Privacy Policy

Who we are

Shopaholics is operated by Mollo Innovations (Pty) Ltd (registration number 2026/275132/07), trading as Shopaholics ("Shopaholics", "we", "us" or "our"). Our registered address is Regus Business Centre, 1st Floor, Block B, North Park, Black River Park, 2 Fir Street, Observatory, Cape Town, Western Cape, 7925, South Africa.

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") we are the responsible party for the personal information we process about you. This policy explains what personal information we collect, why we collect it, how we protect it, and the rights you have over it. Our Information Officer can be contacted at [email protected] or at the address above.

Personal information we collect

We collect only the information we need to provide the service:

• Account information — your email address when you create an account. If you sign in with Google, we receive only your name and email address from Google.
• Content you create — the shopping lists, recipes, meal plans, expenses and related items you and your household add to the service.
• Anonymous sessions — if you use Shopaholics without an account, your session is identified by a randomly generated session ID with no personal information attached.
• Technical information — limited information needed to operate and secure the service, such as your session and the requests your device makes to our servers.
• Optional uploads — if you use our AI features (recipe import, receipt scanning, voice input), the text, images or audio you submit are processed to produce the result you asked for.
• Location (iOS app, optional) — if you enable store reminders on the iOS app, your location is processed on your device to detect when you are near a pinned store; only the store locations your household pins are stored by us. See "Location — store reminders on the iOS app" below.

We do not collect special personal information (such as health, religious or biometric data) and we do not ask for it.

Location — store reminders on the iOS app

The iOS app has an optional store-reminder feature: it can remind you about your shopping items when you arrive near a store you have pinned. It works only if you allow it — iOS asks for your permission before the app can use your location, and asks separately before reminders can work while the app is closed.

• Your location stays on your device. Your phone itself watches for you entering an area of about 150 metres around your pinned stores. Your position and movements are processed on the device and are not sent to us, stored by us, or shared with anyone. Reminders are triggered and shown by your phone, not by our servers.
• Only the store pins are stored by us. When you or a household member pins a store, that store’s coordinates are saved to your household so that everyone’s reminders can use them. A store pin is the location of a shop your household chose — it is not a record of where you are or have been, and we keep no history of your movements.
• Turning it off. Decline the permission, or revoke it at any time in your device’s settings, and the feature simply stops — the rest of the app is unaffected. Removing a pinned store removes its saved coordinates.

Our lawful basis for this processing under POPIA is your consent, given through the permission prompt. You may withdraw it at any time as described above; withdrawal does not affect processing that already took place. The web version of Shopaholics does not use your location at all.

How we collect it

We collect personal information directly from you when you create an account, sign in, or use the service. Where you choose to sign in with Google, we receive your name and email address from Google with your consent. We do not buy personal information about you from third parties.

Why we use it, and our lawful basis

We process your personal information to provide and maintain the Shopaholics service — to create and secure your account, to store and sync the lists, recipes and plans you share with your household, and to provide the optional features you choose to use. Our lawful basis under POPIA is the performance of our agreement with you (our Terms of Service) and our legitimate interest in keeping the service secure and working reliably.

Providing an email address is necessary to create and use an account — without it you can still use the app anonymously but cannot save data to an account. Supplying any other information is voluntary. We never sell, rent or share your personal information for advertising or marketing, and we do not use your data for profiling.

Who we share it with

We do not sell your information. We share it only with the operators (service providers) that help us run Shopaholics, and only as needed to provide the service. Each is bound by a written agreement to keep your information confidential and secure, to process it only on our instructions, and to notify us of any security compromise:

• Our hosting provider — we self-host our PostgreSQL database and application on servers operated by Hetzner in Germany (European Union).
• Google — for Google sign-in (if you use it), and for the optional AI features, where the content you submit is processed by Google's Gemini service to generate the result.

Within the service, the household members you choose to share a list with can see the content of that shared list. We may also disclose information where we are required to do so by law, or to protect our rights, users or the security of the service.

Transfers outside South Africa

Our database is hosted in Germany (European Union) and our AI features are processed by Google, which may process data outside South Africa. Where we transfer your personal information outside the Republic, we do so in accordance with section 72 of POPIA: the recipients are subject to laws and binding agreements (including the European Union's General Data Protection Regulation and our operators' contractual commitments) that provide an adequate level of protection comparable to POPIA, and the transfer is necessary to perform our agreement with you.

How we keep it safe

We take appropriate, reasonable technical and organisational measures to protect your personal information against loss, damage and unauthorised access or processing, as required by section 19 of POPIA. These include encryption of data in transit (HTTPS/TLS), access controls enforced at the database layer so that only you and your household members can read your lists, signed session tokens stored in a secure, HTTP-only cookie, and restricting staff access to what is necessary. No system can be guaranteed completely secure, but we review and update our safeguards as risks change.

How long we keep it

We keep your personal information only for as long as necessary to provide the service to you. You can delete your account at any time from the account settings page. Deleting your account permanently removes all associated data — households, lists, recipes, meal plans and expenses — within 30 days, except where we are required by law to retain certain records for longer.

Your rights

Under POPIA you have the right to:

• request access to the personal information we hold about you;
• ask us to correct or update information that is inaccurate or incomplete;
• ask us to delete your information, or delete your account yourself at any time;
• object to our processing of your information on reasonable grounds;
• withdraw any consent you have given (this does not affect processing already carried out); and
• complain to the Information Regulator (see below).

To exercise any of these rights, email us at [email protected]. We will respond within a reasonable time.

Children

Shopaholics is intended for adults and is not directed at children under the age of 18. We do not knowingly collect the personal information of a child without the consent of a parent or guardian. If you believe a child has provided us with personal information without such consent, please contact us and we will delete it.

Cookies

We use only the cookies needed to run the service: a single HTTP-only session cookie (shopaholics_session) to keep you logged in, and a cookie that remembers your active household (shopaholics_hh). We do not use tracking cookies, advertising cookies, or third-party analytics. You can clear or block cookies through your browser settings, but the service may not work correctly without the session cookie.

Changes to this policy

We may update this policy from time to time. We will notify you of material changes by posting a notice in the app, and the "last updated" date above will always reflect the current version.

Contact us & complaints

Privacy questions or data requests can be sent to [email protected], or by post to Mollo Innovations (Pty) Ltd at the registered address above. Please contact us first so we can try to resolve any concern.

You also have the right to lodge a complaint with the Information Regulator of South Africa: