This policy explains what personal information Thrive SA collects, why we collect it, who we share it with, how long we keep it, and how you can get it corrected or deleted. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).
It covers two things: this website — the Thrive Check and the Thrive assessment — and the Thrive SA members app, the sign-in-only members service you reach at members.thrivesa.co.za or through the Thrive SA app on Android.
Which parts apply to you. Sections 3.1–3.8 describe this website. Sections 3.9–3.14 describe the members app. Sections 1, 2 and 4 to 12 apply to both.
1. Who is responsible for your information
- Responsible party
- THRIVE SA (PTY) LTD (registration number 2025/741148/07), trading as Thrive SA
- Address
- Cape Town, South Africa
- Privacy contact
- privacy@thrivesa.co.za
- General support
- support@thrivesa.co.za
Our Information Officer can be reached at the privacy address above. You may also complain directly to the Information Regulator (South Africa) — their details are in section 11.
2. What you can do on this site, and in the members app
On this website you can do one thing, and sections 3.1–3.8 follow from it:
- The Thrive Check — a free questionnaire that produces a Thrive Readiness Score out of 100. It is calculated only from the answers you type in. It is not a credit bureau score, it is not obtained from any credit bureau, and lenders do not use it.
- Your contact details — at the end of the questions we ask for your name, cell number and email address, so that we can show you your score, send it to you, and have a consultant follow up.
This site is free, and nothing is sold or paid for on it. We do not ask for your ID number here, we do not ask for card details here, and nothing is retrieved from a credit bureau here. Where a bureau retrieval happens at all, it happens on a separate service with its own consent screen and its own tick box, and never automatically.
2.1 The Thrive SA members app
The members app is the separate service referred to above. It is for people who have taken up Thrive Membership. You cannot create an account in the app. Your account is set up by a Thrive consultant when your membership starts, and you sign in with the details you were given. In the app you can:
- read your own credit information and score, made available following your consent, and follow how they change over time;
- work through a personalised plan built from that information;
- use budget, affordability and credit-usage tools, and dispute letter templates;
- read short lessons on how credit works;
- ask questions in plain language through Zoe, the in-app assistant;
- if you are under debt review, follow your debt review status and keep your debt review paperwork in a private document vault;
- manage your profile and notification preferences, download a copy of your data, and request deletion of your account.
Nothing is bought or paid for in the app. There is no checkout, no in-app purchase and no card entry anywhere in it. Membership is arranged and billed separately by a Thrive consultant.
3. What we collect
3.1 Answers you give us in the Thrive Check
What you are trying to achieve, whether you have recently been declined for credit and what for, your work situation, an income band, whether items such as missed payments, arrears, a judgment or a listing are on your profile, how month-end feels, whether you are under debt review, your timeframe, and how well you feel you know your credit profile. These are your own statements about yourself. We do not verify them at this stage and we do not treat them as fact.
3.2 Contact details
Your name, cellphone/WhatsApp number and email address, collected after the questions so that we can save and send you your result.
3.3 Consent records
Whether you accepted these terms and the privacy policy (required), whether you opted in to marketing (optional), whether you gave bureau consent (only on the bureau screen), the date and time of each, and the version of the wording you agreed to.
3.4 Visitor and session identifiers
A random visitor identifier stored in a cookie on your device for up to one year, and a random session identifier that lasts until you close the tab. Neither contains your name or contact details. They exist so that a part-finished assessment can be continued, so that one person is not counted or contacted twice, and so that we can measure how the service is actually used. See our Cookie Policy.
3.5 Usage events
Which step you reached and when, the page address, the referring website, any campaign source in the link you followed, and whether you are on a mobile or desktop device. Events are linked to your visitor identifier and, once you have given contact details, to your record with us.
3.6 South African ID number — not collected on this site
We do not ask for your ID number on this website. We ask for it only on a separate service, at the point where your credit record is actually to be retrieved. It is used to find your record at the credit bureau and it is never displayed back to anyone. How long it is kept is set out in section 6. This paragraph describes the standalone bureau-retrieval flow; how your ID number is held in the members app is described in 3.10.
3.7 Credit bureau information — only with your bureau consent, and never on this site
Where you have given bureau consent on a separate service, we receive your credit information from the credit bureau. This can include your credit score, your accounts and their balances and payment status, arrears, judgments, defaults and listings, debt review status, and enquiries made about you. This is a soft enquiry for your own information and is not a credit application.
3.8 Payment information
No payment is taken on this website and we never ask for card details here. Where you have paid us for something — now or in the past — your card details were entered on our payment provider's own secure checkout. We never see, receive or store your card number. We receive only confirmation of the outcome, the amount and a payment reference.
3.9 Your member account and profile
Your name, cellphone number and email address, the credentials you sign in with, your membership status and dates, your notification preferences, and any cancellation or deletion request you submit together with the reason you choose to give. Your password is never stored in readable form — nobody at Thrive can read it, and we will never ask you for it.
3.10 Your identifying information and the bureau enquiry
Unlike this website, the members app holds your South African ID number on your member record. It is used to identify you when your credit information is retrieved, and to sign you in.
Where you have given the required consent, your identifying information may be processed through our authorised bureau-access partner in order to retrieve your credit information from a registered credit bureau. Thrive SA operates the member platform and uses the information made available through that authorised arrangement to provide the credit-wellness functionality described in this policy.
3.11 Your credit information and score in the members app
Where the required consent has been given, credit information retrieved through our authorised bureau-access arrangement may be made available within the Thrive SA member platform. Thrive uses this information to display your credit position and provide the member features described in this policy. The registered credit bureau remains the source of the underlying bureau record.
That information can include your credit score and score history, your accounts with their balances and payment status, arrears, judgments, defaults and listings, your debt review status and the debt counsellor recorded against it, and enquiries made about you. We also store the plan and the analysis we generate from it.
3.12 Your conversations with Zoe
Zoe is the assistant inside the app. What you type to Zoe, and the part of your own credit information needed to answer you, is sent off your device to our AI processor, Anthropic, so that a reply can be generated.
Thrive does not store the conversation itself. The thread is held only in the app while it is open, and it is cleared when you sign out or close the app. What we keep is a count of how many messages you sent on a given day, so that fair-use limits can be applied.
Anthropic processes information required to power Zoe on Thrive's behalf. Standard API inputs and outputs are generally deleted from Anthropic's backend within 30 days, subject to limited legal, safety or policy-enforcement exceptions, and Anthropic does not use Thrive's commercial API inputs or outputs to train its models by default.
Please do not type anything into Zoe that you would not want sent to our AI processor. Zoe is not a person. It is not a debt counsellor, a credit provider or a financial adviser, and it cannot make any decision about your account.
3.13 Documents and photos you upload
If you are under debt review, the app gives you a private document vault for the paperwork that process needs — for example a clearance certificate, settlement letters, proof of final payments, a bureau report, or a Form 17.W confirmation. You choose what to upload. Files may be PDFs or photographs, up to 10 MB each. A photograph you pick from your phone is uploaded as it is, including anything else visible in it.
Uploading is optional, files are stored privately against your own member record, and you can delete any of them from the app at any time. Thrive does not check or verify the documents you upload.
3.14 App activity and technical information
Which plan steps and debt-review checklist items you have ticked as done, which lessons you have worked through, and when your credit information was last retrieved.
The app contains no advertising SDK, no analytics SDK and no third-party tracker. It does not use an advertising identifier, and it does not collect your location, your contacts, your calendar, your call history or your photo library — only the individual files you choose to upload under 3.13.
