Elora — Privacy Policy

How we protect your personal information under POPIA.

Operated by Daniela Le Roux (Sole Proprietor) · Effective date: 1 September 2026 · Version 2.0

This Privacy Policy is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Introduction and scope

Daniela Le Roux (Sole Proprietor) ("Elora", "we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what personal information we collect through the Elora mobile and web application and related services (the "App"), why we collect it, how we use, share, store, retain, and protect it, and the rights you have under POPIA.

This Policy applies to all users of the App and forms part of our Terms & Conditions. By using the App and providing your information, you acknowledge this Policy. Where we rely on your consent, including where consent is required for health and cycle-related information or other optional processing, we will ask for it separately and clearly.

2. Who we are — Responsible Party and Information Officer

For the purposes of POPIA, the "Responsible Party" is:

• Daniela Le Roux (Sole Proprietor), registration number N/A (Sole Proprietor).
• Address: 1253 Rist Ave, Queenswood, Pretoria, South Africa.

Our Information Officer, who is responsible for our compliance with POPIA and has been appointed and registered with the Information Regulator, is:

• [INFORMATION OFFICER NAME].
• Email: [INFORMATION OFFICER EMAIL].

3. Definitions

• Personal information — information relating to an identifiable, living person (and, where applicable, an identifiable existing juristic person).
• Special personal information — sensitive information, including information about a person's health, sex life, or biometric information. Menstrual-cycle and related health data may fall into this category under POPIA.
• Processing — any operation on personal information, including collecting, storing, using, sharing, adapting, deleting, or otherwise handling it.
• Operator — a third party that processes personal information on our behalf, for example our hosting provider.
• Data subject — the person to whom the personal information relates (you).
• Responsible Party — the person or entity which, alone or in conjunction with others, determines the purpose of and means for processing personal information.

4. The information we collect

4.1 Information you give us

• Account information — your name, email address, password, and account identifiers.
• Profile information — details such as your age or date of birth, gender, fitness goals, experience level, and preferences.
• Payment information — when you subscribe, your payment is processed by our payment provider (Yoco and, for recurring plans, any additional provider). We receive confirmation of payment and limited details; we do not collect or store your full card number where the payment provider handles those details.
• User Content — journal entries, progress photos, body measurements, weight logs, and recipes or notes you upload.
• Communications — information you provide when you contact support or correspond with us.

4.2 Special personal information (health and cycle data)

To provide cycle-synced training and personalised insights, we collect health-related information you choose to provide, including menstrual-cycle dates and phases, symptoms, and physical metrics such as weight and measurements, and progress photos. Some of this information is special personal information under POPIA.

Where consent is the applicable lawful basis or authorisation, we process this information only with your explicit, voluntary, specific, and informed consent, which you may withdraw at any time (see section 13). Where another lawful authorisation under POPIA applies, processing may take place without consent where the statutory requirements are satisfied.

4.3 Information we collect automatically

• Device and technical information — device type, operating system, App version, language and settings.
• Usage information — how you interact with the App, features used, workouts viewed, and general activity logs.
• Notifications — push-notification tokens, if you enable notifications.
• Cookies and similar technologies — see section 14.

4.4 Information from third parties

• Confirmation of payment from our payment providers.
• Where you sign in using a third-party service (for example Google), limited profile information from that provider, subject to its own policy.
• Information supplied by app stores or other integrated services where necessary to provide or administer the Service.

5. How and why we use your information

We process your personal information for the following purposes and on the following lawful bases under POPIA, including consent, performance of our contract with you, our legitimate interests, compliance with the law, and other lawful bases where applicable:

• To create and manage your account and provide the App — performance of our contract.
• To provide cycle-synced training, personalisation, and AI insights — where required, your explicit consent for relevant special personal information, together with any other lawful basis applicable to the processing.
• To process payments, subscriptions, renewals, and transaction records — performance of our contract and compliance with legal obligations.
• To operate trackers and store your progress (journal, photos, measurements) — performance of our contract and, where required, consent.
• To communicate with you about your account, service updates, and support — performance of our contract and our legitimate interests.
• To improve, secure, troubleshoot, and understand use of the App, including analytics — our legitimate interests and other lawful bases where applicable.
• To send you marketing, where permitted and where required with your consent — see section 15.
• To comply with legal obligations, prevent fraud or misuse, and protect our legal rights — legal obligation and legitimate interests.

6. Special personal information and consent

Because cycle and health information is sensitive, we take particular care with it. We collect and use it only for identified and lawful purposes related to the Service and only where an applicable authorisation under POPIA permits us to do so.

Where consent is the applicable authorisation, we shall obtain explicit, voluntary, specific, and informed consent separately from acceptance of these Terms. We do not use acceptance of these Terms as a substitute for consent where separate consent is required.

You can withdraw your consent at any time by adjusting your settings, deleting the relevant data, or contacting our Information Officer, where those mechanisms are available. Withdrawing consent may mean certain personalised or cycle-synced features can no longer function. Withdrawal does not affect processing already lawfully carried out before withdrawal.

7. Children

The App is intended for users aged 18 (eighteen) and older. We do not knowingly collect personal information from children. If we become aware that we have collected information from a person under 18 (eighteen) without appropriate consent or other lawful authorisation, we shall take reasonable steps to delete or otherwise lawfully address it.

8. How we share your information

We do not sell your personal information. We share it only as necessary to provide the App, operate our business lawfully, protect our rights, and comply with applicable law, and with appropriate safeguards, including with the following categories of recipients (Operators and third parties):

• Google Firebase (Google LLC / Google Cloud) — hosting, database (Firestore), authentication, and related infrastructure. Your account and App data may be stored on Firebase infrastructure.
• Google AI services — to generate your personalised recommendations and insights. Relevant profile, activity, and, where lawfully processed, cycle data may be processed to produce these outputs.
• Yoco and other payment providers — to process payments and subscriptions.
• Communication and notification providers — to send emails and push notifications, where used.
• Analytics providers — to understand and improve App usage, where used.
• Professional advisers, authorities, insurers, auditors, and successors — where required or permitted by law, to protect our rights, or in connection with a lawful business transfer.

