Privacy Policy

This Privacy Policy explains how Shelfie ("Shelfie", "we", "us") collects, uses, discloses and protects personal information when you use the Shelfie platform — a retail point-of-sale, stock-management and field-service application for South African businesses. It is written with the Protection of Personal Information Act, 2013 ("POPIA") in mind. For a focused POPIA disclosure, see our POPIA Disclosure.

1. Who is responsible for your information

Shelfie acts in two distinct roles, and which role applies determines who is responsible for the information:

• As responsible party (controller). For the account and billing information of the business owners and staff who sign up for Shelfie, Shelfie is the responsible party and decides why and how that information is processed.
• As operator (processor). For the customer and transaction data that a business captures inside Shelfie — its own customers' names, contact details, orders, invoices and WhatsApp conversations — the business is the responsible party. Shelfie processes that data on the business's behalf, only on its documented instructions, under the operator terms in section 5 of our Terms of Service. If you are a customer of a business that uses Shelfie, please direct data-subject requests to that business in the first instance.

2. Information we collect

2.1 Account and billing information (Shelfie as responsible party)

• Business owner and staff names, email addresses and roles.
• The owner's billing email and subscription/payment status.
• Authentication data (hashed passwords, session and device information, IP address and user-agent).
• A security audit log: sign-ins and failed sign-ins, password resets, team and role changes, and changes to payment and WhatsApp connections, with the IP address and browser each came from. It never records passwords, keys or what was typed.
• Support correspondence you send us.

2.2 Customer and transaction data (Shelfie as operator for the business)

• The business's customer names, phone numbers, email addresses and physical/delivery addresses.
• WhatsApp messages sent to the business's number are read to send an automatic reply (such as the shop link) and are not stored. We keep only a message identifier, for 30 days, so the same message is never answered twice.
• If the business connects its own WhatsApp Business number, the phone numbers (not names) of its WhatsApp contacts, so that automatic replies leave its friends and family alone.
• People who message the business's WhatsApp number: their number, when they last wrote and when they were last answered. Not what they said.
• Quotes, invoices, orders, payments and field-service job records. When a customer approves a quote online, the IP address and browser they approved it from are kept with the quote as a record of the approval.
• Product catalogue, stock levels and stock-movement history.

2.3 Technical information

• Log data, error reports and basic usage analytics needed to operate, secure and improve the service.
• Cookies strictly necessary for authentication and language preferences.

When a shop owner opens the WhatsApp connection screen (in Settings or during setup), we load Meta's Facebook SDK so the number can be connected through Facebook. Meta receives the visitor's IP address, browser details and the page address when the screen opens, before anything is clicked. We switch off the SDK's event logging, and it isn't loaded on any other page.

Shelfie does not store full card numbers. Card and EFT payments are handled by our payment providers on their own secure, PCI-DSS-compliant infrastructure (see section 5).

3. Why we process your information (lawful basis)

• To provide the service — performance of the contract between Shelfie and the business, and between the business and its customers.
• To bill and take payment — managing subscriptions and processing payments.
• To secure the service — authentication, fraud prevention and audit logging (legitimate interest).
• To support and improve the product — responding to queries and diagnosing faults.
• To meet legal obligations — e.g. tax and accounting record-keeping.

4. How long we keep it (retention)

We keep personal information only for as long as necessary for the purposes above or as required by law. A summary schedule:

5. Third parties and sub-processors

We share information with a small set of service providers who process it on our behalf to run the platform. We require each to protect the information and use it only for the agreed purpose.

Transfers outside South Africa (POPIA section 72). Hetzner and Sentry process the data in Germany, where the EU General Data Protection Regulation gives protection at least as strong as POPIA (section 72(1)(a)). Resend and Meta may process it in the USA. Each is bound by its data processing terms with us, which require an adequate level of protection (section 72(1)(a)), and the transfer is needed to send the emails and WhatsApp messages the service exists to send (section 72(1)(c) and (d)). Backups are encrypted before they leave our server; the decryption key is kept offline. See also our POPIA Disclosure. We do not sell your personal information.

6. Your rights as a data subject

Under POPIA you have the right to:

• Be told whether we hold information about you, and to access it.
• Request correction or deletion of inaccurate, irrelevant, excessive or unlawfully obtained information.
• Object, on reasonable grounds, to the processing of your information.
• Object to direct marketing and withdraw any consent you have given.
• Lodge a complaint with the Information Regulator (South Africa).

To exercise these rights, contact our Information Officer (section 7). If your information was captured by a business that uses Shelfie, contact that business; we will assist them as their operator.

7. Information Officer & contact

Shelfie is operated by GETTINDRIKKIEWITHIT (PTY) LTD.
Information Officer: Drikus van der Walt, Director
Email: info@shelfie.co.za
Postal address: 61 Van Eeden Street, Waterbron, Bloemfontein 9301, South Africa

You may also contact the Information Regulator of South Africa (inforegulator.org.za).

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the platform or by email. The "Last updated" date above reflects the most recent revision.