PRIVACY POLICY

What We Collect

• Order information: name, email address, phone number, shipping address, postal code, and any order notes you provide.
• Newsletter subscription: email address and optional first name when you opt in.
• Abandoned cart data: if you begin checkout or enter your contact details before completing a purchase, we temporarily save your name, email address, phone number, cart contents, and chosen delivery method.
• Payment information: processed entirely by Yoco. We never see or store your full card details.
• Analytics data:each page you visit triggers a record of the URL path, referrer URL, your browser’s user-agent string, and an anonymous session identifier. No personally identifiable information is attached to these records.

Why We Collect It

• To process and fulfil your orders and send shipping updates.
• To send order confirmation emails.
• To send newsletters and product drop announcements only if you opted in. You can unsubscribe at any time using the link in every email.
• To send a single abandoned cart recovery email if you provided your email address during checkout and did not complete your order. This is the only marketing communication sent without explicit newsletter opt-in; you may request deletion of your cart data at any time by emailing us.
• To understand how visitors navigate our site so we can improve it (aggregated analytics).
• To detect and prevent fraud, abuse, and security incidents.
• To meet our legal obligations, including tax record-keeping.

How We Protect It

All data is transmitted over HTTPS. Order, customer, and subscriber records are stored on managed PostgreSQL infrastructure (Supabase) with encryption at rest. Access to admin tools is restricted to authorised staff via authenticated, audited sessions. We do not sell or rent your personal information to third parties.

Third-Party Processors

We share the minimum necessary data with the following trusted processors to operate our store:

• Yoco — payment processing. Receives card and transaction data. PCI-DSS compliant. Privacy policy.
• Resend — transactional email delivery. Receives recipient email addresses and email content (order confirmations, shipping updates, newsletters, cart recovery emails). Privacy policy.
• Supabase — database hosting. All customer, order, subscriber, and analytics records are stored on Supabase infrastructure. Privacy policy.

No other third parties receive your personal information. We do not use Google Analytics or any advertising trackers.

Browser Storage & Local Data

We do not use tracking cookies. We use your browser’s localStorage for the following purposes:

• Session identifier (sv_session_id): a randomly generated UUID stored locally to link your page-view analytics and any abandoned cart record to a single anonymous session. It is never linked to your name or email unless you voluntarily provide them during checkout.
• Chatbot history (sv-chat-messages-v3): your conversation with our on-site chatbot is saved in your browser only. It is never sent to our servers and is cleared automatically when you clear your browser data or when we release a new chatbot version.

You can remove all locally stored data at any time via your browser’s settings (“Clear site data” or equivalent).

How Long We Keep It

• Order records: retained for at least 5 years to satisfy tax and consumer-protection obligations.
• Newsletter subscriptions: retained until you unsubscribe.
• Abandoned carts: deleted automatically after 30 days.
• Analytics records: aggregated and anonymised after 12 months; raw records are deleted.
• Chatbot history: stored locally in your browser only — never retained by us.

Your Rights

Under POPIA you have the right to:

• Request a copy of the personal information we hold about you.
• Request that we correct or delete your information.
• Object to your information being used for direct marketing.
• Lodge a complaint with the Information Regulator at inforegulator.org.za.

To exercise any of these rights, email us at contact@saintventura.co.za. We respond within 30 days.

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will notify you and the Information Regulator within 72 hours of becoming aware of the incident, as required by POPIA.

Contact

Information Officer · Saint Ventura
contact@saintventura.co.za