Privacy Policy

1. Information We Collect

We collect personal information that you provide directly and information generated through your use of our platform.

Account & Identity Information

• Full name
• Email address
• Phone number
• Password (stored as a secure hash by Supabase — never in plain text)

Delivery Information

• Pickup address
• Drop-off address
• Package details (size, weight, description)
• Delivery instructions and preferences

Payment Information

Payments are processed by Yoco, a PCI-DSS-compliant payment gateway. We do not store your card numbers, CVV codes, or full payment card details on our systems. We retain only a transaction reference for reconciliation purposes.

Usage & Technical Information

• IP address and approximate location (inferred from IP)
• Browser type and device information
• Pages visited and actions taken on our platform
• Date and time of access

2. How We Use Your Information

We process your personal information only for lawful purposes directly related to the operation of our service. Specifically, we use your information to:

• Create and manage your account
• Process and fulfil delivery bookings
• Compare delivery quotes from third-party providers on your behalf
• Process payments through Yoco
• Send transactional emails (booking confirmations, status updates) via Resend
• Send SMS delivery notifications via BulkSMS.com
• Respond to customer service enquiries
• Comply with legal and regulatory obligations under South African law
• Detect and prevent fraud or abuse of our platform

We will not use your personal information for direct marketing without your explicit consent, and you may withdraw that consent at any time.

3. Information Sharing

We do not sell your personal information. We share your information only with the third-party service providers listed below, and only to the extent necessary to deliver our service.

Delivery Providers

Your name, phone number, pickup address, and drop-off address are shared with the delivery provider you select when placing a booking. This is necessary to fulfil the delivery contract.

Payment Processor — Yoco

Payment transactions are processed by Yoco Technologies (Pty) Ltd. Your payment card details are submitted directly to Yoco and are never transmitted to or stored on DeliverAI servers. Yoco is subject to its own privacy policy and PCI-DSS obligations.

Authentication — Supabase

Account authentication is handled by Supabase, which stores your email address and a cryptographic hash of your password. Supabase operates under its own data processing agreement and security standards.

Email Communications — Resend

Transactional emails (such as booking confirmations) are sent on our behalf by Resend Inc. using the address bookings@deliverai.co.za. Your email address is shared with Resend solely for this purpose.

SMS Notifications — BulkSMS.com

Delivery status notifications may be sent to your mobile number via BulkSMS.com. Your phone number is shared with BulkSMS.com solely for the purpose of delivering these notifications.

Legal Disclosure

We may disclose your personal information if required to do so by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect our rights or the safety of others.

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS) for all communications
• Password hashing — your password is never stored in plain text
• Restricted access to personal data on a need-to-know basis
• Use of trusted, industry-standard third-party infrastructure

No method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that poses a risk to you, we will notify you and the Information Regulator as required under POPIA.

5. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights:

Right of Access

You may request a copy of the personal information we hold about you at any time.

Right to Correction

If you believe any personal information we hold about you is inaccurate, incomplete, or misleading, you have the right to request that it be corrected or updated.

Right to Deletion

You may request the deletion of your personal information where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and we have no other legal basis for processing. Note that we may need to retain certain information to comply with legal obligations or resolve disputes.

Right to Object

You have the right to object to the processing of your personal information for direct marketing purposes. You may also object to processing based on legitimate interests where you have grounds relating to your particular situation.

Right to Lodge a Complaint

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa:

To exercise any of the rights above, please contact our Information Officer at hello@deliverai.co.za. We will respond within 30 days of receiving your request.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations:

• Account information — retained for the duration of your account and for up to 12 months after account closure, unless you request earlier deletion.
• Delivery and transaction records — retained for a minimum of 5 years to comply with South African tax and financial record-keeping requirements.
• Communication logs — retained for up to 12 months for customer support and dispute resolution purposes.

Once the retention period expires, personal information is securely deleted or anonymised.

7. Cookies

Our website uses cookies and similar technologies to maintain your session, remember your preferences, and ensure the platform functions correctly. We currently use:

• Essential cookies — required for authentication and basic platform functionality. These cannot be disabled without affecting your ability to use the service.
• Session cookies — temporary cookies deleted when you close your browser, used to maintain your logged-in state.

We do not currently use third-party analytics or advertising cookies. You can control cookie behaviour through your browser settings, although disabling essential cookies may impair platform functionality.

8. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a child under 18 without appropriate parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us at hello@deliverai.co.za.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. When we make material changes, we will notify you by email (if you have an account) or by posting a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

10. Information Officer Contact

In terms of POPIA, we have designated an Information Officer responsible for overseeing compliance with this policy and handling data subject requests.

For any questions, requests, or concerns regarding your personal information or this Privacy Policy, please contact the Information Officer at the email address above. We will acknowledge receipt of your request within 3 business days and provide a full response within 30 days.