Privacy Policy

1. Introduction

Mall Drop ("we", "our", or "us") operates the Mall Drop mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our App, whether as a buyer, vendor, courier, or administrator.

By downloading, installing, or using Mall Drop, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access or use the App.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Full name, username, email address, phone number, and password when you register for an account.
• Profile Information: Profile picture/avatar, role selection (buyer, vendor, courier), and account preferences.
• Vendor Information: Business details including formal or informal business registration, store name, store description, store images, and business assets.
• Transaction Information: Delivery addresses, order details, payment preferences, and billing information.
• Content You Create: Product listings, reviews, star ratings, support ticket messages, and dispute submissions.
• Communication Data: Messages sent through support tickets and dispute resolution channels.

2.2 Information Collected Automatically

• Device Information: Device type, operating system version, unique device identifiers, and device capabilities (including biometric support).
• Location Data: GPS coordinates when you use delivery tracking, store discovery, or courier functionality (with your permission).
• Usage Data: App interaction data including pages visited, features used, and session duration.
• Authentication Data: Login timestamps, session tokens, biometric enrollment status, and last authentication time.

2.3 Information from Third Parties

• Payment Data: Transaction confirmations, payment status, and charge identifiers from Yoco (our primary payment processor) and Ozow (bank transfers and vendor payouts).
• Shipping Data: Delivery quotes, tracking information, and shipment status from ShipLogic (domestic) and Easyship (international).

3. How We Use Your Information

We use the information we collect for the following purposes:

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

4.1 With Other Users

• Buyers can see vendor store names, product listings, and aggregate store ratings.
• Vendors can see buyer delivery addresses and order details necessary to fulfil orders.
• Couriers can see pickup and delivery addresses for accepted jobs. Buyers can see courier location during active deliveries.

4.2 With Third-Party Service Providers

• Yoco: Primary payment processing — we share transaction amounts and order references to process card payments and refunds.
• Ozow: Secondary payment processing — we share transaction data for bank transfers, vendor payouts, and courier payouts.
• ShipLogic & Easyship: Shipping logistics — we share delivery addresses and parcel details to calculate quotes and arrange deliveries.
• Google Maps: Mapping services — location data is used to display maps, calculate routes, and enable delivery tracking.
• Supabase: Backend infrastructure — all user data is stored securely on Supabase's hosted PostgreSQL database and object storage.

4.3 For Legal Reasons

We may disclose your information if required to do so by law, or in response to valid legal processes such as a court order, subpoena, or government request.

5. Data Storage and Security

5.1 Where We Store Your Data

• Cloud Database: User profiles, orders, products, payments, and support data are stored in a PostgreSQL database hosted by Supabase.
• Object Storage: Product images and store assets are stored in Supabase Storage buckets (product-images and store-assets).
• On Your Device: Authentication tokens are stored in encrypted secure storage (Flutter Secure Storage). App preferences (theme, onboarding status) are stored in local SharedPreferences.

5.2 How We Protect Your Data

• Authentication tokens are encrypted using platform-native secure storage (Keychain on iOS, EncryptedSharedPreferences on Android).
• All communications between the app and our servers use HTTPS/TLS encryption.
• Passwords are hashed and managed by Supabase Auth — we never store plaintext passwords.
• Sessions automatically expire after 30 minutes of inactivity.
• Biometric and PIN authentication add additional layers of device-level security. PINs are hashed using PBKDF2-HMAC-SHA256 before storage.
• Row Level Security (RLS) policies on the database ensure users can only access data they are authorised to view.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate personal information through your profile settings or by contacting us.
• Deletion: Request deletion of your account and associated personal data. Some data may be retained for legal or operational reasons.
• Portability: Request your data in a structured, commonly used format.
• Withdrawal of Consent: Revoke previously granted permissions (e.g., location access) through your device settings at any time.
• Objection: Object to certain processing activities where we rely on legitimate interest.

To exercise any of these rights, contact us at privacy@bountifulai.co.za.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specific retention periods include:

• Account data: Retained while your account is active and for 30 days after deletion request.
• Transaction records: Retained for 5 years to comply with financial record-keeping requirements.
• Support tickets: Retained for 2 years after resolution.
• Location data: Delivery tracking data is retained for 90 days after delivery completion.

8. Children's Privacy

Mall Drop is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

9. Cookies and Local Storage

The Mall Drop mobile app does not use browser cookies. However, we use the following local storage mechanisms:

• Secure Storage: For authentication tokens (encrypted, platform-native).
• SharedPreferences: For app settings such as theme preference and onboarding completion status. This data never leaves your device.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective Date" at the top of this page and notify you through the App. We encourage you to review this policy periodically.

Continued use of Mall Drop after changes are posted constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: