Legal
Privacy Policy
Version 1.0 · Effective date: 3 October 2026 · Last updated: 3 October 2026
1.About this policy
This policy explains how Puddle ("we", "us") processes personal information when you use puddle.co.za, the Puddle admin dashboard, the Puddle Storefront API, or shop on a store powered by Puddle. It is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA").
Puddle is a platform used by independent merchants ("Merchants") to run online stores. Because different organisations are responsible for different information, please read section 2 carefully.
2.Who is responsible for your information?
Under POPIA, the responsible party decides why and how personal information is processed, and an operator processes it on the responsible party's behalf under a written contract.
| Information | Responsible party | Puddle's role |
|---|---|---|
| Customer data | The Merchant whose store you shop at | Operator – we process it on the Merchant's instructions |
| Merchant and Admin User data | Puddle | Responsible party |
| Platform security, fraud-prevention, error monitoring and service-improvement data | Puddle | Responsible party |
| Puddle's own marketing and enquiries | Puddle | Responsible party |
| Aggregated or de-identified analytics | Puddle | Responsible party (not personal information) |
3.Information we collect
3.1 Customer (shopper) information
Processed by Puddle as operator for the Merchant.
- Identity and contact: first and last name, email address, phone number, and whether your email is verified.
- Addresses: delivery and billing addresses (street, suburb, city, postal code, province, country), recipient name and phone number, and delivery instructions.
- Orders: items bought, amounts and currency, promotion codes used, gift cards applied, delivery method and courier tracking details, refunds, and order status.
- Payment metadata: payment provider, payment status and captured amount. We do not store your full card details; these are handled by Paystack on their PCI-DSS compliant infrastructure.
- Gift cards: recipient's name and email, sender's name and personal message (if you send or receive a gift card), gift card balance and expiry.
- Wishlist items linked to your account.
- Cart and browsing activity: items in your cart and cart activity timestamps used for abandoned-cart reminders. This includes activity from guests, linked to a randomly generated guest identifier.
- Marketing preferences: whether you agreed to marketing emails, when, and whether you have unsubscribed.
- Sign-in and session data: one-time code hashes (temporary, expire after 10 minutes), session identifiers stored in secure cookies and in our session cache, sign-in timestamps, and technical data such as IP address and browser type (for security).
- Account status: if the Merchant suspends or bans an account, the status and the recorded reason.
3.2 Marketing and behavioural information
- Email engagement: when marketing or automated emails are sent, we record delivery and bounce events and, through tracking pixels and links powered by Umami (self-hosted at metrics.puddle.co.za), whether you opened an email or clicked a link, and the time and approximate device information.
- Campaign tracking: UTM parameters on marketing links (such as campaign and content identifiers) so Merchants can see which campaigns work.
- Website traffic analytics: page views, referrers, approximate location (province/city level), and device, browser and operating system types, shown to Merchants in aggregated dashboard charts.
- Abandoned-cart events: timestamps and cart contents used to send reminders where you have consented or where the law allows.
3.3 Merchant and Admin User information
Puddle is the responsible party.
- Name, email address, role and store membership; store invitation records.
- Authentication credentials: passkey public keys (we never receive your biometric data or private key), API key identifiers (secrets are stored hashed), and OAuth tokens if you connect third-party accounts.
- Business details: company name, registration and VAT numbers, address, bank/settlement details held by our payment provider and verification documents.
- Billing and subscription records, support communications and usage of AI features (queries and metadata).
- Technical and security logs (IP address, user agent, timestamps, audit trails).
3.4 Information about other people
If you give us someone else's information (for example, a gift card recipient or a delivery recipient), you confirm you are allowed to do so and that they know or would reasonably expect this use.
3.5 Children
Puddle and Merchants' stores are not directed at children under 18. We do not knowingly process the personal information of children unless a parent or guardian consents or the law allows. If you believe a child has given us information, contact us.
3.6 Special personal information
We do not intentionally collect special personal information (such as health, religion or biometric data). Please do not include it in free-text fields (such as delivery instructions or gift messages).
4.Why we process information and our legal grounds
| Purpose | Examples | POPIA ground |
|---|---|---|
| Fulfilling orders and contracts | Creating your account, processing payments, sending order confirmations and receipts, arranging delivery, tracking, returns and refunds | Necessary to carry out a contract with you (s11(1)(b)) |
| Legal obligations | Tax, accounting and record-keeping, responding to lawful requests | Obligation imposed by law (s11(1)(c)) |
| Direct marketing | Marketing emails about products and offers | Your consent (s69); you can withdraw at any time. For existing customers, a Merchant may also market its own similar products where you were given the chance to opt out |
| Security and fraud prevention | Rate limiting, detecting abuse, investigating suspicious activity, banning fraudulent accounts, error and performance monitoring (Sentry) | Legitimate interests of the responsible party and others (s11(1)(d)–(f)) |
| Analytics and service improvement | Traffic charts, device statistics, email engagement, aggregated usage metrics | Legitimate interests; consent where required by law |
| AI-assisted analytics for Merchants | Answering a Merchant's analytics questions about its store | Legitimate interests of the Merchant and Puddle; performance of the service for the Merchant |
| Operating our platform for Merchants | Admin sign-in, billing, support | Contract with the Merchant; legitimate interests |
We process only the information that is adequate, relevant and not excessive for these purposes.
5.Who we share information with
We share personal information only as needed, under written agreements requiring appropriate protection. Our current providers are:
| Provider | Purpose | Information involved | Location |
|---|---|---|---|
| Paystack | Payment processing, refunds, fraud screening (PCI-DSS compliant) | Name, email, amount, order reference, payment details entered on Paystack's secure page | South Africa / Nigeria |
| Shiplogic (Internet Express and The Courier Guy) | Rate quotes, shipment creation, labels, tracking, pickup points | Recipient name, address, phone number, email, parcel details | South Africa |
| Bob Go | Rate quotes, shipment creation, tracking, pickup points/lockers | Recipient name, address, phone number, email, parcel details | South Africa |
| Puddle Notifications Gateway (notifications.puddle.co.za) via AWS SES | Sending transactional emails (OTP codes, receipts, shipping updates) and marketing emails | Email address, name, email content, delivery/bounce events | AWS eu-west-1 (Ireland) |
| Cloudflare R2 | Storage of images, uploaded assets and encrypted backups | Merchant-uploaded images and files | Global network; storage region selected per bucket |
| Umami Analytics (self-hosted) | Website analytics and email open/click tracking | Pseudonymous identifiers, page views, device info, IP-derived approximate location (not stored in full), email tracking identifiers | South Africa (metrics.puddle.co.za) |
| Sentry | Error and performance monitoring | Error reports that may incidentally include user identifiers (such as account ID or IP address) and request details | EU (Frankfurt, Germany – ingest.de.sentry.io) |
| Redis (session cache) | Sessions, rate limits, cart state | Session identifiers, cart state, rate-limit counters (temporary) | Same hosting region as the application |
| Application and database hosting (PostgreSQL) | Hosting the platform and database | All platform data | South Africa |
| OpenAI | Powering AI analytics for Merchants (GPT-5.4 model family) | The Merchant's prompt and selected store data, which can include order and customer details | United States (OpenAI API – data not used for training under our agreement) |
We may also share information with:
- Merchants (their own customers' information and platform-level analytics for their store).
- Professional advisers, auditors, insurers and law enforcement or regulators where required by law or to protect rights.
- A buyer or successor in a merger, acquisition or restructuring, subject to continued protection of your information.
6.Cross-border transfers (POPIA section 72)
Some providers (such as AWS SES, Sentry, OpenAI and Cloudflare) store or process information outside South Africa. We transfer personal information across borders only where:
- The recipient is subject to law, binding corporate rules or a binding agreement providing adequate protection substantially similar to POPIA; or
- You consent; or
- The transfer is necessary to perform a contract with you or for your benefit; or
- Another ground in section 72 applies.
Where necessary, we use data processing agreements and, where possible, choose regions with stronger legal protection. Contact our Information Officer at [email protected] for details of the safeguards for a particular transfer.
7.Cookies and similar technologies
| Category | Examples | Purpose | Duration | Consent |
|---|---|---|---|---|
| Strictly necessary | HttpOnly session cookie for customer and admin sign-in; CSRF and security cookies; cart/guest identifier | Keep you signed in, protect against abuse, remember your cart | Session, or up to 30 days | Not required; essential to provide the service you request |
| Analytics | Umami (self-hosted, cookieless configuration) | Understand traffic and email campaign performance | No persistent cookie set – Umami is configured in cookieless mode | Not required (cookieless and pseudonymous) |
| Marketing / advertising | None set by Puddle | – | – | – |
- Email tracking pixels are tiny images in emails that tell us when an email is opened. You can prevent this by blocking remote images in your email client. You can stop all marketing emails by unsubscribing.
- Merchants who add their own tools (such as ad pixels) to their storefronts must disclose them and obtain consent where required. Puddle is not responsible for those tools.
