Privacy Policy

Last updated: 8 November 2026

Scribbl ("we," "us," "our") is operated by [Your Company (Pty) Ltd], registered in South Africa under [Reg No. 2024/XXXXXX/07]. This policy explains what personal information we collect when you use the Scribbl website and app, why we collect it, and what rights you have over it.

We've written this in plain English wherever possible. If anything is unclear, email us at privacy@scribbl.co.za.

The short version: We collect only what we need to run the shop and deliver your order. We never sell your data. We never store your card details — Paystack handles that. You can ask us to delete your account and everything associated with it at any time.

1. Information we collect

1.1 Information you give us

Account details: name, email address, phone number, password (stored hashed).
Children's details (optional): first name, school, and grade — used only to show the correct stationery list.
Order details: items ordered, delivery address, order history.
Saved lists: any school stationery list you save for reordering.
Communications: messages you send us via email or the contact form.

1.2 Information we collect automatically

Device and browser info: operating system, browser type, screen size.
Usage data: pages visited, features used, time spent — used to improve the product.
IP address: used for security, fraud prevention, and approximate location (city-level).
Cookies: a session cookie keeps you logged in. We use no third-party advertising cookies.

1.3 Information from third parties

Paystack: payment confirmation and transaction ID. We never receive your card number or CVV.

2. How we use your information

To fulfil orders: process payment, pick stock, arrange delivery, and send order updates.
To show your school's list: match your child's grade to the correct school stationery list.
To run your account: authenticate you, save your preferences, remember your cart.
To improve the service: understand what's working, fix bugs, plan features.
To comply with law: tax records, consumer protection, fraud prevention.
To contact you: order updates, delivery notifications, and (only if you opt in) occasional product news.

3. Legal basis (POPIA & GDPR)

We process your personal information on these legal grounds:

Contract: to fulfil an order you've placed.
Legitimate interest: to secure the service, prevent fraud, and improve the product.
Consent: for marketing emails (you can withdraw anytime).
Legal obligation: to keep tax and transaction records.

4. Who we share with

Paystack (payment processing) — card data goes directly to them, never to us.
Delivery partners — name, address, and phone number, for delivery only.
Hosting and infrastructure providers — our VPS host and CDN store data on our behalf under data-processing agreements.
Analytics providers — if enabled, they receive anonymized usage data only.
Law enforcement — only when legally compelled, and only the specific information requested.

We never sell your personal information.

5. How long we keep it

Account data: until you delete your account, then 30 days for backup rollback.
Order records: 5 years (required by South African tax law).
Marketing consent: until you unsubscribe, plus 12 months as proof of consent.
Server logs: 90 days.

6. Your rights

Under POPIA and (where applicable) GDPR, you have the right to:

Access the personal information we hold about you.
Correct anything inaccurate.
Delete your account and data (via our deletion page).
Object to processing based on legitimate interest.
Withdraw consent for marketing at any time.
Complain to the Information Regulator (South Africa): inforegulator.org.za.

To exercise any of these, email privacy@scribbl.co.za. We respond within 30 days.

7. Security

We use HTTPS everywhere. Passwords are hashed. Payment processing is PCI-DSS certified via Paystack. We run regular backups, keep software patched, and restrict admin access to staff who need it. No system is perfectly secure — if you suspect unauthorized access to your account, email us immediately at security@scribbl.co.za.

8. Children

Scribbl is not directed at children under 13. We collect children's names and grades only when a parent or guardian provides them, and only to show the correct stationery list. If you believe a child has created an account without consent, contact us and we'll delete it.

9. International transfers

Our servers are located in South Africa. Some service providers (e.g., Paystack for certain card networks) may process data outside South Africa. We ensure transfers comply with POPIA Section 72 requirements.

10. Changes

If we make material changes to this policy, we'll notify you by email and update the "Last updated" date at the top. Continued use after changes means you accept the updated policy.

11. Contact

Information Officer: [Your Name]
Email: privacy@scribbl.co.za
Postal: [Your Registered Address]