Privacy policy

Who is responsible

KasiCart is run by the KasiCart team. Under the Protection of Personal Information Act (POPIA) we are the "responsible party" for your information.

Our contact details are being added. Until then, use the Flag button on a post, or reply to any email we sent you.

What we collect, and why

• Your account. Your email address, and a display name if you add one. Your password is handled by our sign-in provider; we never see it.
• Prices you add. The item, the price, the shop and when you saw it. Prices are shown to everyone without your name.
• Where you shop. The area you choose or your phone’s location when you choose to share it, so we can show shops and prices near you. Other people never see your location.
• Your lists and spending. Shopping lists you save, what you tick off in the trolley and the spending you record. Only you (and the people you share a household or stokvel list with) can see them.
• Voice notes (members only). Your recording is sent to an AI service to write it out as text. We keep the text, not the recording.
• Till slips and shelf photos. The photo is read by an AI service to find the prices, and then deleted, normally within 48 hours. The prices you confirm are kept, and only you can see which slips were yours.
• Shops you list. Your shop’s name, type, address, map pin, phone and WhatsApp numbers, opening hours, photos and prices. These are shown publicly once an administrator has checked the shop.
• Your choices. Your saved area for alerts, which alerts you want, and the shops you follow. If you allow notifications, a code from your phone or browser so we can send them.
• Technical details. A scrambled (hashed) version of your connection or account, used to stop spam and abuse. We do not use advertising trackers or sell your information.

We use this only to run KasiCart: to show prices and shops near you, price your shopping lists, send the alerts you chose and keep the site safe from spam and abuse. We do not sell your information. Shops can pay to be featured; featured spots are always labelled.

What other people can see

Prices you add are public, without your name, email or contact number. Listed shops are public once checked. Your till slips, lists, spending, saved area and alert choices are private to you.

Who else handles your information

We use these service providers. They may only use your information to do this work for us. Some of them store or process information outside South Africa; we only use providers that protect it to a standard similar to POPIA (section 72).

• Sign-in and storage: Supabase, which runs our sign-in and can store photos.
• AI services: An AI provider (for example OpenAI) that writes out voice notes and reads till slips. Only the recording or photo and the words needed are sent.
• Email: Our email provider (for example SendGrid or our own mail server), to send sign-in links and the alerts you asked for.
• Maps and place search: Google Maps or OpenStreetMap, to find places you search for.
• Bot checks: Cloudflare Turnstile or hCaptcha, to check that a person, not a script, is using a form.
• Hosting: The servers that run the app.

We may also have to share information when the law requires it, for example a court order.

How long we keep it

• Your account, until you delete it.
• Posts and prices stay as community records. If you delete your account they stay up without your name or contact details.
• Till slip and shelf photos: deleted after their prices are read, normally within 48 hours.
• Voice recordings: not kept. Only the text is.
• Photos that were uploaded but never posted: deleted within a day.

Your rights

Under POPIA you can:

• See what we hold: on your Profile tap Download my data.
• Correct it: change your name and settings on your Profile, or ask us.
• Delete it: on your Profile tap Delete my account. Your posts stay up without your name or contact details.
• Object to how we use your information, or ask questions, using the contact details above.
• Complain to the Information Regulator: inforegulator.org.za, complaints.IR@inforegulator.org.za.

Children

If you are under 18, ask a parent or guardian before you create an account. Never post photos of children.

Keeping it safe

Connections are encrypted, passwords are handled by our sign-in provider, stored keys are encrypted, and only a few administrators can see private details such as contact numbers. If something goes wrong that puts your information at risk, we will tell you and the Information Regulator.

Changes

If we change this policy we will update the date at the top and, for big changes, tell you by email or in the app.