This policy explains what personal information Thrive SA collects, why we collect it, who we share it with, how long we keep it, and how you can get it corrected or deleted. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).
It covers two things: this website — the Thrive Check and the Thrive assessment — and the Thrive SA members app, the sign-in-only members service you reach at members.thrivesa.co.za or through the Thrive SA app on Android.
Which parts apply to you. Sections 3.1–3.8 describe this website. Sections 3.9–3.15 describe the members app. Sections 1, 2 and 4 to 12 apply to both.
1. Who is responsible for your information
- Responsible party
- THRIVE SA (PTY) LTD (registration number 2025/741148/07), trading as Thrive SA
- Address
- Cape Town, South Africa
- Privacy, POPIA and support contact
- support@thrivesa.co.za
Our Information Officer can be reached at this address. Privacy, POPIA, access, correction, deletion and consent-withdrawal requests are all handled there. You may also complain directly to the Information Regulator (South Africa) — their details are in section 11.
2. What you can do on this site, and in the members app
On this website you can do one thing, and sections 3.1–3.8 follow from it:
- The Thrive Check — a free questionnaire that produces a Thrive Readiness Score out of 100. It is calculated only from the answers you type in. It is not a credit bureau score, it is not obtained from any credit bureau, and lenders do not use it.
- Your contact details — at the end of the questions we ask for your name, cell number and email address, so that we can show you your score, send it to you, and have a consultant follow up.
This site is free, and nothing is sold or paid for on it. We do not ask for your ID number here, we do not ask for card details here, and nothing is retrieved from a credit bureau here. Where a bureau retrieval happens at all, it happens on a separate service with its own consent screen and its own tick box, and never automatically.
2.1 The Thrive SA members app
The members app is the separate service referred to above. It is for people who have taken up Thrive Membership. You cannot create an account in the app. Your account is set up by a Thrive consultant when your membership starts, and you sign in with the details you were given. In the app you can:
- read your own credit information and score, made available following your consent, and follow how they change over time;
- work through a personalised plan built from that information;
- use budget, affordability and credit-usage tools, and dispute letter templates;
- read short lessons on how credit works;
- ask questions in plain language through Zoe, the in-app assistant;
- if you are under debt review, follow your debt review status and keep your debt review paperwork in a private document vault;
- manage your profile and notification preferences, download a copy of your data, and request deletion of your account.
Nothing is bought or paid for in the app. There is no checkout, no in-app purchase and no card entry anywhere in it. Membership is arranged and billed separately by a Thrive consultant.
3. What we collect
3.1 Answers you give us in the Thrive Check
What you are trying to achieve, whether you have recently been declined for credit and what for, your work situation, an income band, whether items such as missed payments, arrears, a judgment or a listing are on your profile, how month-end feels, whether you are under debt review, your timeframe, and how well you feel you know your credit profile. These are your own statements about yourself. We do not verify them at this stage and we do not treat them as fact.
3.2 Contact details
Your name, cellphone/WhatsApp number and email address, collected after the questions so that we can save and send you your result.
3.3 Consent records
Whether you accepted these terms and the privacy policy (required), whether you opted in to marketing (optional), whether you gave bureau consent (only on the bureau screen), the date and time of each, and the version of the wording you agreed to.
3.4 Visitor and session identifiers
A random visitor identifier stored in a cookie on your device for up to one year, and a random session identifier that lasts until you close the tab. Neither contains your name or contact details. They exist so that a part-finished assessment can be continued, so that one person is not counted or contacted twice, and so that we can measure how the service is actually used. See our Cookie Policy.
3.5 Usage events
Which step you reached and when, the page address, the referring website, any campaign source in the link you followed, and whether you are on a mobile or desktop device. Events are linked to your visitor identifier and, once you have given contact details, to your record with us.
3.6 South African ID number — not collected on this site
We do not ask for your ID number on this website. We ask for it only on a separate service, at the point where your credit record is actually to be retrieved. It is used to find your record at the credit bureau and it is never displayed back to anyone. How long it is kept is set out in section 6. This paragraph describes the standalone bureau-retrieval flow; how your ID number is held in the members app is described in 3.10.
