Mom's Directory

Privacy Policy

Last updated: 3 October 2026

This policy explains what personal information Mom's Directory collects, why it is collected, how it is stored, and what rights you have in relation to it under the Protection of Personal Information Act 4 of 2013 (POPIA).

Responsible party

Mom's Directory is operated by Brittany Miller, trading as Mom's Directory. She is the appointed Information Officer for the purposes of POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA).

Email: themomsdirectory@gmail.com

Information collected

• Accounts and favourites, optional. If you sign in with Google, we receive your name, email address, email verification status and profile-photo URL. We store these with your Google account identifier, the listings you save and when you save them, and records of your sign-in sessions, including their IP address and browser/device information. We also keep temporary sign-in state and request counters to complete sign-in and prevent abuse.
• Newsletter subscription. Your name and email address.
• Contact form, recommendations and corrections. Your name, your email address, and the content of your message.
• Listing applications. The details submitted through the Add a listing form, including business name, category, area, contact details, and whether the business is mom-owned. Featured listings are paid by EFT. Mom's Directory does not accept card payments and does not collect, process or store card details. What is retained is the record of the transfer as it appears on the bank statement — the payer's name, the reference used and the amount — which is kept as an accounting record.

We do not receive your Google password. Google sign-in tokens are used to complete sign-in but are not retained in our account database. We do not request access to your Gmail, contacts, Google Drive or other Google services.

Mom's Directory does not request and does not knowingly collect personal information relating to children.

Purpose of processing

Account information is used to recognise you when you sign in, keep you signed in, show your private favourites on the devices you sign in on, and let you sign out or delete your account. Technical sign-in information and request counters help protect the service from abuse. You can browse the directory without an account; signing in is required only for account features such as saving favourites.

Newsletter details are used solely to send the Mom's Directory newsletter, comprising new listings, seasonal guides and occasional features.

Messages, recommendations and corrections are used to respond to the sender and to verify and improve directory listings. Recommendations, corrections and other material submitted for publication may also be published on this website, in the newsletter and on Mom's Directory social media accounts, with or without your name, as set out in the Terms of Use. Contact details are never published.

Listing applications are used to assess a business's suitability for the directory, to compile the listing, and for related correspondence with that business.

Personal information is not sold, rented or shared with third parties for their own purposes. Listed businesses do not receive the details of directory users.

Direct marketing is sent only to individuals who have subscribed to the newsletter. Creating an account does not subscribe you. Enquirers and applicants are not added to the mailing list without their separate consent.

Storage and service providers

We use the following service providers to operate the directory:

• MailerLite — newsletter subscriber management
• Formspree — form submissions
• Google for account sign-in, and email and spreadsheet storage of enquiries and applications
• Vercel — website hosting
• Umami — website analytics
• Hetzner for account and favourites server hosting in Nuremberg, Germany
• Cloudflare R2 for private database and server-configuration backups in the EU

Account details, sign-in sessions and favourites are held in a private database on our Hetzner server. The database is not publicly accessible. Backups are stored privately with Cloudflare R2. We use HTTPS for account connections and restrict access to account data, backups and server credentials.

Google processes sign-in under its own Privacy Policy. You can manage the Google connection in your Google Account settings. Disconnecting Google does not delete your Mom's Directory account; use the deletion route below for that.

Certain of these providers store data on servers located outside South Africa. Such transfers are made in accordance with section 72 of POPIA, on the basis that the recipients are subject to protections substantially similar to those required under POPIA. Operators are not permitted to use personal information for their own purposes.

Analytics and cookies

This website uses Umami to measure how the site is used — which pages are visited, which links are clicked, and the approximate location a visit came from. Umami is a privacy-focused analytics service: it does not use tracking cookies or follow visitors across other websites. When someone creates an account, signs in or saves a listing, Umami records that it happened and which listing was saved, but not who did it. We do not send your account name, email address, profile photo or list of saved favourites to Umami.

Accounts use essential sign-in cookies. These cookies complete Google sign-in and keep you signed in. They are not used for advertising or cross-site tracking. The sign-in cookie is sent over HTTPS and cannot be read by page scripts. Signing out removes your current sign-in cookie. Blocking essential cookies may prevent account features from working, but you can still browse the directory without signing in.

Browser local storage caches your name and profile-photo URL so the account menu can display them while your session is checked. This cache is cleared when you sign out. Local storage also remembers display preferences. Browser session storage keeps temporary actions during Google sign-in, navigation settings and a location you choose for nearby results. You can clear browser storage through your browser settings. It is not used for cross-site tracking.

Retention

• Account details and the Google account identifier are kept until you delete your account. Favourites are kept until you remove them or delete your account.
• Sign-in sessions normally expire after seven days and can be renewed while you use the account. Signing out ends the current session. Deleting your account removes all its sign-in sessions and saved favourites from the live database.
• Technical logs are used for security and troubleshooting and kept for a limited period. Routine API logs do not include your name or email address. Temporary sign-in state and abuse-prevention records are kept only as long as needed for those purposes.
• Database backups rotate through seven recent copies on the server and 30 daily copies in Cloudflare R2. Deleted data may remain in restricted backups until those copies rotate out. It is not immediately erased from every backup when you delete your account.
• Newsletter details are retained until you unsubscribe or request deletion.
• Messages and enquiries are retained for up to two years and then deleted.
• Listing records are retained for the duration of the listing and for a reasonable period thereafter, as required for accounting purposes.

Unsubscribing

Every newsletter contains an unsubscribe link. Unsubscribing takes effect immediately.

Your rights

You can remove individual favourites from Your favourites, or permanently delete your account from Your account. Deletion asks you to sign in with Google to confirm, then deletes your account, Google account link, sign-in sessions and favourites from the live database. It does not delete your Google account, unsubscribe you from a separately requested newsletter, or remove records we must retain to meet legal obligations. The backup retention described above still applies.

Under POPIA you are entitled to:

• request confirmation of what personal information is held about you
• request that it be corrected
• request that it be deleted or destroyed
• object to its processing

Requests may be sent to themomsdirectory@gmail.com. There is no charge, and requests are dealt with as promptly as reasonably possible.

Business listings

Listings are compiled from publicly available business information, from recommendations submitted by members of the public, and from businesses that apply directly. Where a listed business is operated by an individual, listings are limited to professional and business information.

Business owners may request that a listing be corrected or removed by writing to themomsdirectory@gmail.com. No reason need be given.

Security incidents

In the event of a compromise of personal information, affected persons and the Information Regulator will be notified as soon as reasonably possible, in accordance with section 22 of POPIA.

Complaints

Complaints regarding the handling of personal information should in the first instance be directed to themomsdirectory@gmail.com.

If a complaint is not resolved, it may be lodged with the Information Regulator:

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
POPIAComplaints@inforegulator.org.za
inforegulator.org.za

Amendments

This policy may be updated from time to time. The date at the top of this page reflects the most recent version.