Privacy Policy

1. Who we are

Pantri is a digital grocery marketplace and food-wallet that lets households buy essentials, bank them in a digital pantry, and redeem them at partner stores. We are the responsible party (data controller) for the personal information described here. Our Information Officer can be reached at privacy@pantri.africa.

2. Information we collect

We collect the following categories of personal information:

• Identity & contact — name, email address, phone number, and the password you set (stored only as a salted hash).
• Verification — one-time PINs (OTP) sent to verify your email and sensitive actions.
• Merchant KYC — for retail partners only: business registration, director identification and proof of bank account, for vetting.
• Financial & payment — wallet balance and transaction history. Card payments are processed by our payment provider (Paystack); we do not receive or store your full card number, CVV or PIN.
• Transactional — pantries, banked items, carts, orders, redemptions (and redemption PINs), subscriptions, donations, favourites and wishlists.
• Location — approximate location you choose to share to find nearby stores (optional; you can decline).
• Usage & behavioural analytics — interactions such as product impressions, views, clicks, add-to-cart, wishlist actions and purchase events, used to understand and improve the service (see §5).
• AI assistant — the messages you send the in-app assistant and the actions it performs on your behalf (see §6).
• Device & technical — IP address, device/browser type and log data, for security, fraud prevention and diagnostics.

3. Why we process it & lawful basis

We process personal information to: create and manage your account and pantries; process payments, subscriptions, redemptions and donations; provide the AI assistant and personalise recommendations; send service messages, OTPs, receipts and notifications; keep the platform secure and prevent fraud; and comply with legal obligations. Our lawful bases under POPIA include performance of our contract with you, your consent (e.g. location, optional marketing), our legitimate interests (security, analytics and service improvement), and compliance with law.

4. Cookies & similar technologies

We use strictly-necessary cookies and local storage to keep you signed in and remember your cart and preferences, and limited analytics to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect core functionality.

5. Analytics & profiling

We record product analytics and build a per-product “journey” (for example, how often you have viewed an item) to power features like “you’ve viewed this a few times”, wishlists and better recommendations. This profiling is used to improve your experience and our merchants’ insights; it does not produce legal or similarly significant automated decisions about you. Merchant-facing reports are aggregated and do not expose your identity to retailers beyond what is needed to fulfil an order or redemption.

6. The AI assistant

When you use the Pantri AI assistant, your messages are processed by a third-party large-language-model provider (DeepSeek) solely to generate responses and perform the grocery actions you request (such as searching products or filling your cart). We do not send more personal information than necessary to fulfil your request, and we do not use your conversations to train third-party models.

7. Who we share information with

We share personal information only as needed to operate Pantri:

• Retail partners — limited details needed to fulfil a redemption or order.
• Payment provider — Paystack, to process and verify payments (PCI-DSS compliant).
• Service providers (operators) — hosting, email/SMTP, mapping/address lookup (Google), and the AI provider, each under contractual confidentiality and security obligations.
• Authorities — where required by law, regulation or valid legal process.
• We do not sell your personal information.

8. International transfers

Some of our service providers may process data outside South Africa. Where this happens, we take reasonable steps to ensure your information receives a level of protection consistent with POPIA, including appropriate contractual safeguards.

9. How long we keep it

We keep personal information for as long as your account is active and as needed to provide the service. When you delete your account we delete or de-identify your personal information, except records we are legally required to retain (for example, financial and tax records), which we keep only for the period required by law and then delete.

10. How we protect it

We use HTTPS/TLS encryption in transit, encryption of sensitive personal information at rest, hashed passwords, short-lived authentication tokens, OTP verification, role-based access controls, rate limiting and monitoring. See our Security page for more.

11. Your rights

Subject to applicable law, you have the right to:

• access the personal information we hold about you;
• correct or update inaccurate or incomplete information;
• delete your account and associated data — instantly from Account → Profile → Delete account, or by request at pantri.africa/delete-account;
• object to or restrict certain processing, and withdraw consent (e.g. location or marketing) at any time;
• lodge a complaint with the Information Regulator (South Africa) if you believe we have not handled your information lawfully.

12. Marketing & communications

We send transactional messages (OTPs, receipts, order and redemption notices) as part of the service. Any optional marketing is sent only with your consent, and you can opt out at any time using the unsubscribe link or by contacting us.

13. Children

Pantri is intended for users aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated in-app or by email, and the “last updated” date above will reflect the latest version.

15. Contact us

For any privacy question, to exercise your rights, or to reach our Information Officer, email privacy@pantri.africa. See also our Terms of Service and Security pages.