How we collect, use, and protect your information across quadcorp.co.za and our Ticked service.
Last updated: 19 October 2026
QuadCorp (Pty) Ltd, registration number 2024/490584/07, of 86 Mitchell Avenue, Woodlands, Cape Town, 7785 ("QuadCorp", "we", "us", "our") is a South African software studio operating at quadcorp.co.za. We build CRM software, websites and funnels, online stores, and Ticked, an automated WhatsApp booking assistant offered as a QuadCorp service. This policy covers all of these, including the Ticked waitlist and application pages hosted under quadcorp.co.za/Ticked, the Ticked business dashboard at app.ticked.online, and ticked.online, the public Ticked website where people find businesses, book them on WhatsApp and leave reviews.
Our contact page asks for your name, business name, email address, and project details. This form does not submit to a server — it prepares a WhatsApp message with what you've typed, which opens in WhatsApp for you to review and send. We only receive it once you choose to send that message, the same as any other WhatsApp conversation.
The Ticked waitlist form collects your full name, business name, business type, and WhatsApp number. This is submitted directly to our systems and stored securely so we can reach out about early access.
If you apply to use Ticked, we collect more detailed information needed to set up the service on your behalf: your business name, contact email and phone number, your own WhatsApp number (for a test message during set-up and for contacting you), the services you offer (names, duration, pricing), your business hours, your cancellation and rescheduling policies, and any other operating notes you provide. We also collect the names, roles, email addresses and services of the team members you add, and the email address each person uses to sign in to the Ticked dashboard. We record what administrators and users do in the dashboard in an audit log. To protect the form from spam, it includes a hidden check and limits how many applications one email address can send; this uses no tracking. If we turn an application down, we delete its details 30 days later.
If a business asks us for a website quote from the Ticked dashboard, we store what it asked for (for example the number of pages, an online shop or its own web address), its timeline, budget range, the best time to contact it and any notes, so we can reply with a quote.
Businesses on Ticked Premium can publish a page about themselves on ticked.online. The business chooses what appears on it, such as its description, photos, services and prices, opening hours, address, a public contact number, social links, and the names, job titles and photos of team members it chooses to show. The business is responsible for having permission to publish this information, including its team members' names and photos. The number Ticked uses for WhatsApp bookings is used for the "Book on WhatsApp" button.
If you create an account on ticked.online, we collect your email address and a password (stored only in scrambled form by our login provider), or, if you choose "Continue with Google", your name, email address and the link to your Google profile picture from Google. We also store the first name and last name you give us and, if you add one, a profile photo.
When you leave a review, we store your rating (1 to 5 ticks), what you wrote, the service you chose and the dates you wrote or edited it. If you report a review, we store your reason and any details you add. Your review is public: it shows with your first name and the initial of your last name (for example "Aisha K."), your profile photo if you added one, and the business's reply. We never show your email address. The business you review can see your review and reply to it. ticked.online accounts are meant for people aged 18 or over.
If you turn on phone or computer notifications in the Ticked dashboard, we store the notification address your browser gives us for that device, and the type of device and browser. We use it only to send you Ticked notifications (such as new bookings). The notifications are delivered by your browser's own push service (Google, Apple, Mozilla or Microsoft) and are encrypted so that only your device can read them. You can turn them off at any time in the dashboard under Account; signing out also turns them off for that device.
Like most websites, our hosting provider (Vercel) automatically logs standard technical information for security and reliability purposes — such as IP address, browser type, and request timestamps. We do not run analytics or advertising trackers on this site, and we do not use cookies to track you across other websites.
We process information about businesses and their team members to provide the services they have signed up for. We process information about a Ticked business's customers on that business's behalf and under its instructions (see section 12). We keep security and audit logs because we have a legitimate interest in keeping our services safe. Where we rely on your consent, you can withdraw it at any time.
We don't sell your information. We share it only where necessary to run the services you've asked for:
We do not share your information with third parties for their own marketing purposes.
Information is stored with our hosting and database providers, Vercel and Supabase. Some of these providers process information outside South Africa, including in the United Kingdom and the United States. Waitlist and application data is kept in access-controlled storage; our admin views are protected by authentication, and our administrators' logins also require 2-step sign-in (a code from an authenticator app). Ticked dashboard users can turn on 2-step sign-in for their own logins too. We take reasonable technical measures to protect information from unauthorised access. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.
To fix problems and keep Ticked running, authorised QuadCorp staff can view a Ticked business's dashboard, conversations and bookings. Where a conversation needs it, they can reply to a customer on the business's behalf, and the business can see that the conversation is being handled by Ticked support. Every time our staff view or act in a business's account, it is recorded in an audit log, which the business can ask to see.
We keep enquiry and application information for as long as reasonably necessary to respond to you, provide the service you've requested, or meet legal and accounting obligations. You can ask us to delete your information at any time using the contact details below. You can delete your ticked.online account at any time under My account: this permanently deletes your account, your profile photo and all your reviews. If you'd rather keep your account, you can delete a single review yourself at any time. If a review is removed for breaking our review rules, we keep it, hidden from the public, together with the reports about it, until you delete it or your account, so we can deal with disputes. A business's page on ticked.online is removed as soon as the business unpublishes it or leaves Ticked Premium. For what happens to a Ticked account's information when it is suspended or cancelled, and for information about a Ticked business's customers, see the section on Ticked and information about our clients' customers.
