This Privacy Policy explains what personal information NapEats ("we", "us", "our") collects from customers, restaurants ("vendors"), and delivery drivers who use our platform, why we collect it, and how it's handled. We operate in South Africa and aim to handle personal information in line with the Protection of Personal Information Act (POPIA).

1. Who this applies to

This policy covers everyone who uses NapEats: customers placing orders, restaurants listing their menus, and drivers making deliveries. Each has a different account type and different information is collected accordingly, as set out below.

2. Information we collect

Customers: name, email address, phone number, delivery address, and (if you choose to share it) your location, used to show nearby restaurants and calculate accurate delivery fees. We also keep a record of your orders, ratings/reviews you submit, and any refund requests you make.

Restaurants (vendors): business name, contact details, physical address and pickup location, menu content and photos, banking details (used to pay you), and order/sales history.

Drivers: name, contact details, banking details (used to pay you), and your real-time location only while you have toggled yourself "available" for deliveries - we do not track your location when you are offline.

Everyone: we keep basic technical information needed to operate the platform securely, such as login timestamps and IP addresses associated with login attempts (used to detect and block abuse of accounts).

We do not collect more than we need to run the service, and we do not sell personal information to third parties.

3. How we use this information

• To create and manage your account, and let you log in securely
• To process and fulfil orders - passing the necessary details between customer, restaurant, and driver so an order can be prepared and delivered
• To calculate delivery fees based on distance, and to offer deliveries to the closest available driver
• To process payments (see Section 5 - Payments, below)
• To send order updates, receipts, and account-related emails (such as password resets)
• To show ratings and reviews, and to investigate refund requests or disputes (which may involve reviewing photos submitted as evidence by a vendor or driver)
• To detect and prevent fraud, abuse, or unauthorised access to accounts
• To generate sales and payout reports for restaurants and drivers

4. Who we share information with

We share only what's necessary for the platform to work:

• Between parties to an order - a restaurant sees the customer's name, phone number, and delivery address for orders placed with them; a driver sees the same for orders assigned to them, plus the restaurant's pickup details.
• PayFast - our payment processor, used to handle online card payments. We do not store your full card details ourselves; PayFast handles that in line with their own security standards.
• Map and location services - we use OpenStreetMap/Nominatim to convert addresses to map coordinates and to display maps. Only the address or coordinates you provide are sent for this purpose.
• We do not share personal information with advertisers, and we do not sell personal information.

5. Payments

Online payments are processed by PayFast, a licensed South African payment gateway. When you pay online, your card details are handled directly by PayFast - we never see or store your full card number. Cash payments (where offered, currently for collection orders only) are handled directly between you and the restaurant/driver.

6. Location data

Location data is only collected with your action: a customer choosing to share their address/location for delivery purposes, or a driver toggling themselves "available." Drivers can stop location sharing at any time by toggling back to unavailable. We use location data to calculate delivery distance/fees and to dispatch the closest available driver - it is not used for any other purpose.

7. Data retention

We keep order records for as long as reasonably necessary for accounting, tax, and dispute-resolution purposes. Account information is kept while your account is active. If you'd like your account or personal information deleted, contact us using the details below and we'll action this in line with our legal obligations (for example, we may need to retain order/financial records for a period as required by South African tax law even after an account is closed).

8. Security

We take reasonable technical measures to protect personal information, including encrypted password storage, secure (HTTPS) connections, and access controls limiting who can see what data. No system is 100% secure, but we work to keep information protected against unauthorised access.

9. Your rights

Under POPIA, you have the right to ask us what personal information we hold about you, to request that inaccurate information be corrected, and to request deletion of your information (subject to our legal obligations to retain certain records). To exercise any of these rights, contact us using the details below.

10. Cookies

We use a session cookie to keep you logged in while you use the site. We do not use third-party advertising or tracking cookies.

11. Children's privacy

NapEats is intended for use by adults. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time as the platform changes. We'll update the "last updated" date at the top when we do.

13. Contact us

If you have questions about this policy or how your information is handled, contact us at info@napeats.co.za or 081 660 4566.