Privacy Policy

1. Introduction

Herbal Habits (Pty) Ltd ("Herbal Habits", "we", "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website and services, in accordance with the Protection of Personal Information Act, 2013 (POPIA).

Herbal Habits is merely a platform that brings shoppers and independent store owners together. We do not sell any products ourselves.

By using Herbal Habits, you acknowledge that you have read and understood this policy.

2. Who we are (Responsible Party)

Herbal Habits (Pty) Ltd is the "responsible party" for your personal information under POPIA.

• Registration number: 2026/302352/07
• Address: 37 Coral Road, Table View, Cape Town, 7439
• Information Officer: Jean Du Plessis
• Contact: hello (at) herbalhabits.co.za

3. What personal information we collect

Depending on how you use our platform, we may collect:

• Account information: name, email address, password, and account type (shopper, store owner).
• Age verification: confirmation that you are 18 or older.
• Store owner information: business name, registration details, physical address, contact details, and listing content you provide.
• Payment information: processed securely by our payment provider (see section 7). We do not store your full card details.
• Usage information: how you interact with the platform, including pages viewed, searches, and stores saved.
• Activity dates: when you are signed in, we record which days you used the platform (the date only, once per day, not what you did). We use this to understand how active our members are and to help support your account.
• Location information: if you use our "Near Me" search, your device's precise location, used to sort and filter stores by distance. We keep only the municipality it falls in (for example "City of Cape Town"), never the exact point.
• Approximate area: when you visit, our hosting provider tells us roughly where your internet connection is. We turn that into a municipality and province straight away and store only that, never your IP address or coordinates. It can be wrong (mobile networks often route through another city).
• Your area (optional): if you set "Your area" in Account Settings, the municipality of the town you pick. You can change or remove it at any time.
• Searches: what you search for on the platform, whether anything was found, and the area it relates to (the place you searched for, your area, or your approximate area).
• Merch waitlist: if you tap "Notify me" on our Coming Soon banner, we note your account email so we can tell you when Herbal Habits merch launches. You can unsubscribe from any email we send, or ask us to remove you.
• Giveaway claim information: if you win a giveaway and choose delivery, the phone number and delivery address you provide so the store can arrange delivery.
• Calendar activity: events you mark "I'll be there" or "Remind me", so we can send you reminders, and which calendar events you open or click through (for example to a booking page). Store owners only ever see totals, never who.
• App notifications: if you switch them on, the delivery address your browser or phone gives us for that device (it comes from Google, Apple or Mozilla's push service, which delivers the message), the kind of device (iPhone, Android or computer) and the kinds of notifications you chose. We use them only to send those notifications. Switching off, or deleting your account, removes them.
• Blog activity: articles you save, like or finish reading (so your Saved Articles and "Read" ticks work), and correction suggestions you send us. We also count article views, finished reads, shares and clicks, including from visitors who aren't signed in (see the visitor cookie in section 9), and only ever look at those as totals.
• Ambassador Programme: if you apply, what you write in your application and our decision. If you become an ambassador, the friends and stores who join through your link (we show you only anonymous progress and their town, never their name or email), visits to your link (counted by the anonymous visitor cookie, with the approximate area), your points, rewards you claim (and any delivery details you give for them) and your monthly activity. Your first name, the initial of your surname and your town show on the ambassador leaderboards, which only other ambassadors can see; you can hide yourself at any time. If you apply through a store's "Become an ambassador" link, we note that store on your application (a small cookie remembers it for up to 60 days), and that store earns points once you bring in your first paying friend; it never sees who your friends are. If you name a store that knows you when you apply, we ask that store to recommend you: its owner sees your first name and initial, when you joined and how many times you've used a code there, and we keep their answer with your application.
• Store visits and shares: when your codes are scanned at a store, that store sees your first name and surname initial, how often you visited and your points there. When you tap Share on a store page you get your own link; the store sees your first name and initial with how many people opened it (never who they were).
• Courtyard (members-only clubs): if you ask to join a club, the club sees your name (as on your account), your answers to its questions, when you asked and joined, your member pass, each time it checks you in at the door, the level and paid-until date it gives you, and who invited you (if you used a member's bring-a-friend link) or how many people you brought in; it can download this list and keep private notes about you. It never sees your email address: if the club emails its members, we send the email for it, and you can switch these emails off on My Clubs. Poll votes are shown to the club only as totals. If you ask to join a club that chose to be findable, nothing about you is shown on Find a Store. If you apply to run a club, we keep your application (including the contact person, phone number and any registration details you give us) and our vetting notes.
• Members-only club stores: if you ask to join one, the store sees your first name and initial, your answers to its questions, and when you asked and joined. It doesn't see your email address. We email you when the store lets you in.
• Store suggestions: if you suggest a store ("Can't find a store?"), what you tell us about it and that the suggestion came from your account, so our team can contact the store and email you if it joins. Store details you give us are business information about the store.
• Places not on Herbal Habits yet: if you tap "I want this" on a place that hasn't joined, we note that it came from your account, so we can count interest, contact the place and email you if it joins. The place never sees who asked. We list these places from public business information (their name, type and address only) and remove a place when its owner asks us to.
• Referrals: if you join through an ambassador's link, we link your account to that ambassador so they can earn points. They see that a friend joined and, later, whether a payment went through, never who you are. If their link carries a gift (a free period, sometimes followed by a discount), we record which ambassador gave it to you so it shows on your My Membership or Billing page and counts towards their gift totals. We also note it to give you a welcome badge. If you join through a friend's "Invite a friend" link, we note that they invited you (a small cookie remembers their link for up to 30 days); they aren't told and nobody earns anything from it.
• Emails from us: which of our marketing topics you're subscribed to (news, deals and giveaways, events, and for store owners), whether you've unsubscribed, and, for each campaign email we send you, whether it was delivered, opened or bounced and which links you clicked. We use this to stop sending to people who don't want our emails, to honour your choices, and to see which emails are useful. You can change your choices at any time from the link at the bottom of every campaign email or in Account Settings. If you're added to a campaign by email address (for example you signed up at an event), we record how you agreed to hear from us.
• Reviews and content: reviews, ratings, and other content you submit.
• Technical information: IP address, device and browser type, and cookie data (see section 9).

