Privacy Policy

Adults-only service

Lalela is intended for adults aged 18 or older. It is not directed to children, and people under 18 may not register for or use the service, including with a parent or guardian’s permission.

We do not intentionally seek personal information from people under 18. If we become aware that an account belongs to someone under 18, we may restrict or close the account and handle associated personal information in accordance with applicable legal obligations and retention requirements. Contact support@lalela.net if you believe an under-18 person has provided information to Lalela.

Data collection

We collect account and profile details needed to provide the service, including name, email address, phone number, profile image, selected community information, and account verification status.

We also collect service-use data such as app events, session metadata, device and platform indicators, notification token state, and optional location data when a user enables location features.

• Identity and profile: name, email, phone, profile details
• Invitation contact details: when a community moderator opens Invite Members or the list of pending invitations in the mobile app and allows Contacts access, Lalela reads names, phone numbers, email addresses, contact photos and messaging/social/link fields used to identify a WhatsApp entry on the contact card locally. These details show a list the moderator can choose from and help name people already invited. While Contacts access is allowed and checking has not been stopped, phone numbers and email addresses from those device contacts (not names or photos) are sent to Lalela automatically over an encrypted connection only to check whether each person already has a verified Lalela account, is a member of the community, or has a pending invitation; they are not stored or logged, and the moderator sees only that status, not account details. Manually typed invitation details are not sent for automatic contact matching. Stop and resume controls are available in Invite Members and the pending-invitations list; the preference is stored on that device. For each person the moderator selects and invites, an email invitation sends only the email address the moderator chose for that person to Lalela so the invitation email can be delivered. An in-app invitation to an existing Lalela member is recorded against that member’s account so they can accept or decline it. SMS and WhatsApp invitations open the moderator’s own messaging app with the chosen phone number and the invitation text, and are sent by the moderator. After the moderator sends one, the app sends that phone number to Lalela once so Lalela can record the invitation: Lalela stores only a one-way coded form of the number (a keyed hash, from which the number cannot be read back), the channel used (SMS or WhatsApp), and when it was sent, so the community can see that the person was already invited and when, and so the invitation can be marked as accepted if that person later joins with the same verified phone number. Lalela does not upload or synchronize the device address book, read it in the background, or store contacts who were not invited.
• Device calendar: when you tap Add to calendar on a community event, Lalela opens the device event editor with that event’s details. You choose whether to save it. Lalela does not read existing calendar entries, synchronize calendars, or send or store a copy of the calendar entry on Lalela servers.
• Community content and safety records: posts, notices, listings, messages, uploaded media, reports, blocks, and moderation events
• Technical telemetry: device type, app version, request and error diagnostics
• Location signals: saved/default location, precise community location sharing, and separate emergency/security location updates when enabled
• Purchase records: store product references, receipt or transaction identifiers, payment status, entitlement state, and billing timestamps

Why we process data

We process data to provide core platform functions such as account access, community communication, emergency workflows, support handling, and service security.

We use account and community location controls to provide location-aware features. When you enable location sharing for an account and a community, precise coordinates may be shown to active members who can access that community. Emergency/security location is separate and is available only through eligible safety-response features when the required responder and opt-in controls are enabled. You can turn off location sharing in the app; this does not automatically remove location already included in earlier posts, listings, or safety records, or other stored records retained for service, safety, or legal needs.

We process purchase and entitlement records to verify store purchases, provide paid digital services, manage access, reconcile transactions, and respond to support or refund requests. We also use reports and block records to review safety concerns and prevent blocked accounts from starting or sending direct conversations with one another.

When a moderator selects contacts and taps Share Invite, Lalela uses each selected person’s chosen email address only to send that community invitation email, and records an in-app invitation and sends a notification to selected people who already have a Lalela account. Chosen phone numbers for SMS or WhatsApp are passed to the moderator’s own messaging app on the device; after the message is sent, Lalela records only a keyed hash of the number with the channel and time sent, to avoid repeat invitations, show the moderator when the person was invited, and close the invitation when the person joins. Contact matching runs automatically only for device contacts while the moderator allows Contacts access and has not stopped checking; manually typed invitation details are not sent for automatic matching. Phone numbers and email addresses are compared with verified Lalela accounts and the community’s members and invitations, and are discarded after each check.

When you choose Add to calendar, Lalela passes the selected community event details to the operating system’s event editor. The resulting calendar entry is managed by your device and calendar provider. An event identifier returned by the operating system is discarded by the app; Lalela does not send it to its servers or store it, and does not read existing calendar contents.

