Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information: Email address and securely hashed password, collected when you register.
• Product data: Product names, prices, barcodes, and inventory counts you enter into the application.
• Market and sales data: Craft market names, sales records, stock allocations, and related business information you create.
• Uploaded files: CSV files and PDF documents you upload for AI-powered sales extraction or product import.
• Usage data: Pages visited, features used, and interaction patterns within the application.
• Payment information: Subscription billing is handled entirely by PayFast. We do not collect, store, or have access to your credit card number, bank details, or other payment credentials. PayFast may collect your name, email, and billing address for payment processing.

2. How We Use Your Information

We use your personal information for the following purposes:

• To create, manage, and authenticate your account.
• To provide the KraftSpot service, including inventory management, barcode generation, label printing, and sales tracking.
• To process AI-powered sales extraction when you upload CSV or PDF files.
• To process subscription payments through PayFast.
• To send transactional emails related to your account (e.g., password resets, email verification).
• To improve and develop the application.

We will not use your email address or personal information for marketing purposes unless you explicitly opt in. We will never sell your personal information to third parties.

3. AI Data Processing

When you use our AI-powered sales extraction feature, your uploaded files (CSV or PDF) are sent to external AI providers for processing. These providers include:

• OpenRouter (when using the openrouter AI provider) — subject to OpenRouter's privacy policy.
• Microsoft Azure OpenAI (when using the azure AI provider) — subject to Microsoft's privacy policy.

The content of your uploaded files (product names, prices, quantities, sales data) is transmitted to these providers for the sole purpose of extracting structured data. We do not use your file contents to train AI models. Processed data is returned to KraftSpot and used only to populate your inventory and sales records.

4. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — database and authentication hosting. Data may be stored on servers outside of South Africa. Subject to Supabase's privacy policy.
• PayFast — payment processing for subscriptions. PayFast collects payment details directly and we never have access to your card or bank information. Subject to PayFast's terms.
• OpenRouter / Microsoft Azure OpenAI — AI processing of uploaded files as described in Section 3 above.

5. Cookies

KraftSpot uses the following cookies:

• auth-token — an httpOnly cookie used to authenticate your session. This cookie is essential for the application to function and is not used for tracking or analytics.
• theme — a localStorage preference for light/dark mode. This is stored in your browser and is not sent to our servers.

We do not use advertising cookies, analytics tracking cookies, or third-party tracking technologies.

6. International Data Transfers

Your data may be stored and processed on servers located outside of South Africa, including but not limited to Supabase cloud infrastructure and AI provider servers. We ensure that any international data transfers are handled in accordance with POPIA requirements, and that the receiving parties maintain adequate levels of data protection equivalent to South African standards.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specifically:

• Account data: Retained until you request account deletion.
• Product and sales data: Retained as long as your account is active.
• Uploaded files: Not stored permanently. Files are processed in memory and discarded after extraction.
• Payment records: Retained as required by South African tax and financial regulations.
• Usage data: May be retained in aggregated, anonymised form for service improvement.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit (TLS/HTTPS), secure password hashing, httpOnly cookies, and Row Level Security (RLS) on our database to ensure users can only access their own data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights Under POPIA

Under the Protection of Personal Information Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your account and associated personal data.
• Object to processing of your personal information for specific purposes.
• Complain to the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of these rights, contact our Information Officer at [email protected].

10. Children's Privacy

KraftSpot is not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

12. Contact

For any questions about this privacy policy or to exercise your data rights, please contact our Information Officer:

• Email: [email protected]