adbopVENUE STUDIO
ADBOP · EFFECTIVE 22 OCTOBER 2026
Privacy notice
How adbop handles personal information under South Africa’s Protection of Personal Information Act (POPIA).
Who is responsible
Andrew Harwood, Dillon Harwood and Thea Sinclair, trading as adbop operates adbop at 44 Riviera Road, Uvongo/Margate, South Africa and is responsible for account, support and security processing. The Information Officer is Andrew Harwood, drew@adsbop.com. General support is support@adsbop.com. This notice covers the website, Android app and Windows app. When we host client content on an account holder's instructions we act as an operator for that processing; the account holder remains responsible for the lawfulness of their content and client contacts.
Information, sources and purposes
- Accounts: email, account or agency name, account type, hashed password and package choices supplied by you. We need these to create, secure and administer your account. Signup does not ask for a phone number. An Agent or administrator may provide a venue contact number, address/location and invitation email. We receive team/venue invitations from the person inviting you, not necessarily from you directly.
- Authentication: verified-email status, hashed one-time codes, expiring links, encrypted authenticator secrets, hashed recovery codes, session records and security events. If you choose Google sign-in we receive Google's account identifier, verified email and verification status. We do not receive your Google password from Google.
- Content and settings: adverts, images, silent videos, designs, playlists, publications, schedules, device choices, locations and display formats. Old uploaded music remains private; music uploads and uploaded playback have been removed.
- Devices: device name, app version, last contact, publication/download state, storage diagnostics and a hashed credential. The device keeps its own credential using Android Keystore. Cached files are kept for online playback and reconnection, not offline operation.
- Phone control: encrypted browser frames and encrypted taps/typing, plus session identifiers, public keys, timestamps and status. The relay temporarily buffers encrypted payloads in its private database. The phone and device hold the decryption keys; the relay has no session decryption key. A session lasts at most 15 minutes; the latest frame replaces the previous one and queued inputs expire after 15 seconds. See Data retention for cleanup and backup limits.
- Support and delivery: correspondence, support notes, audited support visits, encrypted queued email and email-delivery status. A support password is checked for that visit and is not stored or logged.
- Technical access: hosting and email infrastructure can process IP addresses, request times, user-agent details and delivery information for operation and security. Application throttles use keyed IP/email hashes. Browser/music sites receive ordinary network requests from your device under their own notices.
- Future payments: no fees are collected before launch. If enabled later, the payment provider processes checkout/card data; adbop stores package/subscription status, amounts and provider references, not full card numbers or CVV.
Account/contact details, verification and security information necessary for a feature are required to supply it; without them we cannot create, protect or deliver that account or feature. Google sign-in, Phone control and optional profile information are voluntary. Choosing not to use them does not prevent using an available alternative, such as email sign-in. Do not send identity documents, sensitive personal information or children's information unless we establish a lawful, necessary request and secure route.
Lawful grounds and use limits
We process information where necessary to enter into or perform the service agreement, comply with a legal duty, or pursue a legitimate interest in secure and reliable service that respects your rights. We seek consent where required, including for optional direct marketing. You can withdraw consent without affecting earlier lawful processing; necessary contract/legal processing may continue. We do not sell personal information, use client adverts to train models, or make solely automated decisions with legal or similarly substantial effects about you.
Who receives information
Owners, their authorised team, Agents and venue clients see information according to server-enforced roles. Administrators can access accounts and content for authorised administration/support and their actions are audited. Hosting, email and other necessary service providers process information on authorised instructions with confidentiality and security obligations. Google receives data when you choose its sign-in; music sites act under their own terms. We disclose information to authorities or other people only on a lawful basis, including a valid legal obligation. We do not give administrators a way to recover your password or read remote-session plaintext from the relay.
Browser credentials, cookies and Guest mode
Music-service sign-in happens in the current built-in browser on the device or in the browser you choose on PC. That browser can retain the provider's cookies and tokens on the device; adbop does not copy them to its account database or telemetry. Phone typing and browser images may contain personal information, including sign-in text, which is end-to-end encrypted for transport and relay buffering. We never ask you to submit music passwords to an adbop account/support form. Use a trusted phone and device and disconnect when finished.
Essential cookies keep website sign-in, Google authorisation state and email verification working. We do not add advertising or analytics trackers to the account website; third-party sites in the music browser have their own cookies and tracking. Guest needs no account but still needs internet: its server availability check produces normal access logs. Guest settings are temporary and its isolated browser profile is cleared on exit. Third-party sites visited in Guest receive their own requests.
Cross-border processing
Google, music providers and other service providers may process information outside South Africa. Where adbop transfers personal information abroad, we must have a lawful basis under POPIA section 72, such as adequate protection through law or a binding agreement, valid consent, or another applicable permitted ground. We assess relevant protections; choosing a provider does not remove our duties. Ask the Information Officer about the providers, locations and safeguards relevant to your information.
Retention, security and incidents
We keep information only for the purpose, an applicable legal duty or a justified dispute/security need, then delete or de-identify it. See Data retention. We apply access controls, HTTPS, password hashing, encryption of appropriate secrets, signed media links and revocable device credentials. No system can guarantee absolute security. If there are reasonable grounds to believe personal information was accessed or acquired without authorisation, we investigate and notify the Information Regulator and affected people as POPIA section 22 requires, as soon as reasonably possible, subject to lawful delay.
Your information rights
You may request confirmation and access to your personal information, correction of inaccurate information, deletion or destruction where legally appropriate, restriction of unnecessary retention, and objection on the grounds POPIA permits. You may withdraw optional consent and object to direct marketing. Send requests to drew@adsbop.com. We may reasonably verify identity or authority before disclosing data; do not send passwords. We explain any lawful refusal, fee or retention requirement and the available complaint route. We aim to respond within 30 days, subject to applicable lawful periods and extensions.
Owners and Agents may close their account using password confirmation; Agent closure also deletes managed venues and venue-client accounts after explicit confirmation. Venue clients and team members can send personal-information requests directly to the Information Officer. Our PAIA manual explains formal access requests and forms. You may complain to the Information Regulator of South Africa; you do not need our permission. Information Officer registration, provider agreements and operational safeguards remain obligations in addition to publishing this notice.
Changes
We update this notice when processing changes and notify account holders of material changes. New uses must have an appropriate lawful basis; this notice is not a blanket consent to unrelated processing.
Operator and contact details
Andrew Harwood, Dillon Harwood and Thea Sinclair, trading as adbop.
Operated by Andrew Harwood, Dillon Harwood and Thea Sinclair.
Physical and service address: 44 Riviera Road, Uvongo/Margate, South Africa.
Telephone: +27836962435.
Information Officer: Andrew Harwood, drew@adsbop.com. General support: support@adsbop.com.
adbop is operated by Andrew Harwood, Dillon Harwood and Thea Sinclair, trading as adbop at https://adsbop.com. For questions, requests or complaints about this page, email support@adsbop.com.