1. Who We Are

Shiphustle is a cross-border e-commerce platform operated from the Republic of South Africa. Our website address is: https://shiphustle.com. We enable consumers in Southern Africa to purchase goods from South African online retailers and have them delivered via registered courier partners.

---

2. Information We Collect

We collect the following information when you use Shiphustle:

• Account information: name, email address, phone number, date of birth, gender.
• Identity documents: ID number, ID document scan, passport number, passport scan — required for customs clearance on cross-border shipments.
• Delivery addresses and GPS coordinates for delivery zone matching.
• Order history, cart contents, and payment transaction records.
• Payment card details: when you make a payment, your card authorisation is stored securely by Paystack. We store a reference token, card type, last 4 digits, and expiry date to enable one-tap payments on future orders. We do not store full card numbers.
• Order ratings and feedback: star ratings, optional comments, and feedback tags you provide after delivery.
• Device information: device tokens for push notifications, platform type (Android/iOS), and app crash reports via Firebase Crashlytics.
• Notification preferences: your choices about which push and email notifications to receive.
• Authentication data: login method (email, Google, Apple), two-factor authentication settings, and session information.

---

3. How We Use Your Information

• To process and fulfil your orders, including customs documentation.
• To verify your identity as required by cross-border trade regulations.
• To communicate with you about orders, deliveries, and account activity via push notifications, email, SMS, and in-app messages.
• To match you with courier delivery zones and calculate shipping costs.
• To process payments securely via Paystack and enable saved card functionality for faster checkout.
• To improve the platform, diagnose technical issues via crash reports, and prevent fraud.
• To display order ratings and feedback to courier partners and administrators for service quality purposes.

---

4. Information Sharing

We share your information only as necessary to provide the service:

• Courier partners: your name, delivery address, phone number, and email for delivery fulfilment.
• Customs authorities: identity and order information as required by law.
• Paystack: payment details for transaction processing and saved card management.
• Firebase/Google: anonymous crash reports and device tokens for push notifications. No personal data is included in crash reports.
• Law enforcement: when required by law or to protect our rights.

We do not sell your personal information to third parties.

---

5. Data Storage and Security

Your data is stored securely on Supabase infrastructure with row-level security policies ensuring users can only access their own data. Identity documents are stored in encrypted private storage buckets accessible only to you and authorised administrators. All data transmission uses TLS encryption. Payment card tokens are stored with Paystack’s PCI-DSS compliant infrastructure.

---

6. Your Rights

You have the right to:

• Access your personal data through your profile screen in the app.
• Correct inaccurate information by editing your profile.
• Delete your account directly from the app (Account Settings → Delete Account). Deletion is scheduled with a 14-day grace period during which you can cancel the request. After 14 days, your personal data is permanently anonymized, uploaded documents are deleted from storage, and your account is deactivated. Deletion is blocked while you have active orders or active courier assignments.
• Control notifications by adjusting push, email, and SMS preferences per category in the app.
• Remove saved payment cards at any time under Account Settings → Saved Payment Methods. Removing a card deletes the stored authorisation token, card type, last 4 digits, and expiry date from your account, so it can no longer be used for one-tap payments. You can save a card again on your next purchase.
• Withdraw consent for optional data processing.

To exercise these rights or for any privacy-related requests, contact us at support@shiphustle.com.

---

7. Cookies and Tracking

The Shiphustle mobile app does not use cookies. Our website uses minimal cookies for essential functionality only (WordPress session management). We do not use third-party advertising trackers. Firebase Crashlytics collects anonymous crash data to help us fix bugs — no personally identifiable information is included.

---

8. Data Retention

We retain your account data for as long as your account is active. Order records, invoices, credit notes, and customs documentation are retained for 5 years as required by the Tax Administration Act and cross-border trade regulations. Crash reports are retained for 90 days. When you delete your account, personal data is anonymized after the 14-day grace period. An anonymized reference is retained to preserve the integrity of financial records as required by law.

---

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of the platform after changes constitutes acceptance.