Privacy Policy

1. Who we are

Oasis Tree (Pty) Ltd (“OasisTree”, “we”, “us”) is building a mobile app and family heritage platform that helps families build a living family tree, preserve memories of living and deceased relatives, and coordinate as a household. This Policy explains what personal information we collect, why, how it is used and shared, and the rights you have over it. OasisTree is in a private beta with invited families. It is not yet available to the public. What this website itself collects is set out in Sections 14 to 16.

2. Legal framework

We are a South African company and are built around the Protection of Personal Information Act (POPIA), the Electronic Communications and Transactions Act (ECT Act), the Consumer Protection Act, and the Wills Act (relevant to the Family Vault — see Section 6). For users outside South Africa, including diaspora users, we aim to meet the higher of the applicable local standard (such as the EU/UK GDPR) or our POPIA baseline.

3. What we collect

The categories of information the product is designed to collect are:

• Identity & contact: name, email, phone number, date of birth, profile photo.
• Family tree & relationship data: names, relationships, dates, and biographical notes for family members you add — including deceased relatives and, where applicable, minors (see Section 8).
• Family Vault & legacy data: Heritage Messages and other items you choose to store for release to specific people on death or a future date (see Section 6).
• Payment data: handled by our payment processor (see Section 5) — we do not store full card details.
• Technical & usage data: device identifiers, app version, crash logs, and location only where you explicitly grant it for a specific feature.
• Contact discovery data: optional, off by default — see Section 7.
• Support data: the content of a support request, your email address, and technical context needed to help resolve it.
• Website data: invite requests, support and deletion requests, questions asked of the website assistant, and what the site keeps in your browser — see Sections 14 to 16.

4. How we use it

To create and run your account, family tree and Vault; to process subscription payments; to enable optional features you turn on; to respond to support requests; to keep the Service secure; and to release Family Vault items according to the conditions you set. We do not use family tree, Vault, or children’s data for advertising, profiling, or any purpose beyond delivering the Service to you.

5. Sharing of information

We do not sell personal information. We share it only with:

• Infrastructure and database providers who host the Service, under data-processing terms requiring protection equivalent to this Policy. The providers behind this website are named in Section 14.
• A payment provider, once paid plans are available, for billing and transaction data only. No payments are taken during the private beta.
• A customer-support ticketing provider, for the content of a support request.
• Law enforcement or regulators where legally compelled.
• A successor entity in the event of a merger or acquisition, under equivalent privacy protections.
• Any third party you explicitly ask us to share with (e.g. inviting a family member).

We never sell or rent personal information, never use family content to train third-party AI models, and never share your raw contact list with anyone.

6. Family Vault & Heritage Messages

The Family Vault is designed to be the most protected tier of data on OasisTree. It is designed to hold a “Heritage Message” — a video, audio, or written message for specific family members, to be released on your verified death or a future date you choose. Automatic release is not yet available during the private beta.

At this stage the Family Vault is encrypted on our servers, not end-to-end. That means OasisTree is technically able to access Vault contents; we restrict that access by policy and access controls. End-to-end encryption, where only your family holds the key, is planned.

A Heritage Message is not a legal will under the Wills Act (No. 7 of 1953) and has no legal force to distribute property or assets. If you want your wishes about property or assets to be legally binding, you need a will drafted by a qualified attorney.

Two questions about the Vault are genuinely still open internally and are not yet resolved: what happens to a deleted member’s tree node (full erasure vs. a structural placeholder), and who owns a Vault item after the depositing member’s account is closed. We are not stating a settled position on either until they are resolved with proper legal input — we would rather tell you that plainly than guess.

7. Contact discovery (optional, off by default)

If offered, this feature would help you find family members already using the app via your phone’s contacts. It is designed so that matching happens on your device, your full contact list never leaves your phone, only hashed numbers for contacts that produce a match are sent to our servers, and you can revoke access at any time. This feature is never required to use OasisTree.

8. Children’s information

A family tree, by its nature, includes children. OasisTree is designed so an adult family member can add a child to the tree only after confirming they are a competent person for that child (a parent, legal guardian, or someone with court-given parental responsibility) and consenting to the processing this involves, as required by POPIA. We do not use a child’s information for advertising or marketing, and never share it outside the family members the consenting adult has chosen. OasisTree does not support direct account sign-up by anyone under 18.