4. Why we use it, and on what lawful basis
| What we do | Information used | Lawful basis (POPIA) |
|---|---|---|
| Calculate and show your Thrive Readiness Score | Your questionnaire answers | Your consent, and performance of the free service you asked for |
| Save your result and send it to you | Name, cell, email | Your consent when you submit the form |
| Retrieve your credit record and prepare a written analysis (separate service, not this site) | ID number, bureau information | Your separate, explicit bureau consent |
| Take payment for a service you bought from us (not sold on this site) | Order and payment confirmation | Performance of our contract with you |
| Have a consultant follow up by phone or WhatsApp about your enquiry | Name, cell, your answers | Our legitimate interest in responding to an enquiry you started; you may ask us to stop at any time |
| Send marketing tips, offers and reminders | Name, cell, email | Only if you ticked the optional marketing box |
| Prioritise which enquiries our consultants call first | Your answers and your activity on the site | Our legitimate interest in running the business efficiently |
| Measure and improve the service | Usage events, visitor/session identifiers | Our legitimate interest in understanding how the service performs |
| Keep records, prevent abuse, meet legal obligations | As applicable | Legal obligation and legitimate interest |
| Members app — give you access to your account and keep it secure | Name, cell, email, ID number, sign-in credentials | Performance of your membership agreement with us |
| Members app — retrieve your credit information and make it available to you | Identifying information required for the bureau enquiry, and the resulting credit information | Your separate, explicit bureau consent |
| Members app — build and update your personalised plan and analysis | Credit information, your goal, your progress | Performance of your membership agreement with us |
| Members app — answer a question you ask Zoe | What you type to Zoe, and the credit information needed to answer it | Performance of your membership agreement, on your instruction each time you ask |
| Members app — store the debt review documents you choose to upload | The files you upload | Your consent, given each time you upload a file |
| Handle a data download, correction, cancellation or deletion request | Your account details and the request itself | Legal obligation under POPIA |
Marketing consent is optional and separate. You will receive your Thrive Score, and a consultant can still follow up with you, whether or not you tick the marketing box. Accepting these Terms and this Privacy Policy is required to use the service; agreeing to marketing is not.
4.1 Internal prioritisation
We calculate an internal priority rating so our consultants know which enquiries to return first. It uses what you told us about your work situation, income band, goal, timeframe and credit situation, and how you have engaged with us. It is not shown to you, it is not a credit score, it is not shared with lenders or credit bureaux, and it is never used to decide the price you pay. We do not use race, gender, age, health, religion, political opinion, trade union membership, biometrics or sexual orientation for this. No decision with a legal or similarly significant effect on you is made by automated means alone — a person is always involved.
5. Who we share it with
| Who | What they get | Why |
|---|---|---|
| Authorised bureau-access partner / registered credit bureau | Identifying information required for the bureau enquiry and the resulting credit information. | To retrieve and make available the member's credit information following the required consent. |
| Payment provider (Yoco) — not used on this site | Your card details, entered directly with them; order amount and reference | To process securely any payment you make to us elsewhere |
| Email provider (Resend) | Your email address and the message | To deliver your result and order emails |
| WhatsApp / messaging provider | Your cellphone number and the message | Only where you opted in, or to respond to an enquiry you started |
| Cloud hosting, database and file storage (Supabase) | The information described above, including your member record, your credit information, your Zoe conversations and any documents you upload, stored securely | To run this website and the members app |
| AI processor (Anthropic) | The content needed to prepare your assessment, or to answer a question you ask Zoe, together with the part of your own credit information needed to answer it | To generate your written assessment and to power Zoe. Anthropic processes this on Thrive's behalf. Standard API inputs and outputs are generally deleted from Anthropic's backend within 30 days, subject to limited legal, safety or policy-enforcement exceptions, and Anthropic does not use Thrive's commercial API inputs or outputs to train its models by default. |
| Thrive SA consultants | Your contact details, your answers, and a summary of your position | To follow up on your enquiry |
| NCR-registered debt counsellor partners | Only what you agree to share, and only if you ask for a referral | Debt counselling is a separate, regulated service we do not provide ourselves |
| Google Play (Android app distribution) | Nothing from your Thrive record. Google receives only what it collects as the app store when you download or update the app | To distribute the Android app |
We do not sell your personal information. Some of these providers process information outside South Africa; where that happens we rely on the provider's contractual commitments to protect it to a standard comparable to POPIA.
