ShopOS

Privacy

ShopOS is in pilot in Durban. This notice explains what we collect and why, in line with POPIA.

Last updated: 15 October 2026.

Who is responsible

ShopOS is operated by J Live Solutions, 178 Currie Road, Durban, South Africa (the “responsible party” under POPIA).

Information Officer: Rene Tambwe. Privacy requests: info@jlivesolutions.co.za

Promises we make

  • Free while in pilot. No card is required to try the app.
  • Do you sell my data? No.
  • We store only what we need to run your account and comparisons, in line with POPIA.

What we collect

  • Account — email, password hash (never returned to clients), role, and account status. Phone number only if you give it to us; the app does not currently ask for it.
  • Addresses — delivery addresses you save for the pilot.
  • Preferences — shopping priorities you set in the app.
  • Shopping activity — grocery items you search for or add to a basket, and the comparisons we generate for you. Recent searches are stored only on your device.
  • Security log — records of security events (registration, sign-in, sign-out, address and preference changes, account deletion) together with the IP address and device/browser user agent used, so we can detect and investigate misuse. Passwords and tokens are never logged.

Why we may process it

To provide the service you signed up for (POPIA s11(1)(b)): creating your account, remembering your delivery details and shopping preferences, and running the Durban grocery comparison pilot. And for our legitimate interest in keeping the service secure (s11(1)(f)).

Retention

We keep your account, delivery addresses, preferences and basket data while your account is active. If you delete your account, we remove your email, phone number, password, saved addresses and preferences immediately; any copies in backups are overwritten within 35 days. Security log entries (including IP address and user agent) are kept for 12 months from the event and then deleted; if you delete your account, the IP address and user agent in your security log entries are deleted immediately. Server request logs are kept for no more than 30 days. After deletion we keep only a de-identified record that an account was deleted, and de-identified basket statistics that cannot be linked back to you.

Service providers

We use a hosting provider to run our servers. It processes data only on our instructions. We do not use analytics, advertising or crash-reporting services, and we do not sell or share your information for advertising. Google Play processes app install data under its own terms.

Security

All traffic is encrypted with HTTPS. Passwords are stored only as an Argon2id hash. Sign-in tokens are kept in your device’s secure storage.

Children

ShopOS is for adults (18+). We do not knowingly collect information from children; if you believe a child has registered, contact us and we will delete the account.

Your rights under POPIA

You may ask us to: give you a copy of the personal information we hold about you; correct or update it; delete or de-identify it; or stop processing it (you can object to processing that is based on our legitimate interests). We reply within 30 days and may need to confirm your identity first.

You can delete your account yourself in the app (Profile > Delete account) or at https://shopos.ascentapp.co.za/delete-account/. Self-serve export is not finished yet; contact us and we will handle other requests manually within 30 days.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa): https://inforegulator.org.za, POPIAComplaints@inforegulator.org.za, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191.

Pilot

ShopOS is in pilot in Durban. Expect changes. This privacy notice may be updated as the product matures; we will change the date above when it is.