9. Marketing communications

We will only send marketing communications (email, SMS, push, or in-app) where you have given consent, or where permitted for existing customers under the ECT Act. You can withdraw consent at any time, free of charge, via the unsubscribe link in any marketing email, your in-app notification settings, or by emailing privacy@oasis-tree.com. Account, security, and payment-related communications are not marketing and continue regardless of your marketing preference.

10. Your rights

Subject to POPIA, you have the right to:

• Access your data — ask us for a copy of the personal information we hold about you.
• Correct inaccurate data.
• Request deletion, subject to Section 6’s open questions above.
• Object to processing, or withdraw consent at any time.
• Lodge a complaint with South Africa’s Information Regulator at inforeg@justice.gov.za or www.inforegulator.org.za.

To exercise any of these rights, or to start a request to delete your account, see our account deletion page or contact privacy@oasis-tree.com.

11. Security

We use technical and organisational security measures, including encryption in transit and at rest and role-based access controls. Family information is not end-to-end encrypted during the private beta, so OasisTree is technically able to access it; we restrict that access by policy. End-to-end encryption is planned. A formal breach-response plan and a full per-category data retention schedule are still being finalised — we are naming that gap rather than implying it is already closed.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified via in-app notification or email at least 30 days before taking effect.

13. Contact us

Privacy enquiries: privacy@oasis-tree.com. Entity: Oasis Tree (Pty) Ltd. Physical address: 11 AYR Close, New Germany, Durban, KwaZulu-Natal, South Africa. South Africa’s Information Regulator: inforeg@justice.gov.za.

14. This website

This section covers oasis-tree.com itself, which is separate from the OasisTree app.

• Invite requests: when you request an invite we collect your name, your email address and/or phone number, your consent, and whether you want occasional news. The request is recorded on our web host (Afrihost) and copied to a backup database run by Supabase. Our team is emailed a notification that includes these details and your IP address, and if you gave an email address we send you a confirmation. We use these details to invite you to the private beta and to contact you about it.
• Support and account-deletion requests: the details you enter are stored in a database run by Supabase and emailed to our support team, and we email you a confirmation.
• The website assistant: questions you type into the chat assistant are sent to our Supabase service to find an answer from approved OasisTree content. Each question is stored with a random reference for that browser tab, so we can prevent abuse and improve answers. If you choose Email support from the chat, your request also includes your latest question, the assistant’s latest answer, the page address and that reference. At present the assistant answers without sending your question to an outside AI service. It can be configured to use Voyage AI and Anthropic, both US companies, for questions it cannot match directly; we will update this section before that is switched on.
• Checking support options: each page asks our Supabase service which support options are currently available. That request carries no form data, but like any web request it reveals your IP address and browser details to Supabase.
• Invite links: if you open an OasisTree invite link, the page sends the invite code to OasisTree’s own servers to show who invited you and to which family.

Where it is processed: the website’s Supabase project is hosted in Frankfurt, Germany, in the European Union, where personal information is protected by the EU General Data Protection Regulation. Invite requests are also held by our web host. We do not sell this information or use it for advertising.

15. Cookies and browser storage

This website does not set cookies and uses no analytics, advertising or tracking tools. It keeps a small amount of information in your browser’s own storage instead:

• Your answer to the storage notice, your light or dark mode choice, and whether chat sounds are on — kept until you clear your browser storage.
• The current chat conversation, whether the chat window is expanded, and whether its attention animation has played — kept only until you close the tab.
• A random chat reference for the tab, which is sent with your questions (see Section 14) — kept only until you close the tab.
• For OasisTree staff only: a sign-in session when using the support dashboard or requesting staff access.

You can review this at any time through “Cookie settings” in the site footer, and clear it through your browser settings. If live chat with a person is switched back on, or any analytics tool is ever added, we will update this section and ask you first where consent is required.

16. Keeping and removing website records

We have not yet set automatic deletion periods for website records such as invite requests, support requests and assistant questions. Until we do, we keep them only as long as we need them for the purposes above, and we remove them on request. To be taken off the invite list, or to ask for any of these records to be deleted, email privacy@oasis-tree.com.