6. How long we keep it
| Information | Kept for |
|---|---|
| Unfinished assessments (answers only, no contact details) | Up to 12 months, then deleted |
| Enquiry records that did not become a customer relationship | Up to 24 months from your last activity, then anonymised or deleted |
| South African ID number used for bureau enquiries | May be retained in secure operational records associated with bureau enquiries, including records used to support bureau processing and prevent duplicate retrievals. It is retained only for as long as reasonably required for those purposes and subject to applicable consent, authorised partner, legal and regulatory requirements |
| Bureau information on an order that was never paid | Up to 90 days |
| Your paid Thrive Analysis and its order record | 5 years, to meet record-keeping and tax obligations |
| Usage events | 13 months, then aggregated |
| Your member account, profile and preferences | While your membership is active, and up to 12 months after it ends, subject to earlier lawful deletion |
| Your ID number — members app | Held while required for the member account and authorised bureau functionality, and deleted when the account is deleted unless a lawful retention requirement applies |
| Credit-bureau information in the members app, and the plan and analysis built from it | Retained only for as long as required to provide the member service and as permitted under the applicable consent, authorised partner arrangements and legal or regulatory requirements |
| Your conversations with Zoe | Not stored on our servers. We keep only a daily count of messages sent, for fair-use limits. Anthropic's own copy is generally deleted within 30 days, subject to limited exceptions |
| Documents you upload to the vault | Until you delete them, or until your account is closed |
| Opt-out and deletion records | Kept indefinitely, so that we can honour your request |
7. Your rights
Under POPIA you may ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct or complete anything that is wrong or out of date;
- delete information we no longer have a lawful reason to keep;
- stop using your information for marketing;
- object to processing based on legitimate interest.
Write to privacy@thrivesa.co.za. We respond within 30 days. We may ask you to confirm your identity first. A formal access request is made under the PAIA Manual.
If you are a member, two of these are built into the app, under Profile → Settings → Data & Privacy: Download my data gives you a copy of what we hold about you, and Request account deletion starts a deletion. You do not need the app to do either. Email privacy@thrivesa.co.za and we will handle it the same way.
Our Data Deletion page sets out exactly how deletion works, what you need to give us, what we remove, and what we have to keep.
Some information cannot simply be erased on request — for example records we must keep for tax or accounting purposes, or a record that you asked us not to contact you. Where that applies we will tell you which information we are keeping and why.
8. Stopping messages
- WhatsApp: reply STOP.
- Email: use the unsubscribe link in any message.
- Either: email privacy@thrivesa.co.za.
Opt-outs are recorded on a suppression list that every one of our senders checks before anything goes out, so the request holds even if you come back to the site later. If you have told a consultant you are not interested, we stop marketing contact as well. Messages that are strictly about something you bought — your receipt, or your analysis being ready — are not marketing and are still sent.
9. Security
Traffic is encrypted in transit. Your credit report and order sit behind a private link that is unique to you — treat that link like a password and do not share it. Staff access is restricted by role, and the internal tools our consultants use do not expose your ID number or your card details. No system can be guaranteed perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
In the members app, every request is checked on our servers against your own signed-in session, so one member's record cannot be read by another. Documents you upload are stored privately and are reachable only through a short-lived link issued to you — they are not public and they are not indexed by search engines.
10. Children
The service is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
11. Complaints
Please raise it with us first at privacy@thrivesa.co.za. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 · complaints.IR@justice.gov.za · inforegulator.org.za.
12. Changes
If we change this policy we will update the version and date at the top. Where a change materially affects how we use information you have already given us, we will ask for your consent again rather than rely on the old wording.
Version 1.1 extended this policy to cover the Thrive SA members app — your member account, your identifying information and credit information inside the app, your conversations with Zoe, and the documents you upload. It also describes the bureau enquiry as running through an authorised bureau-access arrangement, and adds the Data Deletion page.