- You can control cookies in your browser settings, but disabling strictly necessary cookies will prevent sign-in.
8.How long we keep information
We keep personal information only as long as necessary for the purpose it was collected or as required by law (POPIA section 14).
| Data | Retention |
|---|---|
| Customer accounts | Until you or the Merchant delete the account. Deleted accounts are first soft-deleted (hidden and unusable) and then permanently removed or anonymised within 90 days. |
| Order records | Orders retain identifying details (name, email, addresses) even after account deletion because tax, accounting and consumer-law obligations require retention. Kept for 5–7 years from the end of the financial year (Tax Administration Act; Companies Act), then deleted or anonymised. |
| Payment records and refunds | As for order records. Full card data is never stored by us. |
| One-time sign-in codes | Stored only as hashes; expire after 10 minutes and are deleted or marked used on consumption. |
| Session tokens | Expire after 30 days (or earlier on sign-out). Cache entries expire automatically via TTL aligned to session length. |
| Cart and abandoned-cart records | Guest and cart records kept for up to 90 days after last activity, then deleted. |
| Marketing consent and unsubscribe records | Kept for as long as needed to prove consent and honour opt-outs, generally while the Merchant's store is active and for 3 years afterwards. |
| Email delivery logs and tracking events | 12–24 months, then deleted or aggregated. |
| Website analytics | Raw event data 12–24 months; aggregated, non-identifying statistics may be kept longer. |
| Error monitoring (Sentry) | 30–90 days per Sentry retention settings. |
| AI usage logs | 12 months for billing, abuse and quality purposes. Data sent to OpenAI is not retained by them for training under our agreement. |
| Merchant/Admin accounts | While the account is active and for up to 90 days after termination, then deleted, except billing and tax records (5–7 years). |
| Backups | Encrypted backups are overwritten in the normal backup cycle (up to 30–35 days). |
| Legal holds | Longer where needed for a dispute, investigation or legal claim. |
9.Security
We take reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing (POPIA section 19). These include:
- Encrypted connections (HTTPS) and security headers and cross-origin controls on our APIs.
- Rate limiting on sign-in and checkout endpoints.
- Passwordless sign-in with one-time codes stored only as hashes, and support for phishing-resistant passkeys for Admin Users.
- Logical separation of each Merchant's data, with row-level security controls that restrict access to a store's own data.
- HttpOnly secure session cookies and limited-lifetime sessions (30 days).
- Access controls, least-privilege access for our team, and monitoring of errors and suspicious activity via Sentry.
- Encrypted off-server backups.
10.Marketing communications
- We (or Merchants using Puddle) send marketing emails only where you have opted in or POPIA allows. Opt-in is recorded when you tick a consent box or subscribe.
- You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, which takes you to a page that updates your preference immediately, or by contacting the Merchant or us.
- We will still send transactional messages (such as one-time codes, order confirmations, delivery updates and important account notices).
- Merchants are responsible for the content and lawfulness of marketing sent from their stores.
11.Your rights under POPIA
You have the right to:
Be informed
That we are processing your information (this policy) and to ask whether we hold information about you.
Access
Your personal information and ask who has had access to it (section 23).
Correct or delete
Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to retain (section 24).
Object
To processing (section 11(3)) on reasonable grounds, and object to direct marketing at any time.
Withdraw consent
At any time without affecting past lawful processing.
Not be subject to automated decisions
That have legal or substantially affecting consequences (section 71). We do not make such decisions. Accounts are suspended or banned by humans (Merchants) based on stated criteria.
Complain
To the Information Regulator (see section 12) and institute civil proceedings if you believe your rights have been infringed.
Deletion and retention. If you ask us to delete your information, we will delete or anonymise it unless we must keep it, for example transaction records required by tax, accounting or consumer law, records needed to establish, exercise or defend legal claims, or fraud-prevention records.
12.Information Officer and Information Regulator
Information Regulator (South Africa)
inforegulator.org.za[email protected][email protected]JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
We encourage you to contact us first so we can try to resolve your concern.
13.Links to other sites and merchant storefronts
Merchants' storefronts and third-party sites (such as Paystack's payment page and courier tracking pages) are governed by their own privacy notices. Puddle is not responsible for them.
14.Changes to this policy
We may update this policy from time to time. The "last updated" date above shows the latest version. If changes are material, we will notify Merchants (and, where appropriate, Customers) by email or notice on our website before they take effect.
15.Contact
Questions about your privacy?
We're happy to help. Reach out and we'll get back to you as soon as possible.