3.7 Credit bureau information — only with your bureau consent, and never on this site
Where you have given bureau consent on a separate service, we receive your credit information from the credit bureau. This can include your credit score, your accounts and their balances and payment status, arrears, judgments, defaults and listings, debt review status, and enquiries made about you. This is a soft enquiry for your own information and is not a credit application.
3.8 Payment information
No payment is taken on this website and we never ask for card details here. Where you have paid us for something — now or in the past — your card details were entered on our payment provider's own secure checkout. We never see, receive or store your card number. We receive only confirmation of the outcome, the amount and a payment reference.
3.9 Your member account and profile
Your name, cellphone number and email address, the credentials you sign in with, your membership status and dates, your notification preferences, and any cancellation or deletion request you submit together with the reason you choose to give. Your password is never stored in readable form — nobody at Thrive can read it, and we will never ask you for it.
3.10 Your identifying information and the bureau enquiry
Unlike this website, the members app holds your South African ID number on your member record. It is used to identify you when your credit information is retrieved, and to sign you in.
Where you have given the required consent, your identifying information may be processed through our authorised bureau-access partner in order to retrieve your credit information from a registered credit bureau. Thrive SA operates the member platform and uses the information made available through that authorised arrangement to provide the credit-wellness functionality described in this policy.
3.11 Your credit information and score in the members app
Where the required consent has been given, credit information retrieved through our authorised bureau-access arrangement may be made available within the Thrive SA member platform. Thrive uses this information to display your credit position and provide the member features described in this policy. The registered credit bureau remains the source of the underlying bureau record.
That information can include your credit score and score history, your accounts with their balances and payment status, arrears, judgments, defaults and listings, your debt review status and the debt counsellor recorded against it, and enquiries made about you. We also store the plan and the analysis we generate from it.
Credit information can also come from a report that you give us yourself. That is described in section 3.15.
3.12 Your conversations with Zoe
Zoe is the assistant inside the app. What you type to Zoe, and the part of your own credit information needed to answer you, is sent off your device to our AI processor, Anthropic, so that a reply can be generated.
Thrive does not store the conversation itself. The thread is held only in the app while it is open, and it is cleared when you sign out or close the app. What we keep is a count of how many messages you sent on a given day, so that fair-use limits can be applied.
Anthropic processes information required to power Zoe on Thrive's behalf. Standard API inputs and outputs are generally deleted from Anthropic's backend within 30 days, subject to limited legal, safety or policy-enforcement exceptions, and Anthropic does not use Thrive's commercial API inputs or outputs to train its models by default.
Please do not type anything into Zoe that you would not want sent to our AI processor. Zoe is not a person. It is not a debt counsellor, a credit provider or a financial adviser, and it cannot make any decision about your account.
3.13 Documents and photos you upload
If you are under debt review, the app gives you a private document vault for the paperwork that process needs — for example a clearance certificate, settlement letters, proof of final payments, a bureau report, or a Form 17.W confirmation. You choose what to upload. Files may be PDFs or photographs, up to 10 MB each. A photograph you pick from your phone is uploaded as it is, including anything else visible in it.
Uploading is optional, files are stored privately against your own member record, and you can delete any of them from the app at any time. Thrive does not check or verify the documents you upload.
3.14 App activity and technical information
Which plan steps and debt-review checklist items you have ticked as done, which lessons you have worked through, and when your credit information was last retrieved.
The app contains no advertising SDK, no analytics SDK and no third-party tracker. It does not use an advertising identifier, and it does not collect your location, your contacts, your calendar, your call history or your photo library — only the individual files you choose to upload under 3.13.
3.15 Credit reports you give us
You can give Thrive a copy of your own credit report, which you got from a credit bureau or from the free annual report. The preferred way is a secure upload: a Thrive team member, or the Thrive partner who signed you up, uploads it for you if you ask them to and they have your authority.
You can also e-mail it to our support mailbox, support@thrivesa.co.za, and a Thrive team member will upload it. If you do, the e-mail services you use, and the e-mail service that hosts our mailbox, also handle that copy. Thrive deletes the temporary copies it controls (in the mailbox and in any file downloaded from it) within 7 days after the report has been uploaded. Thrive cannot make the e-mail services, or their backups, delete their copies. We do not accept reports by WhatsApp or any other messaging service at this time. If that changes, we will update this policy before we start.
What we collect. The report file (a PDF) and the information we read from it: your score, your accounts with their balances and payment status, arrears, judgments, defaults, debt review status, and enquiries made about you. The report also shows your name and ID number, which we use to check that the report is yours. To write your plan we also use what you told us when you joined about your goal, your work situation, your income and whether you were recently declined for credit.
Why. Only to produce your Thrive Analysis, personal plan, financial profile and progress tracking, and to show them to you in the members app. We do not sell the report or share it for marketing. We rely on your separate, explicit consent for this. That consent does not allow Thrive to obtain any further report from a credit bureau.
Who handles it, and where. Supabase stores your information in London, in the United Kingdom, and runs the software that reads your report. Anthropic PBC, a United States company, writes the analysis and plan text. These providers may process your information outside South Africa, including in the United States and possibly other countries, and only for Thrive's purposes. What Anthropic receives is listed in section 5. It does not receive the report file, your ID number or your surname.
How long we keep it. See section 6. Your rights and withdrawing consent. See section 7.
4. Why we use it, and on what lawful basis
| What we do | Information used | Lawful basis (POPIA) |
|---|---|---|
| Calculate and show your Thrive Readiness Score | Your questionnaire answers | Your consent, and performance of the free service you asked for |
| Save your result and send it to you | Name, cell, email | Your consent when you submit the form |
| Retrieve your credit record and prepare a written analysis (separate service, not this site) | ID number, bureau information | Your separate, explicit bureau consent |
| Take payment for a service you bought from us (not sold on this site) | Order and payment confirmation | Performance of our contract with you |
| Have a consultant follow up by phone or WhatsApp about your enquiry | Name, cell, your answers | Our legitimate interest in responding to an enquiry you started; you may ask us to stop at any time |
| Send marketing tips, offers and reminders | Name, cell, email | Only if you ticked the optional marketing box |
| Prioritise which enquiries our consultants call first | Your answers and your activity on the site | Our legitimate interest in running the business efficiently |
| Measure and improve the service | Usage events, visitor/session identifiers | Our legitimate interest in understanding how the service performs |
| Keep records, prevent abuse, meet legal obligations | As applicable | Legal obligation and legitimate interest |
| Members app — give you access to your account and keep it secure | Name, cell, email, ID number, sign-in credentials | Performance of your membership agreement with us |
| Members app — retrieve your credit information and make it available to you | Identifying information required for the bureau enquiry, and the resulting credit information | Your separate, explicit bureau consent |
| Members app — build and update your personalised plan and analysis | Credit information, your goal, your progress | Performance of your membership agreement with us |
| Members app — receive, store and analyse a credit report you give us, and show you the results | The report file, the information read from it, and your goal, work situation, income and whether you were recently declined | Your separate, explicit consent for customer-supplied credit reports |
| Members app — answer a question you ask Zoe | What you type to Zoe, and the credit information needed to answer it | Performance of your membership agreement, on your instruction each time you ask |
| Members app — store the debt review documents you choose to upload | The files you upload | Your consent, given each time you upload a file |
| Handle a data download, correction, cancellation or deletion request | Your account details and the request itself | Legal obligation under POPIA |
Marketing consent is optional and separate. You will receive your Thrive Score, and a consultant can still follow up with you, whether or not you tick the marketing box. Accepting these Terms and this Privacy Policy is required to use the service; agreeing to marketing is not.
4.1 Internal prioritisation
We calculate an internal priority rating so our consultants know which enquiries to return first. It uses what you told us about your work situation, income band, goal, timeframe and credit situation, and how you have engaged with us. It is not shown to you, it is not a credit score, it is not shared with lenders or credit bureaux, and it is never used to decide the price you pay. We do not use race, gender, age, health, religion, political opinion, trade union membership, biometrics or sexual orientation for this. No decision with a legal or similarly significant effect on you is made by automated means alone.
4.2 Automated analysis of your credit report
Your analysis and plan are written with the help of an automated AI service (see section 5). They are information to help you. They do not approve, decline or price any credit, and they are not used to make any decision about you with legal effect. When a Thrive team member uploads your report, a team member handles the upload and checks that the report is yours. When a Thrive partner uploads a valid report for their own customer, the analysis can be shown to you without a Thrive team member checking it first. If you think your analysis is wrong, write to support@thrivesa.co.za and a person will look at it.
5. Who we share it with
| Who | What they get | Why |
|---|---|---|
| Authorised bureau-access partner / registered credit bureau | Identifying information required for the bureau enquiry and the resulting credit information. | To retrieve and make available the member's credit information following the required consent. |
| Payment provider (Yoco) — not used on this site | Your card details, entered directly with them; order amount and reference | To process securely any payment you make to us elsewhere |
| Email provider (Resend) | Your email address and the message | To deliver your result and order emails |
| WhatsApp / messaging provider | Your cellphone number and the message | Only where you opted in, or to respond to an enquiry you started |
| E-mail services: the one you use to send us a credit report, and the one that hosts our support mailbox | The copy of the report that you e-mail to us | To get your report to us. Thrive deletes the temporary copies it controls within 7 days after the report has been uploaded; the e-mail services and their backups keep their own copies under their own rules. |
| Cloud hosting, database and file storage (Supabase), London, United Kingdom | The information described above, including your member record, your credit information, any credit report you give us and the information read from it, your Zoe conversations and any documents you upload, stored securely | To run this website and the members app, and to read the credit report you give us |
| AI processor (Anthropic PBC, a United States company) | The content needed to prepare your assessment or plan, or to answer a question you ask Zoe. For a credit report you give us, this can include your first name, the names of your creditors, your credit score, the status of your accounts, the rand amounts you owe, pay each month and are behind, whether you are under debt review (and, if so, your debt counsellor's name and contact details), the last digits of some account references, and what you told us about your goal, work situation, income and whether you were recently declined. It does not include the report file, your ID number or your surname. | To generate your written assessment and plan and to power Zoe. Anthropic processes this on Thrive's behalf, and may process it outside South Africa, including in the United States and possibly other countries. Standard API inputs and outputs are generally deleted from Anthropic's backend within 30 days, subject to limited legal, safety or policy-enforcement exceptions, and Anthropic does not use Thrive's commercial API inputs or outputs to train its models by default. |
| Thrive SA consultants | Your contact details, your answers, and a summary of your position | To follow up on your enquiry |
| NCR-registered debt counsellor partners | Only what you agree to share, and only if you ask for a referral | Debt counselling is a separate, regulated service we do not provide ourselves |
| Google Play (Android app distribution) | Nothing from your Thrive record. Google receives only what it collects as the app store when you download or update the app | To distribute the Android app |
We do not sell your personal information. Some of these providers process information outside South Africa; where that happens we rely on the provider's contractual commitments to protect it to a standard comparable to POPIA. For a credit report that you give us, we also ask for your consent to this (see section 3.15).
