Privacy Policy

Tomara (“we”, “us”) is operated by Smaks Enterprise. We take the privacy of your personal information seriously and process it in line with South Africa’s Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, and the choices you have.

Who is responsible

Smaks Enterprise is the responsible party. For any privacy request or question, contact our Information Officer at richard@smaksenterprise.co.za.

What we collect

• Account data: your email address and the name you choose.
• The content you create: domain self-ratings, daily check-ins, goals, decisions, reflections, your Higher Self statements, and messages you send to the AI coach. This can include sensitive personal information about your wellbeing — you share it voluntarily.
• Billing data: subscription status and payment records. Card details are handled entirely by PayFast; we never see or store them.
• Technical data: standard server logs needed to run and secure the service.

Why we process it

To provide the service (your account and features), to process payments, to send transactional email (receipts, trial reminders), and to keep the service secure. Our lawful bases are performance of our contract with you and your consent for any sensitive wellbeing content.

Who we share it with (operators)

We use trusted processors who act on our instructions: Supabase (database & authentication, EU region), Vercel (hosting), PayFast (payments, South Africa), Resend (email delivery), and Anthropic (the Claude model that powers the AI coach — only the coach context and your messages are sent, to generate a reply). We do not sell your personal information.

AI coach

When you use the coach, the messages in that conversation and a summary of your recent in-app data are sent to Anthropic to generate a response. Treat the coach as a supportive tool, not a therapist, and avoid sharing information you would not want processed for that purpose.

Security

Data is encrypted in transit. Every record is protected by row-level security so that you can only ever access your own data. Access to production systems is restricted.

Retention

We keep your data while your account is active. You can delete your content at any time, and on account closure we delete or anonymise your personal information except where we must retain payment records for legal and accounting purposes.

Your rights

Under POPIA you may request access to, correction of, or deletion of your personal information, object to processing, and lodge a complaint with the Information Regulator (South Africa). To exercise any right, email us at the address above.

Children

Tomara is intended for adults and is not directed at children under 18.

Changes

We may update this policy; material changes will be notified in-app or by email. Continued use after an update means you accept the revised policy.