Privacy Notice

1. Who we are

Prouva is operated by Prouva Ltd, a company incorporated in Mauritius (BRN C236255) of The Grand Business Centre, Level 3, Block A, La Promenade, Telfair, Moka Smart City 80813 (“we”, “us”). We are the data controller for personal data processed through the Platform for the purposes of the Data Protection Act 2017 (Mauritius). Data Protection contact: hello@prouva.mu.

2. The personal data we collect

How listings are created. Many listings are compiled from information that businesses have already made public — for example public business directories, a business's own website or public social-media page, and publicly accessible registry information. We do not create this information; we organise information that is already available to anyone, in one place, to help customers find local providers. For such a listing we hold only business-context details (such as trading name, service category, area served and a public contact point). Any business can claim its listing, correct it, or ask us to remove it.

We also collect:

• Identity & sign-in. For customers and providers alike, your email address or Google account identifier. Optionally a display name.
• Reviews. The structured answers, ratings and any text you submit, plus the first name and town you choose to show.
• Provider details. For listed businesses: business name, category, areas, contact number, website and description; and, for verification, the owner/manager's name and Business Registration Number.
• Verification documents (temporary). Quotes, invoices, contracts, receipts and identity documents (NIC or passport) you upload are used only to verify a review or a business and are deleted as soon as the verification decision is made. We do not retain the document or the ID number — only the outcome of the check (and who checked it, and when).
• Your activity. Providers you save to your shortlist, and messages you send us through the contact form or by email.
• Technical data. Basic logs and device/usage data needed to operate and secure the service.

3. Why we use it, and our lawful basis

• To create and secure your account and authenticate you — performance of a contract and our legitimate interests.
• To publish the reviews you choose to post and operate the directory — legitimate interests in providing a public-interest, responsible review service, and your consent to publish what you submit.
• To verify reviews and businesses — legitimate interests in preventing fraud and keeping the Platform trustworthy, with your consent when you upload a document.
• To keep the Platform safe, handle reports and comply with the law — legitimate interests and legal obligation.

In all cases we process personal data in accordance with the data protection principles under the Data Protection Act 2017 — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.

4. Data minimisation for verification

Identity and verification documents are held in restricted storage, accessible only to authorised staff via short-lived links, and are permanently deleted once the verification decision is recorded. We keep only the result of the check, never the underlying document or ID number.

5. What is public

Reviews you approve for publication are public and may be seen by anyone and indexed by search engines. They show only your first name and the first letter of your surname, together with the town you select; we never display your full surname or your contact details. Please do not include your own or anyone else's private personal data in a review. A business's contact number is shown publicly only once that business has been verified.

6. Sharing & processors

We do not sell your personal data. We share it with service providers (processors) who act only on our instructions, including: hosting and database/authentication (Supabase), an AI provider used to help phrase reviews (Anthropic), sign-in providers (e.g. Google), and an email delivery provider. Some processors are located outside Mauritius; where personal data is transferred abroad we take steps to ensure an adequate level of protection as required by the Data Protection Act 2017. We may also disclose data where required by law or to protect our rights or the safety of others.

7. Cookies

We use essential cookies needed to sign you in and keep the Platform secure. We do not use advertising cookies. If we add analytics in future, we will update this notice and seek consent where required.

8. How long we keep it (retention schedule)

• Account data (email, sign-in identifiers): while your account is active, and deleted or anonymised within 30 days of account closure, unless we must keep a limited record to comply with the law or defend a legal claim.
• Reviewer display name: stored only as your first name plus the initial of your surname; we do not retain full surnames.
• Published reviews and replies: kept while they remain published. If you delete a review, or we remove it, it is taken from public view promptly and deleted from our systems within 30 days, subject to the listing-removal process in our Terms.
• Draft review notes (the raw text entered before a review is finalised): deleted once the review is approved or rejected.
• Verification documents (identity and invoices): deleted as soon as the verification decision is recorded, typically within days of upload. We keep only the outcome of the check.
• Server and security logs (including IP addresses): kept for up to 90 days, then deleted or anonymised, unless needed for an ongoing security or fraud investigation or a legal claim.
• Moderation and audit records (the fact and outcome of a decision, not the underlying raw content): kept for up to 24 months for accountability.
• Messages you send us (support or contact email): kept for up to 12 months after the matter is resolved.
• Backups: held on a short rolling cycle (around 30 days); data removed from our live systems is purged from backups within that cycle.

9. Your rights

Under the Data Protection Act 2017 you may request access to your personal data, and its correction or erasure; you may object to or ask us to restrict certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact hello@prouva.mu. You also have the right to lodge a complaint with the Data Protection Commissioner of Mauritius.

10. Security

We take reasonable technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricting access to verification documents to authorised staff.

11. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect their personal data.

12. Changes & contact

We may update this notice from time to time; material changes will be shown on the Platform. Questions or requests: hello@prouva.mu, Prouva Ltd, The Grand Business Centre, Level 3, Block A, La Promenade, Telfair, Moka Smart City 80813, Mauritius.