Privacy policy

1. Who is responsible for your data

Pelicart is a WhatsApp assistant that builds Woolworths, Checkers Sixty60 or Pick n Pay grocery carts on your own store account. You review the cart and pay in the store’s own app. Pelicart cannot check out or pay.

The responsible party under POPIA is Pelicart (Pty) Ltd, a private company registered in South Africa under registration number 2026/398011/07.

• Address: 80 Strand Street, Cape Town, Western Cape, 8001, South Africa
• Email: caleb@pelicart.com

The POPIA & PAIA page gives the Information Officer and formal access details.

2. What Pelicart collects

Pelicart collects the information needed to run your account, shop for you, and support the service. The main categories are:

• WhatsApp profile: phone number, display name, and the first name you provide
• Messages: text, images, and replies exchanged with Pelicart, including photos of shopping lists you send
• Voice notes: the audio you send and the text transcript Pelicart makes of it
• Store access: protected linked-store access data. When Pick n Pay requests a one-time code, this includes the encrypted password or South African ID number needed to complete sign-in
• Shopping data: order history, carts, and delivery addresses
• Account data: your account and Pelicart Pro subscription status
• Billing data: billing contact details and subscription status
• Support-chat messages: what you write when you ask to speak to a human
• Website and referral data: website use, referral source, and advertising attribution
• Operational records: service-use, support, security, and error records

Where this data comes from

You supply messages, voice notes, photos, and store-linking data. Your linked retailer supplies shopping data. Messaging, payment, support, and advertising services supply the account and service data related to their roles.

3. Why we use your data

Pelicart uses your data for these purposes:

• Providing the service you asked for: building carts, tracking your orders, sending delivery updates, and answering support questions.
• Running and improving the service: support, service operation, performance checks, and fault resolution. Authorised people can review relevant records for these purposes.
• Billing: managing your Pelicart Pro subscription.
• Security and fraud prevention: protecting accounts, spotting abuse, and keeping your linked store account safe.
• Legal obligations: keeping the records the law requires, such as tax records.
• Marketing: occasional announcements and re-engagement messages. Section 7 below has the details.

4. What is voluntary

What you must provide, and what you can skip:

• Phone number and messages: needed to provide the service at all. Pelicart works over WhatsApp, so without them there is nothing to reply to.
• Linking a store: optional, but Pelicart cannot build carts without it. You can still chat with Pelicart unlinked, and you can disconnect a linked store at any time.
• Legal requirement: no law requires you to give Pelicart your information. You provide it under our agreement. Once you pay for Pelicart Pro, tax law requires us to keep certain billing records.
• Marketing: entirely optional. Opting out never affects your service or your order notifications.

5. AI processing

Pelicart is an artificial intelligence (AI) assistant. It sends the conversation content and files needed for your request to AI service providers outside South Africa.

Pelicart does not make a decision that has a legal effect on you. You review each cart and pay in the store’s app. A person handles account disputes. You can request human support at any time.

6. Chat logs and debugging

Pelicart keeps messages and related service records only while they are needed for support, security, service operation, fault resolution, or a legal duty.

You can ask for deletion by messaging “delete me” on WhatsApp or by emailing the Information Officer at caleb@pelicart.com. Pelicart deletes or de-identifies records when it is no longer authorised to keep them. A legal duty or claim can require limited records to remain.

7. Direct marketing

Service messages include replies, order updates, and delivery information. Marketing messages promote Pelicart or ask you to return to the service.

Every marketing message says who it is from and includes a free way to opt out. You can also ask Pelicart to stop marketing messages at any time. Pelicart records the opt-out. Service messages are unaffected.

We ask for marketing consent at most once. If you decline or opt out, we do not ask again.

8. Who else processes your data

These providers process part of your data so that Pelicart can work. Each entry says what it receives:

• Messaging services: account details, messages, and replies
• AI model providers: conversation content and files needed to answer your request
• Cloud hosting and database providers: account, linked-store, shopping, message, and technical data
• Analytics services: website, referral, service-use, and error data
• Payment services: billing contact details, subscription data, and payment details entered on the provider’s hosted page
• Address and web-content services: a new delivery address, only when you ask Pelicart to add one, and the links and searches you ask Pelicart to look up
• Human-support chat and booking tools: what you write when you ask to speak to a human, and the details you enter when you book a call
• Linked retailers: the carts Pelicart builds and the orders you place on your own account

What Pelicart does not keep

Pelicart does not keep your store password after it signs in on your behalf. When Pick n Pay requests a one-time code, Pelicart temporarily stores your encrypted password or ID number to complete sign-in. Pelicart removes it after successful verification or after 10 minutes. Pelicart never receives your credit card or bank account details. You review and pay for the cart inside the store’s app. The security guide explains the controls that support these limits.

9. Where your data goes (outside South Africa)

Some service providers process personal information outside South Africa, including in the United States and the European Union.

Pelicart transfers personal information only where section 72 of POPIA permits the transfer. This can include binding safeguards or a transfer needed to provide the service you request.

Where local law does not give similar protection, operator terms require confidentiality, security, and controls on further transfer.

10. How long we keep it

How long we keep your data depends on the type:

• Messages and operational records: only while needed for support, security, service operation, fault resolution, or a legal duty. Email the Information Officer at caleb@pelicart.com to request deletion
• Account, orders, and addresses: while your account is active, or longer if needed for a legal duty or claim
• Linked-store access data: while the store remains linked and Pelicart needs the data. A legal duty or claim can require limited records to remain
• Billing records: for the period required by tax, accounting, payment, and legal duties

11. Security and breach notification

Pelicart uses reasonable technical and organisational safeguards. These include encryption, access controls, monitoring, recovery controls, and provider checks. Operators have written security and confidentiality duties where POPIA requires them. The security guide explains these safeguards in more detail.

Pelicart will investigate suspected unauthorised access to personal information. We will notify the Information Regulator and affected users as soon as reasonably possible.

12. Your rights

POPIA gives you rights over your data. Here is each right and the practical way to use it:

• Access: ask what Pelicart holds about you. Confirming that we hold anything is free. Email the Information Officer, or use the formal request procedure on the POPIA & PAIA page. Pelicart does not charge a request fee when you ask for your own information.
• Correction: ask in the chat or email the Information Officer. The formal route is Form 2 of the POPIA Regulations.
• Deletion: message “delete me” on WhatsApp or email the Information Officer. Pelicart removes or de-identifies records it is no longer authorised to keep and cancels an active subscription. Form 2 is the formal route.
• Objection: object to a particular use of your data, using Form 1 of the POPIA Regulations or an email to the Information Officer.
• Complaint: if you are not satisfied with our answer, complain to the Information Regulator using Form 5 of the POPIA Regulations.

Send a rights request to the Information Officer at caleb@pelicart.com. The POPIA & PAIA page holds Pelicart’s access-to-information manual and the full request procedure and forms.

You may complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za · 010 023 5200, or toll-free 0800 017 160 · inforegulator.org.za. Full contact details, including postal and physical addresses and the eServices portal, are on the POPIA & PAIA page.

13. Children

Pelicart is for people aged 18 or older. Carts can contain alcohol, and the store verifies age at checkout and delivery. Pelicart does not knowingly process the personal information of anyone under 18.

14. Changes to this policy

When this policy changes, we update this page and the date at the top. For material changes we also tell you on WhatsApp or on the website. This version is effective from 2026-08-26.