Privacy Notice
Shopalytics ("we", "us", "our") is committed to protecting your personal information in accordance with the Botswana Data Protection Act 2018 (DPA) and applicable international standards. This Privacy Notice explains what data we collect, why we collect it, and the rights you have over it.
1. Who We Are
Shopalytics is a consumer shopping intelligence platform that helps shoppers in Botswana and Southern Africa compare catalogue deals, plan grocery baskets, and optimise multi-store trips. We are the data controller for personal information processed through our website and application at shopalytics.co.bw.
Contact the data controller: privacy@shopalytics.co.bw
2. Data We Collect
| Category | What we collect | Why |
|---|---|---|
| Account data | Email address, display name (if you sign up) | Authentication and personalisation |
| Usage data | Pages visited, features used, session duration | Improving the service (with consent) |
| Shopping lists | Items you enter into the Smart Basket planner | Providing the basket optimisation feature |
| Redemption data | Retailer name, product, sale amount (when you submit a redemption) | Calculating affiliate commissions |
| Location (optional) | Approximate area for store distance calculations | Personalising store recommendations (with permission) |
| Device & log data | IP address, browser type, error logs | Security, fraud prevention, and debugging |
3. Legal Basis for Processing (Botswana DPA 2018)
- Consent — analytics tracking, optional personalisation, email digests.
- Contract performance — processing your shopping list, redemption submissions.
- Legitimate interest — fraud prevention, security logging, product improvement.
- Legal obligation — tax, regulatory, and law enforcement requirements.
4. How We Use Your Data
- Providing and improving the Shopalytics platform.
- Sending opt-in Smart Basket weekly digest emails.
- Detecting and preventing fraud and abuse.
- Complying with Botswana law and responding to lawful requests from authorities.
- Aggregating anonymous usage statistics for internal analytics and retailer reporting.
We do not sell your personal data. We do not use your data for automated profiling that produces legal or similarly significant effects without your consent.
5. Data Sharing
We share data only with:
- Supabase Inc. — database and authentication infrastructure (EU data residency available on request).
- Vercel Inc. — hosting and edge network (analytics with IP anonymisation).
- Anthropic / Google / OpenAI — AI extraction of catalogue data (no personal shopper data is sent to AI providers).
- Retailers — aggregated, anonymised basket-intent signals only. No individual shopper data is shared with retailers.
6. Cookies
We use cookies for session management, consent storage, and optional analytics. See our Cookie Policy for full details and opt-out instructions.
7. Data Retention
- Account data: retained while your account is active, then 30 days after deletion.
- Shopping lists: retained until you delete them or your account.
- Redemption records: 7 years (financial records obligation).
- Usage / event logs: 90 days rolling.
- Error logs: 30 days.
8. Your Rights Under the DPA 2018
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data (right to erasure), subject to legal retention obligations.
- Restrict or object to certain processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time without affecting prior lawful processing.
Submit requests to privacy@shopalytics.co.bw. We will respond within 21 days as required by the DPA 2018.
9. Security
We apply row-level security on our database, TLS encryption in transit, and least-privilege access controls for all infrastructure. We conduct regular security reviews and will notify affected users of any data breach within 72 hours of becoming aware.
10. Children
Shopalytics is not directed at children under 13. We do not knowingly collect data from children. Certain categories (liquor promotions) require age verification (18+) before display.
11. Changes to This Notice
We may update this notice as the product evolves. Material changes will be communicated via an in-app banner at least 7 days before they take effect. Continued use after that date constitutes acceptance.
12. Contact and Complaints
Data controller contact: privacy@shopalytics.co.bw
You may also lodge a complaint with the Botswana Information and Data Protection Commission if you believe your rights have been violated.