Processing is also used for abuse prevention, fraud mitigation, platform reliability, and legal compliance obligations.

Financial transactions, returns, and refunds

The platform includes paid digital services such as annual memberships and community setup and renewal. These digital purchases are handled through Apple In-App Purchase on iOS or Google Play Billing on Android. We do not accept payment for these services on the web.

We store only the transaction and entitlement details necessary for account management, reconciliation, support, and compliance. We do not intentionally store full card numbers in app-level records.

• Membership product references (for example R99/year)
• Community activation purchase references (for example R999 once-off)
• Payment status, receipt references, and billing timestamps
• Refund and return queries are handled via support@lalela.net

Sharing and disclosure

Content you submit is shown to people who have access to the relevant community; direct messages are shown to their conversation participants. A report you submit, including its reason and related account or content details, is made available to authorized community administrators or moderators and Lalela staff responsible for safety review. Blocking another account limits direct messaging and new direct conversations between those accounts; it does not remove that account’s posts or other content from a community feed.

For a community email invitation, the selected email address and invitation details are sent to the email delivery provider configured for Lalela, and the address is stored in Lalela’s community invitation record. SMS and WhatsApp invitations are composed in the moderator’s own messaging app and sent by the moderator through their own mobile network or WhatsApp; Lalela does not send them and stores only a keyed hash of the phone number used, not the number itself.

If a community moderator has your verified phone number or email address in their device contacts and opens Invite Members or their community’s invitation list with Contacts access allowed and checking enabled, Lalela tells that moderator only whether you have a Lalela account, whether you are an active or inactive member of their community, and whether you have a pending invitation to it and when it was sent. Manually typed invitation details are not checked automatically. Your name, account details and other contact details are not shown. Moderators can stop or resume contact checking from either invitation screen. Moderators can send you an in-app invitation, which you can accept or decline, and can cancel invitations they have sent.

When the required account and community location-sharing controls are enabled, precise coordinates may be visible to active members authorized in that community. Emergency/security coordinates are shared separately with people authorized to use the relevant safety-response features. A saved/default location may also be used with new content or business details when the location feature is enabled.

We share data with trusted processors and infrastructure providers strictly as needed to run the service, such as hosting, storage, email delivery, notifications, and operational security providers.

Lalela’s servers, database, uploaded media and email are hosted in South Africa by Axxess DSL (Pty) Ltd.

Some other providers process information outside South Africa. In particular, Apple and Google process app-store purchase records and push-notification delivery data, and Google processes map and place requests, on their own infrastructure. Information is transferred only as needed to provide the feature you or your community use, and we use providers that apply their own data-protection safeguards.

We may disclose information when legally required, to protect users and communities, or to enforce service rules and prevent abuse.

Retention and deletion timing

Data is retained only for as long as needed for service operation, entitlement and billing records, dispute handling, legal obligations, and safety investigations.

A community invitation expires seven days after it was last sent. The email address, or the keyed hash of the phone number, stored in an invitation record is removed by an automatic daily clean-up once the invitation has been expired for 90 days, or once it is 90 days old and has been accepted, declined or cancelled. The invitation record itself, without those contact details, may be kept for community moderation history.

Phone numbers and email addresses sent for contact checking while Contacts access is allowed are not stored; they are discarded once each check is complete.

When deletion is requested and legally permitted, we remove or anonymize eligible records within operational and compliance windows.

User rights and account/data deletion

Users may request access, correction, restriction, portability, objection, and deletion of personal data under applicable laws including POPIA and GDPR where applicable.

If you received a Lalela community invitation but do not have an account, you may contact support about the email address or phone number used for that invitation. Include the invited address or number and the community name so we can assess the request.

To request immediate account and data deletion, send a request with your account email and phone number for verification.

If you are not satisfied with how your personal information has been handled, you may lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

• Step 1: Send an email with subject "Data Deletion Request"
• Step 2: Include account identifiers (email, phone, and community name if known)
• Step 3: We verify identity and process eligible deletion

Privacy contact

Lalela is operated by Lalela Digital, Wolf’s Lair, Witelsbos, South Africa, which is the responsible party for personal information processed through Lalela.

Information Officer: Steven G Mohaud. Contact the Information Officer at support@lalela.net with the subject "Information Officer".

For privacy, data rights, or refund-related inquiries, contact support@lalela.net.