Privacy Policy

This policy explains how K2025921632 (South Africa), registration number K2025921632, trading as NoshUp (“NoshUp”, “we”, “us”) collects, uses, and protects personal information, in line with South Africa’s Protection of Personal Information Act, 2013 (POPIA). We are the responsible party for the personal information described here.

1. What we collect

1.1 Diners

Ordering through NoshUp is guest checkout — we don’t create an account or collect your name, phone number, or address. We collect:

• Order data — the items, options, and table you ordered to, so the order can be delivered and, if needed, you can view your own receipt afterward.
• Email address — only if you choose to enter one, to send a copy of your receipt. Entirely optional.
• Payment confirmation — whether your payment succeeded and a reference for it. Your card or bank details themselves are never seen or stored by NoshUp; they’re entered directly on PayFast’s own payment page and handled entirely by PayFast.
• Basic technical data — standard information like IP address and device/browser type, collected automatically for security and fraud prevention.

1.2 Restaurant owners and staff

For anyone with a restaurant admin login, we collect:

• Name, email address, and login credentials
• Business details (restaurant name, menu content, table configuration)
• Banking details, where required to pay out your share of orders

2. Why we process it, and on what basis

We process personal information because it’s necessary to perform the contract you’re entering into by placing an order or running a restaurant on NoshUp — taking and routing an order, processing payment, and paying restaurants out. Where processing isn’t strictly necessary for that (an optional receipt email, for example), we rely on your consent, given by the act of providing that information.

3. Who we share it with

• The restaurant you order from — your order details are shared with that specific restaurant so they can fulfil it. They don’t receive orders or data from any other restaurant.
• PayFast, our payment processor, to process payment. PayFast has its own privacy practices governing the payment details you enter on their page.
• Our infrastructure providers — Supabase (database and authentication) and Vercel (hosting) — who process data on our behalf to run the service, under their own data processing terms.

We don’t sell personal information to anyone.

4. Where your data is stored

Our infrastructure providers may store and process data outside South Africa (our current database infrastructure is hosted in the European Union). Where personal information is transferred outside South Africa, we take reasonable steps to ensure it remains protected to a standard consistent with POPIA, including relying on providers with their own recognised data protection commitments.

5. How long we keep it

Order records are kept for as long as reasonably necessary for accounting, tax, and dispute-resolution purposes. An optional receipt email is kept only against the specific order it was provided for. Restaurant staff account data is kept for the duration of the account plus a reasonable period after closure, for legal and accounting reasons.

6. Security

Data is encrypted in transit (HTTPS/TLS). Restaurant data is isolated at the database level using row-level security, so one restaurant’s data is never accessible to another. We never store payment card details on our own systems — that scope stays entirely with PayFast.

7. Your rights under POPIA

You have the right to:

• Ask what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete information we don’t have a lawful reason to keep
• Object to processing carried out on the basis of legitimate interest
• Complain to South Africa’s Information Regulator if you believe we’ve handled your information unlawfully

To exercise any of these, contact our Information Officer at privacy@noshup.co.za.

8. Children

NoshUp isn’t directed at children, and we don’t knowingly collect personal information from children without the consent required under POPIA.

9. Changes to this policy

We may update this policy from time to time. We’ll post the updated version here with a new “last updated” date.

10. Contact us

Information Officer: Ian Stevens
Email: privacy@noshup.co.za