Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information: Email address and password, collected when you register. Passwords are securely hashed by our authentication provider (Supabase Auth); we never store passwords in plain text.
• Consent records: When you accept our Terms and Conditions and this Privacy Policy at registration, we record the date and time, your IP address, and your browser's user-agent string. We keep these records to demonstrate compliance with POPIA.
• Product data: Product names, prices, barcodes, and inventory counts you enter into the application.
• Market and sales data: Craft market names, sales records, stock allocations, and related business information you create.
• Uploaded files: CSV files, PDF documents, and images you upload for AI-powered sales extraction or product import. These files are processed in memory and are not stored permanently.
• Usage and audit data: Label generation counts, AI extraction counts, token usage and uploaded file names, PDF generation records, and security/audit events such as password changes, plan changes, and account deletion.
• Payment information: Subscription payments are processed by Paystack, a third-party payment provider. KraftSpot does not receive or store your full card number, CVV/CVC, PIN, or bank account credentials. See Section 3 for details of what is collected and stored.

2. How We Use Your Information

We use your personal information for the following purposes:

• To create, manage, and authenticate your account.
• To provide the KraftSpot service, including inventory management, barcode generation, label printing, and sales tracking.
• To process AI-powered sales extraction when you upload CSV or PDF files.
• To process subscription payments and manage billing through Paystack.
• To maintain consent and audit records as required by POPIA and for accounting purposes.
• To send transactional emails related to your account (e.g., password resets, email verification).
• To detect, prevent, and investigate fraud, abuse, or unauthorised access.
• To comply with legal, tax, and accounting obligations.
• To improve and develop the application.

We will not use your email address or personal information for marketing purposes unless you explicitly opt in. We will never sell your personal information to third parties.

3. Payments and Paystack

KraftSpot uses Paystack (Paystack Payments Limited, a Stripe company) as its payment provider for paid subscriptions. Paystack handles card and bank transactions on our behalf.

If you decide to pay for a subscription, you will complete the payment through Paystack's secure checkout. Paystack will collect and process your payment and customer information directly in order to process the transaction and administer the recurring subscription. This may include your name, email address, card number or bank account details, card expiry date, CVV/CVC, and any other information required to process the payment. Paystack processes this information under its own terms of service and privacy policy, which we encourage you to review.

KraftSpot stores only what is necessary to manage your subscription:

• Your plan and subscription status, and the start and end dates of your billing period.
• Paystack customer, subscription, and email-token identifiers needed to activate, manage, or cancel your subscription.
• A payment history containing the Paystack transaction reference, amount, payment status, and the transaction data Paystack sends us. That data can include your email address, contact details you provided to Paystack, and limited card metadata such as card brand, issuing bank, and the last four digits of the card.

We never receive or store your full card number, CVV/CVC, PIN, or bank account credentials. Paystack is PCI-DSS compliant and is responsible for securing payment card data.

Paystack's processing is governed by its Terms of Service (including its Acceptable Use Policy) and its Privacy & Cookie Policy.

If you do not wish to provide payment information to Paystack, you can continue to use the Free tier without making any payment.

4. AI Data Processing

When you use our AI-powered sales extraction feature, your uploaded files (CSV, PDF, or images) are sent to external AI providers for processing. These providers include:

• OpenRouter (when using the openrouter AI provider) - subject to OpenRouter's privacy policy.
• Microsoft Azure OpenAI (when using the azure AI provider) - subject to Microsoft's privacy policy.

The content of your uploaded files (product names, prices, quantities, sales data) is transmitted to these providers for the sole purpose of extracting structured data. We do not use your file contents to train AI models. Processed data is returned to KraftSpot and used only to populate your inventory and sales records.

5. Third-Party Services

We use the following third-party services that may process your data:

• Supabase - database and authentication hosting. Data may be stored on servers outside of South Africa. Subject to Supabase's privacy policy.
• Paystack - payment processing for subscriptions. Paystack collects and processes payment and customer details directly, as described in Section 3. We never have access to your full card or bank credentials. Subject to Paystack's terms and privacy policy.
• OpenRouter / Microsoft Azure OpenAI - AI processing of uploaded files as described in Section 4 above.

6. Cookies

KraftSpot uses the following cookies:

• auth-token - an httpOnly cookie used to authenticate your session. This cookie is essential for the application to function and is not used for tracking or analytics.
• theme - a localStorage preference for light/dark mode. This is stored in your browser and is not sent to our servers.

We do not use advertising cookies, analytics tracking cookies, or third-party tracking technologies. Paystack may use its own cookies when you interact with its checkout; those are governed by Paystack's Privacy & Cookie Policy.

7. International Data Transfers

Your data may be stored and processed on servers located outside of South Africa, including but not limited to Supabase cloud infrastructure, Paystack's payment infrastructure (Paystack is a Stripe company and may process data in Nigeria, the European Economic Area, and other jurisdictions), and AI provider servers. We ensure that any international data transfers are handled in accordance with POPIA requirements, and that the receiving parties maintain adequate levels of data protection equivalent to South African standards.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specifically:

• Account data: Retained until you request account deletion, after which your account and associated records are deleted.
• Consent records: Retained while your account is active and for as long as necessary to demonstrate compliance with POPIA.
• Product and sales data: Retained as long as your account is active.
• Uploaded files: Not stored permanently. Files are processed in memory and discarded after extraction.
• Payment records: Retained as required by South African tax and financial regulations (generally five years).
• Audit logs: Retained for security and accountability. When you delete your account, a record of the deletion (including an email snapshot and timestamp) is retained so that the action can be audited; it is not linked to an active user account.
• Usage data: May be retained in aggregated, anonymised form for service improvement.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS/HTTPS), secure password hashing, httpOnly cookies, and Row Level Security (RLS) on our database to ensure users can only access their own data. Payment card data is handled by Paystack in accordance with PCI-DSS. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights Under POPIA

Under the Protection of Personal Information Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your account and associated personal data.
• Object to processing of your personal information for specific purposes.
• Complain to the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of these rights, contact our Information Officer at [email protected].

11. Children's Privacy

KraftSpot is not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact

For any questions about this privacy policy or to exercise your data rights, please contact our Information Officer:

• Email: [email protected]