6. How long we keep it
| Information | Kept for |
|---|---|
| Unfinished assessments (answers only, no contact details) | Up to 12 months, then deleted |
| Enquiry records that did not become a customer relationship | Up to 24 months from your last activity, then anonymised or deleted |
| South African ID number used for bureau enquiries | May be retained in secure operational records associated with bureau enquiries, including records used to support bureau processing and prevent duplicate retrievals. It is retained only for as long as reasonably required for those purposes and subject to applicable consent, authorised partner, legal and regulatory requirements |
| Bureau information on an order that was never paid | Up to 90 days |
| Your paid Thrive Analysis and its order record | 5 years, to meet record-keeping and tax obligations |
| Usage events | 13 months, then aggregated |
| Your member account, profile and preferences | While your membership is active, and up to 12 months after it ends, subject to earlier lawful deletion |
| Your ID number — members app | Held while required for the member account and authorised bureau functionality, and deleted when the account is deleted unless a lawful retention requirement applies |
| Credit-bureau information in the members app, and the plan and analysis built from it | Retained only for as long as required to provide the member service and as permitted under the applicable consent, authorised partner arrangements and legal or regulatory requirements |
| A credit report you give us, the information read from it, and the analysis and plan built from it | While you are a member and for up to 12 months after your membership ends, and then deleted or anonymised. We keep them longer only if a law requires it or a legal hold applies. Your membership ends when Thrive has formally completed your cancellation. A failed payment, a paused or restricted account or a deactivated account is not, by itself, the end of your membership. You can ask us to delete your information sooner (section 7). |
| The temporary copy of a report you e-mail to us | The copies Thrive controls are deleted within 7 days after the report has been uploaded. E-mail services and their backups keep their own copies under their own rules. |
| Your conversations with Zoe | Not stored on our servers. We keep only a daily count of messages sent, for fair-use limits. Anthropic's own copy is generally deleted within 30 days, subject to limited exceptions |
| Documents you upload to the vault | Until you delete them, or until your account is closed |
| Opt-out and deletion records | Kept indefinitely, so that we can honour your request |
7. Your rights
Under POPIA you may ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct or complete anything that is wrong or out of date;
- delete information we no longer have a lawful reason to keep;
- stop using your information for marketing;
- object to processing based on legitimate interest;
- withdraw a consent you gave us. Withdrawing does not undo what was lawfully done before.
Write to support@thrivesa.co.za for any privacy or POPIA request: to see, correct or delete your information, or to withdraw a consent. For general help, write to the same address. We respond to rights requests within 30 days. We may ask you to confirm your identity first. A formal access request is made under the PAIA Manual.
If you are a member, two of these are built into the app, under Profile → Settings → Data & Privacy: Download my data gives you a copy of what we hold about you, and Request account deletion starts a deletion. You do not need the app to do either. Email support@thrivesa.co.za and we will handle it the same way.
Our Data Deletion page sets out exactly how deletion works, what you need to give us, what we remove, and what we have to keep.
Some information cannot simply be erased on request — for example records we must keep for tax or accounting purposes, or a record that you asked us not to contact you. Where that applies we will tell you which information we are keeping and why.
8. Stopping messages
- WhatsApp: reply STOP.
- Email: use the unsubscribe link in any message.
- Either: email support@thrivesa.co.za.
Opt-outs are recorded on a suppression list that every one of our senders checks before anything goes out, so the request holds even if you come back to the site later. If you have told a consultant you are not interested, we stop marketing contact as well. Messages that are strictly about something you bought — your receipt, or your analysis being ready — are not marketing and are still sent.
9. Security
Traffic is encrypted in transit. Your credit report and order sit behind a private link that is unique to you — treat that link like a password and do not share it. Staff access is restricted by role, and the internal tools our consultants use do not expose your ID number or your card details. No system can be guaranteed perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
In the members app, every request is checked on our servers against your own signed-in session, so one member's record cannot be read by another. Documents you upload are stored privately and are reachable only through a short-lived link issued to you — they are not public and they are not indexed by search engines.
10. Children
The service is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
11. Complaints
Please raise it with us first at support@thrivesa.co.za. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 · complaints.IR@justice.gov.za · inforegulator.org.za.
12. Changes
If we change this policy we will update the version and date at the top. Where a change materially affects how we use information you have already given us, we will ask for your consent again rather than rely on the old wording.
Version 1.1 extended this policy to cover the Thrive SA members app — your member account, your identifying information and credit information inside the app, your conversations with Zoe, and the documents you upload. It also describes the bureau enquiry as running through an authorised bureau-access arrangement, and adds the Data Deletion page.
Version 1.2 added credit reports that you give us yourself (section 3.15): who may upload one for you, how it may reach us, which providers handle it and where, what the automated analysis can include, how long we keep it and when your membership is treated as ended, and how automated analysis and human involvement work for it (section 4.2). It also corrected the earlier statement that a person is always involved in every case.
Version 1.3 changed the e-mail address for privacy requests. Privacy, POPIA, access, correction, deletion and consent-withdrawal requests, and complaints to us, are now handled at support@thrivesa.co.za, the same address as general support.