Privacy Policy

Effective 7 September 2026 This Privacy Policy explains what personal information LaProfy collects when you use our app or website, why we collect it, who we share it with, and the rights you have over it under South Africa's Protection of Personal Information Act, 2013 (POPIA). LaProfy [LaProfy (Pty) Ltd — registration number] ("LaProfy, "we", "us") is the responsible party for the processing described here. 1. INFORMATION WE COLLECT Account details — full name, email address, phone number, and password (stored as a salted hash; we never see it in plain text). Collected when you sign up. Order and pickup data — cart contents, order history, the store you ordered from, your scheduled pickup time, and your pickup PIN/QR code. Created when you place an order. Payment confirmation — whether a payment succeeded, the amount, and a payment reference. We never receive or store your card number or online banking login details — see "Payments" below. Location — approximate or precise location, only while the app is open and only if you allow it, used to show stores near you. Camera — used to scan a barcode or QR code when you choose to. Photos — images you choose to attach, e.g. to a review or a support ticket. Voice — speech converted to text on your device when you talk to LaProfy Assistant. Loyalty and reviews — your points balance and history, and any ratings or reviews you write. Support messages — anything you send us through a support ticket or in-app chat. Technical data — IP address, device/app version, and sign-in timestamps, kept for security and fraud prevention. 2. HOW WE USE IT We use your information to create and secure your account; process and fulfil your orders and generate your pickup PIN/QR code; show you stores and products near you; send order-status notifications (payment confirmed, ready for collection — these are always on, since they're how you know when to collect); send marketing messages, but only if you opt in — this is off by default and you can turn it off any time; run our loyalty points programme; respond to support requests and investigate disputes or refunds; detect and prevent fraud and payment abuse; and meet our legal, tax, and accounting record-keeping obligations. We do not sell your personal information, and we do not use it to build advertising profiles for third parties. 3. PAYMENTS — STITCH All payments are processed by Stitch, a licensed South African payment service provider, using Pay by Bank (instant EFT). You're redirected to your own bank's secure login to approve payment, then returned to LaProfy. We receive confirmation that payment succeeded and a reference number — we never receive or store your online banking credentials, card number, or PIN. Stitch processes that information under its own privacy policy as an independent responsible party. 4. LaProfy ASSISTANT (AI) If you choose to use LaProfy Assistant, your message and the minimum context needed to answer it (e.g. your recent search or order) are sent to our AI provider, Anthropic, to generate a reply. The assistant can only look up your own real cart, orders, and the live catalogue — never anyone else's data, and never your payment details. You can use LaProfy fully without ever opening the assistant. 5. WHO WE SHARE IT WITH We share personal information only where it's needed to run LaProfy: the store you order from (enough to prepare and hand over your order); Stitch, to process payment; Anthropic, only if you use LaProfy Assistant; cloud hosting and database providers who store LaProfy's data on our behalf, under contract, only as instructed by us; and law enforcement or regulators, only where we're legally required to. We do not share your information with third parties for their own marketing purposes. 6. CROSS-BORDER TRANSFERS Some of the providers above (including Anthropic) process data outside South Africa. Where that happens, we rely on the contractual safeguards required by POPIA section 72. 7. HOW LONG WE KEEP IT We keep account and order data for as long as your account is active, and afterwards for as long as needed to meet tax, accounting, and dispute-resolution obligations (typically [5 years] from the relevant transaction). If you request deletion, we remove what we can immediately and retain only what we're legally required to. 8. SECURITY We use reasonable technical and organisational measures to protect your information, including encryption in transit, salted password hashing, two-factor authentication on staff and admin accounts, PIN-protected in-store devices, rate-limiting against automated attacks, and audit logging of sensitive actions. 9. YOUR RIGHTS UNDER POPIA You have the right to access the personal information we hold about you; correct information that's inaccurate or out of date; request deletion of your account and data, subject to our legal retention obligations above; object to processing carried out for direct marketing at any time; and lodge a complaint with South Africa's Information Regulator if you believe we've mishandled your information. You can exercise most of these rights yourself, any time, from Settings → Privacy & Data in the app. Information Regulator (South Africa): inforegulator.org.za 10. COOKIES AND DEVICE DATA LaProfy's website uses only the cookies and local storage needed to keep you signed in and remember basic preferences — nothing used for cross-site advertising tracking. The mobile app stores your session and preferences locally on your device using secure storage. 11. CHILDREN LaProfy is intended for people who are legally able to enter into a binding contract and hold a bank account capable of making payments — in South Africa, generally 18 or older. We don't knowingly collect personal information from children without a parent or guardian's consent. 12. CHANGES TO THIS POLICY If we make a material change to how we handle your information, we'll update the effective date above and notify you in the app before the change takes effect. 13. CONTACT AND INFORMATION OFFICER Questions about this policy, or want to exercise a right above directly? Contact our Information Officer: [Information Officer name] · [privacy@laprofy.com] · [registered business address]