Privacy policy

Last updated: 7 October 2026

This policy explains what personal information Everfloh collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It is written to meet South Africa's Protection of Personal Information Act, 2013 (POPIA).

Who we are

Everfloh Entertainment (Pty) Ltd, trading as Everfloh, registration number 2026/766120/07, is a social media and short-form video agency based in Cape Town, South Africa. In this policy, "Everfloh", "we" and "us" mean that company.

For information we collect to run our own business, we are the responsible party under POPIA. For information we handle on behalf of a client, the client is the responsible party and we act as their operator, processing it only on their instructions.

This website

everfloh.com has no contact form, no login, no cookies, no analytics, no advertising pixels and no third-party scripts or fonts. We do not try to identify visitors.

The site is hosted by Cloudflare. Like any web host, Cloudflare processes technical information about each request, such as your IP address, browser type, the page requested and the time, so it can deliver the page and protect the site from abuse. We do not use that information to identify or profile you.

When you email us

If you email us, we receive your name, your email address and whatever you choose to include. We use it to reply to you and, if we end up working together, to run that work, send quotes and invoices, and keep the records the law requires. We rely on our legitimate interest in answering you and on taking steps towards a contract you have asked about.

Our email runs on Google Workspace.

If we contacted you first

We sometimes email creators and businesses we think we can help. We only use business contact details the person or business has published themselves, for example the contact email on a YouTube channel or a company website.

For that, we keep your name, your channel or business name, the public page where we found your address, and a record of what we sent and whether you replied. Every message we send tells you how to stop hearing from us. If you reply "no thanks", or ask in any words, we will not email you again. We keep your email address on a do-not-contact list so that stays true.

Our clients' accounts and data

To do the work, our clients give us access to their social media accounts and the information in them. Depending on the work, this can include:

• admin or editor access to the client's pages and accounts on platforms such as Facebook, Instagram, TikTok and YouTube;
• the client's content: videos, photos and captions, including footage of people filmed at the client's events and stores;
• performance data for the client's accounts, such as views, reach, watch time, followers and engagement.

Analytics through platform APIs

With the client's authorisation, we read performance data for the client's own accounts through the platforms' official interfaces, including Meta's API for Facebook and Instagram and TikTok's API for Business. That access is read-only. We use the data for one purpose: to produce that client's reports and plan their content.

We do not use this access to publish, send messages, moderate comments or create ads. We do not combine one client's data with another's, share it with other clients, or use it for any other purpose. The figures we work with are mostly totals and averages; we do not build profiles of individual followers.

A client can withdraw this access at any time, in the platform's own settings (on TikTok, for example, under Settings and privacy, Security, Manage app permissions) or simply by asking us.

People who appear in client content

When we film at a client's event or store, members of the public may appear in the footage. We follow the client's instructions on consent and notices. If you appear in content we made and want it removed, tell us or the client, and we will take it down from anything we control.

If you are a customer or follower of one of our clients and have a question about your information, the client is the best first contact. You can also email us and we will pass it on.

Who we share information with

We do not sell, rent or trade personal information. We share it only where we need to:

• Service providers who run our tools, such as Google (email and file storage) and Cloudflare (website hosting), under their own data protection terms;
• the platforms themselves, when we post or read data on a client's behalf;
• our accountant and the South African Revenue Service, for invoices and tax records;
• authorities, where the law requires it.

Information stored outside South Africa

Some of our service providers, including Google and Cloudflare, may store or process information on servers outside South Africa. POPIA allows this where the recipient is bound by law, binding corporate rules or an agreement that gives the information an adequate level of protection. We only use providers that make that commitment.

How we protect it

We take reasonable technical and organisational steps to keep personal information safe. Our accounts use two-step verification. Access to client accounts and data is limited to the people working on that client. Platform passwords and access tokens are stored privately and never shared, and we ask for read-only access wherever a platform offers it.

If personal information we hold is ever compromised, we will notify the Information Regulator and the people affected, as POPIA requires.

How long we keep it

• Emails and enquiries: for as long as the conversation and any work that follows need them, and no longer than two years after our last contact, unless they become part of a client or financial record.
• Outreach records: for as long as we need them to avoid contacting you twice. If you opt out, we keep only your email address on our do-not-contact list.
• Client records, quotes and invoices: for as long as company and tax law requires, currently up to seven years.
• Client account access and analytics: for as long as we work together. When the work ends, we hand back or remove our access, and we delete the client's analytics data we hold within 90 days unless the client asks us to return or keep it.

Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and get a copy of it;
• ask us to correct information that is wrong or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object to us processing your information, including for direct marketing, at any time;
• withdraw consent, where we rely on your consent;
• complain to the Information Regulator.

To use any of these rights, email our Information Officer. We may ask you to confirm your identity before we act on a request, and we will respond within a reasonable time. You can also ask for access to records under the Promotion of Access to Information Act, 2000 (PAIA) by emailing the same address.

Our Information Officer

Registered with the Information Regulator.

The Information Regulator

If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also contact the Information Regulator of South Africa directly:

Children

Our services are for businesses and adult creators. We do not knowingly collect personal information directly from children.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top.