Privacy Policy
Last updated: [DATE YOU PUBLISH]
1. Who we are
Bonolo Kompe, trading as Bioryte, is the responsible party under the Protection of Personal Information Act, 2013 (POPIA). We are based at [PHYSICAL ADDRESS], Parys, Free State, South Africa.
Our Information Officer is Bonolo Kompe: bioryte.llc@gmail.com.
2. What we collect
| Where | What we collect | Where it is kept |
|---|---|---|
| Email signup (website) | Your email address and your consent to hear from us | Our database (Supabase) |
| Feedback in the app preview | Your rating, your message, and an email only if you choose to add one | Our database (Supabase) |
| "Tell us about this product" | The barcode and any notes you type | Our database (Supabase) |
| Profiles, history and badges in the preview | Nicknames, age groups, allergy choices, scanned products | Only in your own browser (local storage) |
| Barcode lookups | The barcode number, sent from your browser to Open Food Facts | Open Food Facts (see section 5) |
| Support payments | Payment details are entered on PayFast's page. We receive confirmation of the payment, the amount and the name or email you gave PayFast. We never see your card number. | PayFast, and our records of the payment |
We do not currently use analytics or advertising trackers. We do not ask for your ID number, home address or location. The camera reads barcodes on your device. Camera images are not uploaded or stored by us.
3. Why we use it
- To send you updates about Bioryte, if you signed up and agreed (your consent).
- To read feedback and product reports so we can fix mistakes and improve the app (our legitimate interest in improving a service you chose to use).
- To add missing products and correct wrong ones.
- To record and manage support payments, as the law and our accounting require.
- To keep the site and app secure and working.
We do not sell personal information.
4. Children
Children can use Bioryte Scan only through a parent or guardian. A child profile must be created by an adult who consents to it. Under POPIA we need the consent of a competent person, such as a parent, before processing a child's information.
For a child profile we keep a nickname and an age group only. We do not ask for a child's surname, school, photo, ID number or location. In the app preview the profile stays in the browser on the parent's device and is not sent to us. We do not take payments from children.
A parent can delete a child's profile in the app, or write to us to delete anything we hold. If you believe a child has sent us information without a parent's consent, tell us and we will delete it.
5. Who we share it with
| Service | What it does | What it sees |
|---|---|---|
| Supabase | Stores signups, feedback and product reports (region: [CONFIRM REGION]) | The information you send us |
| Netlify | Hosts the website and app preview | Standard visit data such as IP address and browser type |
| Open Food Facts | Public food database used for product lookups | The barcode you scan and your IP address, because your browser contacts it directly |
| PayFast | Processes support payments | Your payment details and contact details, under PayFast's own privacy policy |
These providers process information for us or, in the case of Open Food Facts, receive a barcode from your browser. Some store data outside South Africa. POPIA allows this where the recipient is bound by rules that protect your information to a similar standard, or where you consent. We may also disclose information if the law requires it.
6. How long we keep it and how we protect it
We keep email signups until you unsubscribe or ask us to delete them. We keep feedback and product reports until you ask us to delete them. Records of support payments are kept for as long as the law requires for tax and accounting. Information stored only in your browser stays there until you clear it or delete the profile.
We protect what we hold with access controls on our database, encrypted connections (https), and a rule that only we can read stored signups and feedback. We never publish the keys that give full access to our database.
If we learn that your information has been accessed without permission, we will tell the Information Regulator and the people affected as soon as reasonably possible, as POPIA requires.
7. Your rights and how to reach us
Under POPIA you can ask us to tell you what information we hold about you and give you a copy, correct information that is wrong, delete your information or stop using it, and stop sending you marketing. Every email will have an unsubscribe link. Write to bioryte.llc@gmail.com and we will respond within a reasonable time, normally 30 days.
Local storage. The app preview saves profiles, history and settings in your browser's local storage so they are there next time. This is not tracking. You can clear it in your browser settings.
Changes. If we change this policy we will update the date at the top and, for important changes, tell signed-up users by email.
Complaints. Please tell us first if you are unhappy. You can also complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@inforegulator.org.za.