We require our Operators to process personal information only on our instructions, keep it confidential, and establish and maintain appropriate safeguards as required by POPIA. Where applicable, we shall also enter into written arrangements addressing the Operator's confidentiality and security obligations.

9. Artificial intelligence processing

Some features use automated and AI-based processing to tailor Content and generate insights. We are transparent about this:

• The AI may use the information you provide, such as profile and activity information and, where lawfully processed, cycle data, to generate suggestions.
• Outputs are general guidance, not medical advice, and may be inaccurate; you remain in control of your choices.

Before launch, we shall confirm the actual AI provider(s), categories of information sent to each provider, retention arrangements, whether inputs or outputs are used for provider model training or other secondary purposes, the location of processing, and the contractual safeguards applicable to the processing. This Policy shall be updated if the production architecture materially changes.

Where AI or automated processing is used in a manner that triggers specific rights or requirements under POPIA, including section 71, we shall comply with those requirements.

10. Cross-border transfers

Our service providers, including Google Firebase and Google's AI services, may store or process your personal information on servers or through infrastructure located outside South Africa. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA, including where the recipient is subject to an adequate level of protection, where an applicable agreement provides appropriate safeguards, where the transfer is necessary to perform a contract with you, where you consent, or where another statutory basis applies.

The actual countries, providers, and transfer mechanisms shall be confirmed before production and this Policy shall be kept accurate as the service architecture changes.

11. How we protect your information

We implement appropriate, reasonable technical and organisational measures to safeguard your personal information against loss, damage, and unauthorised access, as required by section 19 of POPIA. These may include encryption in transit, access controls, authentication, secure development practices, appropriate database security rules, least-privilege access, and monitoring and logging appropriate to the nature of the information.

We cannot guarantee that any method of transmission or storage is completely secure. If a security compromise affecting your personal information occurs, we shall take the steps required by section 22 of POPIA, including notifying you and the Information Regulator where required.

12. How long we keep your information

We keep your personal information only for as long as necessary to provide the App, comply with our legal obligations, resolve disputes, prevent fraud, maintain security, enforce our agreements, and protect our legal rights, subject to applicable law.

When you close your account, we shall delete, destroy, or de-identify your personal information within a reasonable period, except where we are required or permitted by law to retain it, for example transaction records, information required for legal claims, security records, or information held in secure backups pending ordinary deletion cycles.

User Content is governed by the Terms & Conditions. We shall not retain User Content indefinitely merely because it was uploaded, but lawful retention requirements and reasonable security, dispute, and backup requirements may apply.

You may also request access to records in accordance with the Promotion of Access to Information Act 2 of 2000 (PAIA), where applicable. Our PAIA Manual shall be made available through the channels specified by Elora.

13. Your rights as a data subject

Under POPIA, and subject to applicable limitations, you have the right to:

• Access the personal information we hold about you and request details of how it is processed.
• Correct or update information that is inaccurate, irrelevant, excessive, out of date, or incomplete.
• Request deletion or destruction of your information where we are no longer entitled to hold it.
• Object to processing on reasonable grounds, and to object to direct marketing.
• Withdraw consent you previously gave where consent is the applicable lawful basis, including consent for health and cycle data, without affecting processing already lawfully carried out.
• Exercise the rights available to you in relation to automated decision-making where section 71 applies.
• Lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer at [INFORMATION OFFICER EMAIL]. We may need to verify your identity before acting on a request. Certain requests may be made using forms prescribed under POPIA and may be subject to lawful procedures or fees.

14. Cookies and similar technologies

The App and website may use cookies and similar technologies to keep you signed in, remember your preferences, maintain security, understand usage, and support functionality. We may use essential technologies and, where applicable, analytics or other technologies.

You can control cookies through your browser or device settings; disabling them may affect how the App or website works. Where consent is legally required for a particular technology, the relevant consent or preference mechanism shall be provided.

15. Direct marketing

We will send you service-related communications that are necessary to administer your account or Subscription. These are distinct from direct marketing.

We will only send you electronic marketing, such as promotional emails or push notifications, where permitted by section 69 of POPIA and other applicable law. Where consent is required, we shall obtain it appropriately and separately from acceptance of these Terms. You can opt out at any time using the unsubscribe link, your notification settings, or by contacting us. We will honour opt-out requests.

We will not use health, cycle, or other special personal information for direct marketing merely because it was collected for the purpose of providing the Service.

16. Links to third-party sites

The App may link to third-party websites or services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy policies before providing them with personal information.

17. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to the App, technology, our processing practices, or applicable law. We will post the updated Policy in the App and update the effective date, and where changes are material we will take reasonable steps to notify you.

Continued use of the App after changes take effect indicates your acknowledgement of the updated Policy, except where applicable law requires fresh consent or another form of notice or acceptance.

18. How to contact us and lodge a complaint

For any privacy question, to exercise your rights, or to lodge a complaint with us, contact our Information Officer:

• [INFORMATION OFFICER NAME] — [INFORMATION OFFICER EMAIL].
• Daniela Le Roux (Sole Proprietor), 1253 Rist Ave, Queenswood, Pretoria, South Africa.

You also have the right to complain to the Information Regulator (South Africa).

• Website: https://inforegulator.org.za
• POPIA complaints email: POPIAComplaints@inforegulator.org.za
• General enquiries email: enquiries.IR@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

Confirm the Information Regulator's current contact details before publication.