4. How we use your personal information

We process your personal information to:

• Create and manage your account;
• Provide the directory, membership, and store-listing services;
• Process payments and manage subscriptions;
• Verify that users are 18 or older;
• Display reviews and store content;
• Show your review of Herbal Habits itself on our website (first name, initial and your area, or your store's name) only if you ticked the box agreeing to it. You can change or untick it any time on your dashboard;
• Sort and filter stores by distance when you use "Near Me", and show stores and events near "Your area" first if you've set one;
• Show the weather, time of day and season where you are in the illustration on the Home page. We use "Your area" if you've set it, otherwise your approximate area, and only ever send the centre of that municipality (never your location) to our weather provider;
• Produce area statistics (for example, how many people searched for stores in each municipality) for our own planning, and aggregated area statistics for store owners on the Bloom plan (where their visitors and customers are from). These are always totals per area, never linked to your name, and any area with fewer than five people is hidden from store owners;
• Arrange delivery of a prize you've won and chosen to have delivered;
• Keep your loyalty points at each store, and work out your level and badges from your redemptions, reviews and rewards used. This is shown only to you; it doesn't affect what you pay or which deals you see;
• If you have deal emails switched on: send you one weekly "From your stores" email with news from stores you saved or visited in the last 90 days, and, at most once every 90 days per store, an invitation to review a store whose promotion you redeemed. Stores choose what to send but never see your email address or who received it; you can switch these emails off in Account Settings;
• If you choose to answer "How did you hear about Herbal Habits?" when you sign up (optional), use your answer, and any name you give (for example an influencer, friend or store), to understand which channels bring people to the platform. We only report these as totals per channel or name;
• If you're in a household (a membership shared with up to 3 people), the main member sees the name and email address of each person in it and invitations they've sent, and each person sees the main member's name. Nobody in a household sees anyone else's redemptions, points or activity;
• If a friend or family member told you about us and you give their Herbal Habits email (optional), link your account to theirs so we can thank or reward them for bringing you in. We keep only that link, not the email you typed; we never tell you or them whether it matched, and we don't email them about you;
• If our team invites you to Herbal Habits with an offer, use your email address to send you that invitation, note whether you opened and accepted it, and apply and track the offer on your plan (our team sees this for their own planning);
• Communicate with you about your account and transactions;
• Send you reminders and updates about calendar events you've marked Going or Interested;
• Moderate content and enforce our Terms of Service and Content Guidelines;
• Comply with legal obligations;
• Improve and secure our platform.

5. Legal basis for processing

We process your personal information where: you have consented; it is necessary to perform our contract with you; it is required to comply with the law; or it is in our legitimate interests (such as securing and improving our platform), balanced against your rights.

