least five years, because South African tax law requires us to keep them. If you delete your account, these records are kept with your name and contact details removed.
• Security and activity records: 180 days, then deleted automatically.
• Sign-ups that were never confirmed: deleted after 7 days.
• Build My Trip requests: deleted after 12 months.
• Sign-in codes: deleted within a day.
• Booking chat messages: deleted automatically 7 days after they are sent, for both people in the chat and for FUNXTOURS. Deleted messages cannot be recovered. If you delete your account, the messages you sent are removed straight away.

Every account uses two-step verification with a code sent to your email. Connections to the site are encrypted, sign-ins are held in a secure cookie that other scripts cannot read, passwords are stored only as hashes, repeated guessing is automatically blocked, and only FUNXTOURS' own systems can reach the database. Card details never touch our systems.

If a security breach ever affects your personal information, we will tell you and the Information Regulator as POPIA requires.

• See your information: download everything we hold about you from your account settings ("Download my data"). This includes the chat messages you sent in the last 7 days.
• Correct it: update your details in your account settings, or ask us to.
• Delete it: delete your account from your account settings. Booking and payment records are kept anonymised, as explained above.
• Object to how we use your information, or withdraw your consent, by emailing us.
• Complain to the Information Regulator if you are unhappy with how we handle your information (inforegulator.org.za).

For any privacy request, email info@funxtours.co.za. We may need to confirm your identity first, to protect your information.

We use only what the site needs to work: a secure cookie that keeps you signed in, and small settings saved in your browser (such as your light or dark mode choice and your name, to show the right menus). We do not use analytics, advertising or tracking cookies.

You must be 18 or older to create a FUNXTOURS account. Bookings for children must be made by a parent or guardian.

If we change this policy in a way that matters, we will ask you to read and accept the new version the next time you use FUNXTOURS.