Privacy Policy

1Who We Are

ShopEazy is operated by Shopeazy Commerce (Pty) Ltd, registration number 2025/247011/07, 14 Libertas Avenue, Table View, Cape Town, 7441 ("ShopEazy", "we", "us"). Our Information Officer is Eamon Boonzaaier, privacy@shopeazy.co. We handle personal information under the Protection of Personal Information Act (POPIA).

2What This Policy Covers

How we handle personal information about people who visit shopeazy.co; merchants and their staff who use ShopEazy; partners and sales agents; and anyone who contacts us.

If you buy from a shop on ShopEazy, read that shop's own privacy policy. The merchant is responsible for their customers' information, and we process it on the merchant's behalf.

3What We Collect

• Website visitors: device and browser details, IP address, the pages you visit, how you arrived (including advertising and referral codes), and cookies (section 9).
• Merchants and their staff: name, email, phone, business details, identity details where the law requires them, your store's content, your orders, bookings and customers, how you use the console, and your messages to us.
• Payment details: bank details you add for bank-transfer checkout (shown to your shoppers). Card details for your ShopEazy subscription are held by our card processor, never by us.
• Partners and sales agents: name, contact details, identity and bank details for payouts, and referral records.
• Anyone who contacts us: what you tell us and your contact details.

4Why We Use It

• To create and run your account and store.
• To bill subscriptions and platform fees.
• To support you and tell you about changes to the service.
• To pay partners and sales agents.
• To keep the platform secure and prevent fraud.
• To improve ShopEazy, using combined, anonymous figures wherever possible.
• To market ShopEazy to you, where you agreed or are an existing customer, always with an easy way to opt out.
• To comply with the law, for example keeping tax records.

Our lawful bases under POPIA section 11 are: performing our contract with you, our legitimate interests in running and improving the business, our legal obligations, and your consent (for marketing to people who aren't customers, and for optional cookies).

5Who We Share It With

• Service providers who help us run ShopEazy: cloud hosting and database, email delivery, messaging, customer relationship management, analytics, error monitoring, accounting, and our card processor.
• AI features: ShopEazy's own AI (product photos and videos, listings written from a photo, captions, designs, Ask ShopEazy) runs on our AI provider's models. The provider receives what that feature needs, such as the photo, the listing or the question you asked with the store details it relates to. Under its terms, it does not use this to train its models.
• Providers you connect: the payment, courier and locker providers you choose, and the AI apps you connect (section 6).
• Others, only when needed: our professional advisers; authorities, where the law requires; and, under confidentiality, potential investors or buyers of the business.

6AI Apps You Connect

You can connect an AI app you use, such as ChatGPT or Claude, to your store. It only works after you sign in to ShopEazy and approve it, and only within the permissions you choose.

• What the app can reach: depending on the permissions you give it, your store details and design; listings, stock, prices and photos; orders, bookings and deliveries, including your customers' names, contact details and delivery addresses; customers and reviews; messages on your connected WhatsApp number; posts, discounts and campaigns; sales, money and credit summaries; your team list; and your activity log. Refunds, buying a plan or credits, spending AI credits and booking couriers stay off unless you switch them on. Staff can only give an app what their own role allows.
• Where it goes: what the app reads from your store goes to the company that runs the app (for example OpenAI or Anthropic), which may process it outside South Africa under its own terms and privacy policy. You choose to make that transfer, as the responsible party for your customers' information, so choose an app whose terms suit your business.
• What we keep: a record of each connection (the app, who connected it, its permissions and when it was last used), and every important change it makes, named after the app, in your activity log. We do not see your conversation with the AI app, only what it asks your store to do.
• Switching it off: Settings, then AI apps, lists every connection. Disconnect one and it stops at once. Closing your business or your account stops them all.

7Where It Is Stored

Our main database and file storage are in South Africa, in our cloud provider's Johannesburg region. Some service providers, including the AI services in sections 5 and 6, process information outside South Africa, mostly in the European Union and the United States. We use providers bound by laws, rules or agreements that give adequate protection, as POPIA section 72 requires.

8How Long We Keep It

While your account is active, and after that for as long as the law or a legitimate need requires (usually 5 years for billing and tax records). Then we delete or anonymise it. Our PAIA manual sets out how we keep records.

9Cookies and Tracking

On shopeazy.co we measure how people find and use the site, so we know which campaigns work. The cookie banner lets you choose by category:

• Necessary (always on, no personal information). Vercel Web Analytics counts page views without cookies. A first-party cookie (se_attr) remembers the campaign tag, referring website and landing page you arrived with, so we can tell which channel led to a sign-up. It holds no name, email or device ID and expires after 90 days. Your cookie choice is kept in se_consent and se_consent_prefs.
• Analytics (only if you allow it). Google Analytics and HubSpot record the pages you visit. If you contact us or sign up, HubSpot lets our team see what you were interested in.
• Marketing (only if you allow it). The Meta Pixel measures our advertising. When you create a ShopEazy account, we tell Meta and Google that a sign-up happened, using your email address in hashed (unreadable) form so it can be matched to an ad.

Nothing in Analytics or Marketing loads until you allow it. You can Change your cookie choice at any time, or block cookies in your browser settings. Blocking the console's own sign-in cookies stops it working.

10Your Rights

Under POPIA you may ask us:

• what personal information we hold about you;
• to correct or delete it;
• to stop using it for direct marketing (any time, free);
• to stop processing it where we rely on our legitimate interests.

Email privacy@shopeazy.co. We reply within 30 days of confirming who you are. You may also complain to the Information Regulator: enquiries@inforegulator.org.za, inforegulator.org.za.

11Security

• Information is encrypted in transit and at rest; payment and courier keys you connect are encrypted again with our own keys.
• Access is limited by role, and risky changes (bank details, payment keys, a new admin, closing an account) need a fresh code sent to your email first.
• We monitor for errors and failures, and back up our database daily with point-in-time recovery.
• We require our service providers to protect information too.

If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

12Children

ShopEazy is for businesses. You must be 18 or older to open an account. We do not knowingly collect information from children.

13Changes

We post changes here. For significant changes we email merchants at least 14 days before they take effect.