6. When we share your information

We do not sell your personal information. We share it only:

• With our service providers (operators) who process data on our behalf, under written agreements (see section 7);
• With store owners, where you interact with their listing (for example, when you leave a review, your display name and review are shown publicly; or when you win and claim a giveaway prize requiring delivery, your phone number and delivery address are shared with that store so they can fulfil it; or, if you use loyalty points, the store sees your display name on its reward codes and VIP guest list, and totals of points earned and spent at that store);
• If a store invites you to its team (an Employee Account), with that store's owner: your display name, email address, your role, whether you have two-step verification on, and changes you make on the store's behalf, which are shown by name in the store's activity history;
• Where required by law, court order, or to protect our rights;
• In connection with a business transfer (such as a merger or sale).

7. Service providers (Operators)

We use trusted third-party operators to run our platform. Each processes personal information on our behalf under a written operator agreement, as required by POPIA:

• Supabase: database, authentication, and file storage;
• Vercel: website hosting and delivery, including the approximate location of each visit (see section 3);
• xneelo: domain and related hosting services;
• Peach Payments: payment processing (South African provider);
• Paystack: payment processing (part of the Stripe group; your payment details may be processed outside South Africa);
• PayFast: payment processing (South African provider);
• Resend: transactional and notification emails, and our email campaigns (newsletters and announcements), including delivery, open and click reports;
• CARTO and OpenStreetMap: map tiles for our Find a Store map. Your browser loads these directly from CARTO's servers, which then see your IP address.
• Google (Tag Manager, Analytics): site usage analytics, only if you accept analytics cookies (see section 9).
• Microsoft (Clarity): site usage analytics and session behaviour insights, only if you accept analytics cookies (see section 9).

8. Cross-border transfers

Some of our operators process or store information on servers outside South Africa. Where personal information is transferred outside South Africa, we take reasonable steps to ensure it receives a level of protection consistent with POPIA, including through operator agreements and reliance on the transfer conditions in section 72 of POPIA.

9. Cookies

We use two kinds of cookies. Necessary cookies keep you signed in, remember your preferences (such as confirming you are 18 or older), and are always on, because the site does not work correctly without them. Analytics cookies help us understand how the platform is used, and only run if you accept them.

When you first visit, a banner asks you to accept, reject, or customise analytics cookies. Your choice is remembered for up to 12 months, after which we ask again. You can change your choice at any time using the "Cookie Settings" link in the footer of every page.

If you accept analytics cookies, we use Google Tag Manager to manage two analytics tools: Google Analytics (page views, traffic sources, general usage patterns) and Microsoft Clarity (how you move through and interact with pages, to help us find and fix confusing parts of the site). We use them only to understand and improve Herbal Habits, and neither is loaded at all unless you accept.

We also set one first-party cookie of our own with a random ID, used only to count unique visits to store pages, blog articles and ambassador links, and how many people install the Herbal Habits app on their home screen and open it from there (with only whether they were signed in, never who they are). If you open an ambassador's link to a promotion, we also remember which ambassador it was for that promotion for 30 days, so a code you take later can be credited to them; the store and the ambassador see totals and the ambassador's first name and initial, never who you are. It isn't linked to your account or to anything that identifies you, and store owners, ambassadors and our team only ever see totals.

If you open an ambassador's link, we keep that ambassador's link code (nothing else) in a necessary cookie for 30 days, so that if you sign up in that time the ambassador gets the credit and you get any gift on their link. Their link for store owners keeps the code in a second necessary cookie for 30 days (also if you're already signed in), so the store gift page knows whose gift it is.

You can also control or disable cookies through your browser settings, independent of the banner above.

10. How long we keep your information

We keep your personal information for as long as your account is active and as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When no longer needed, we securely delete or de-identify it. When you delete your account (Account Settings), it is hidden and you are signed out straight away, then deleted for good after 30 days; until then you can restore it with the link we email you. After deletion we keep only the dates of the request, not your name or email. Records of payments (amount, date, plan and the last 4 digits of the card) are kept for 5 years as tax law requires, with nothing linking them to you.

11. Your rights under POPIA

You have the right to:

• Be notified about how your information is processed;
• Access the personal information we hold about you;
• Request correction or deletion of your information;
• Object to processing in certain circumstances;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the Information Regulator. To exercise any of these rights, contact our Information Officer at hello (at) herbalhabits.co.za.

12. Security

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and misuse. In the event of a data breach affecting your information, we will notify you and the Information Regulator as required by law.

13. Underage users

Herbal Habits is only for people aged 18 and older. Underage users (anyone under 18) may not create an account or use the platform, and we do not knowingly collect personal information from underage users. If we learn that an account belongs to an underage user, we will close the account and delete their personal information.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here and update the "last updated" date. Significant changes will be communicated to you.

15. Contact & complaints

For any privacy questions or to exercise your rights, contact our Information Officer:

• Email: hello (at) herbalhabits.co.za

You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: POPIAComplaints (at) inforegulator.org.za