As a South African business, we handle personal information in line with the Protection of Personal Information Act (POPIA). Depending on where you're based, you may have the right to:
To exercise any of these, contact us using the details below. We reply within 30 days. You can also complain to the Information Regulator (South Africa) at inforegulator.org.za. To have your information deleted, see How to delete your data.
We don't use tracking or advertising cookies. Some pages use your browser's local storage purely for on-page functionality (for example, remembering a UI preference); this data stays on your device and isn't sent to us. The Ticked dashboard keeps your sign-in in your browser's storage: until you sign out if you tick "Keep me signed in", otherwise only until you close the browser. You can sign out of all your devices at once in the dashboard under Account. ticked.online also keeps your sign-in in your browser's storage until you sign out. Neither site uses tracking or advertising cookies.
Our business services are intended for business owners and operators, and ticked.online accounts are meant for people aged 18 or over. We don't knowingly collect information from children, and our services are not directed at them. If you believe a child has created an account, contact us and we will delete it.
Our site links to third-party platforms including Google and Facebook (for reviews) and WhatsApp. Once you leave our site, that platform's own privacy policy applies — we're not responsible for their practices.
We may update this policy as our services change. We'll update the "Last updated" date above when we do. Continued use of our site or services after a change means you accept the updated policy.
When a business uses Ticked, that business decides why and how its customers' information is used. It is the "responsible party" under POPIA. QuadCorp acts as its "operator": we process the information only on the business's behalf, to provide Ticked, and under its instructions. For information about the businesses themselves (their applications, logins and team members), QuadCorp is the responsible party, as described in the rest of this policy.
When a customer of a Ticked business messages that business's WhatsApp number, Ticked processes:
From this, the business sees a client list in its dashboard (each customer's name, number, visits, bookings and what they have spent) and its money figures (the value of completed and upcoming bookings). Team members do not see the client list or any money figures.
Only to run the business's booking service: to answer questions about the business, make, move and cancel bookings, send reminders and follow-ups, tell the business owner and team members about their bookings, and give the business its own client list, booking statistics and money figures. We do not use customers' messages for marketing, we do not sell them, and we do not use them to train models.
Ticked replies to customers using an AI assistant. It reads the recent messages in the conversation, replies, and can make, move or cancel appointments. The business can read every conversation and can take over a conversation at any time. If something goes wrong, Ticked support can also step into a conversation; the business can see when this happens.
Only the providers needed to run the service:
We share it with no one else, except where the law requires it.
Some of these providers process information outside South Africa, including in the United Kingdom and the United States. We rely on each provider's contractual and legal commitments to protect personal information.
We keep a business's customer information for as long as that business uses Ticked, so the assistant has context and the business has its records. If a business cancels, or its account is suspended, its information is kept for 3 months so it can come back. After those 3 months, we permanently delete the business's information, including its customers' information, from our live systems, and the business must re-apply to use Ticked again. Businesses cannot download their customer lists themselves. Before deletion, a business can ask us for an export of its client list and booking history, which we prepare and send to the business; every export is recorded in our audit log.
When a customer's information is deleted (by the business from its Contacts page, or by us on request), we delete their WhatsApp number, their messages and their entries on the business's calendar, and cancel any upcoming bookings. The business keeps a record of the customer's past bookings (their name, the service, date, team member and price) as part of its own business and financial records; these records no longer include the customer's number or messages. We keep only the records we are legally required to keep, such as invoices and payment records. In-app notifications are deleted automatically after 90 days.
The business is your first point of contact for requests about your information. You may also contact us at quadcorp.co.za@gmail.com. You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. The business can delete your information itself from its Contacts page, and we can export or delete a customer's records for the business concerned on request. We log every request we receive and the date we answered it.
To have your information deleted, email quadcorp.co.za@gmail.com with the subject "Delete my data". Tell us the WhatsApp number or email address your information is held under and, if you are a customer, the name of the business you messaged. We confirm who you are, then either delete what we hold or pass the request to the business that is responsible for it. Deleting removes your WhatsApp number, your messages and your calendar entries, and cancels any upcoming bookings; the business keeps a record of your past bookings under your name, without your number, as part of its business records. We reply within 30 days. A business can also ask us to delete everything held for its account. If the law requires us to keep something, we will tell you.
When a business connects its Google Calendar to Ticked, it gives us permission to use Google Calendar on its behalf. Ticked uses this to:
We store a secure connection token, so Ticked keeps working without the owner signing in each time. We also store the identifiers of the calendars and entries Ticked creates, so it can change or cancel them. We do not keep a copy of the other entries in the owner's calendar.
Only to provide the booking features the business has asked for. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop or train AI models.
We do not transfer Google user data to anyone else, except to provide the booking service the business asked for (including the providers described above), to keep it secure or comply with the law, or with the business's consent. Our team only looks at a business's bookings to provide support the business has agreed to under our Terms of Service, to keep the service secure, or to meet a legal duty.
Ticked's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
A business can disconnect Ticked at any time in its Google Account, under third-party apps and services. Ticked can then no longer read or change the calendar. Entries already made stay in the calendar until the owner deletes them. To have the stored connection token and the identifiers we hold deleted as well, email quadcorp.co.za@gmail.com.
Questions about this policy, or want to exercise your rights over your information? Reach us at:
Information Officer: Abdul Shukri Kaffoor (CEO), quadcorp.co.za@gmail.com. Registered with the Information Regulator on 11 October 2026 (registration number 2026-068912).
Company details: QuadCorp (Pty) Ltd, a private company registered in South Africa, registration number 2024/490584/07. Physical address: 86 Mitchell Avenue, Woodlands, Cape Town, 7785.