Privacy Policy

This Privacy Policy explains how Home Eats (“Home Eats”, “we”, “us”) collects, uses, shares and protects your personal information when you use the Home Eats apps and website (together, the “Platform”). It is written to align with South Africa's Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

“Home Eats” is a trading name of ADAD, a South African online marketplace that connects people who want home-cooked food (“Eaters”) with independent home cooks (“Cooks”) and independent delivery drivers (“Drivers”). We are the responsible party (in POPIA terms) for the personal information described in this policy.

• Operating name: ADAD (trading as Home Eats)
• General contact: bradmchelem@gmail.com
• Information Officer: bradmchelem@gmail.com

2. What personal information we collect

We only collect what we need to run the marketplace. What we collect depends on your role.

2.1 Eaters (customers)

• Name — your display name, also shown to a Cook on your order and to recipients of a shared cart.
• Email address — for your account, sign-in and order communications.
• Delivery addresses and geolocation — the addresses you save, and the latitude/longitude we resolve for them, so Cooks near you can be shown and Drivers can deliver to the right place.
• Order history — the items you order, amounts, and the Cooks you ordered from.
• Payment information — payments are processed by Peach Payments. Cards are tokenised by the payment provider; we do not store your raw card number. We keep a token and card metadata (e.g. the last four digits and card brand) so you can reorder quickly.

2.2 Cooks

• Name and contact details.
• Kitchen details and geolocation — your kitchen name, menu, and the location we use to match you with nearby Eaters.
• Identity and compliance documents — your ID document and Certificate of Acceptability (food-safety certificate), uploaded to secure storage so we can verify you before you go live. See Special personal information.
• Bank account details — verified through a bank-account verification (BANV) check, so we can pay you.
• Payout records — your earnings ledger and payout history.

2.3 Drivers

• Name and phone number.
• Identity, licence and a liveness selfie — your ID document, driver's licence and a liveness selfie used to confirm you are a real, present person. The liveness selfie is biometric information — a special category. See Special personal information.
• Live GPS location — while you are on an active delivery, so Eaters and Cooks can track the order and so we can dispatch fairly. We collect live location only during deliveries.
• Bank account details and payout records — so we can pay you.

2.4 Everyone

• Account and device data — an account identifier, push-notification tokens (so we can notify you about orders), and basic technical/diagnostic data used to keep the apps working and secure.

3. Special personal information (ID & biometrics)

POPIA treats some information as more sensitive. On Home Eats this includes:

• Identity documents for Cooks and Drivers; and
• the Driver liveness selfie, which is biometric information.

Why we need it: we use these solely to verify that Cooks and Drivers are who they say they are, to protect Eaters and the integrity of the marketplace, and to meet our safety and legal obligations. We do not use your biometric selfie for advertising, profiling, or any purpose other than verification.

Your explicit consent: because this is special personal information, we ask for your explicit, informed consent when you submit these documents during onboarding. You may decline — but we will not be able to verify you, which is a requirement to cook or drive on the Platform. You can withdraw consent by deleting your account (see Your rights).

4. Purposes and lawful basis

We process personal information for the purposes and on the lawful bases set out below (POPIA calls these “justifications”).

5. Who we share information with (operators)

We do not sell your personal information. We share it with the service providers (POPIA “operators”) that make the Platform work, only as needed to provide their service:

• Google / Firebase — authentication, database (Firestore), file storage, cloud functions, push notifications (FCM) and remote configuration.
• Peach Payments — card and EFT payment processing and card tokenisation.
• Google Maps Platform — maps, geocoding and place look-ups for addresses and delivery.
• Email provider (TODO: name the transactional email provider once selected) — for receipts and service emails.

We put operator agreements in place with these providers requiring them to process personal information only on our instructions and to keep it secure, as POPIA requires. We may also disclose information if required by law, or to protect our rights, users or the public.

6. Cross-border processing

Some of our infrastructure is hosted in South Africa (our primary database region is africa-south1). However, some processing — in particular our cloud functions — currently runs in the United States (us-central1), and some of our operators process data on servers outside South Africa. This means your personal information may be transferred and processed across borders.

Where we transfer personal information outside South Africa, we do so in line with POPIA — for example where the recipient is subject to laws or binding agreements that provide an adequate level of protection, or where the transfer is necessary to perform our contract with you. By using the Platform you understand that this cross-border processing takes place.

7. How long we keep information & deletion

We keep personal information only for as long as we need it for the purposes above, and then delete or anonymise it — except where the law requires us to keep it longer.

• Account, profile and documents — kept while your account is active. When you delete your account we erase your profile and uploaded documents (including ID, Certificate of Acceptability, and the Driver liveness selfie).
• Order and financial records — when you delete your account we anonymise your past orders rather than erasing them, because South African tax and company law require financial records (such as those relevant to SARS) to be retained, generally for around five years. Anonymised records no longer identify you.

8. Your rights & how to exercise them

Under POPIA you have the right to:

• Access the personal information we hold about you;
• Correct information that is wrong or out of date;
• Object to certain processing and withdraw consent where processing is based on consent; and
• Delete your personal information (subject to the retention rules above).

Account deletion is available in-app. You can delete your account yourself from the Account screen in each app, and on the web via your Account page (/order/account) or the Cook setup page (/cook/setup). Deleting your account erases your profile and documents and anonymises your order history as described above.

You can also correct most details in-app. For any other request — access, objection, or help with deletion — contact our Information Officer at bradmchelem@gmail.com.

9. How we keep your information safe

We take reasonable technical and organisational measures to protect your personal information, including encryption in transit, access controls and security rules on our database and file storage, tokenisation of card data by our payment provider, and limiting access to sensitive documents to those who need it for verification. No system is perfectly secure, but we work to keep your information protected and will notify you and the Information Regulator of a compromise where the law requires.

10. Cookies & analytics (website and apps)

Our website and apps use a small number of cookies and similar technologies that are necessary to keep you signed in and to keep the service working. We also use analytics and crash-reporting tools (provided by Google/Firebase) to understand how the Platform is used and to fix problems. We use this to improve the service, not to build advertising profiles of you.

11. Children

Home Eats is intended for adults. You must be 18 or older to use the Platform. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact our Information Officer so we can delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in the app or by email. Your continued use of the Platform after an update means you accept the revised policy.

13. Contact & complaints

For any privacy question or request, contact our Information Officer at bradmchelem@gmail.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator:

• The Information Regulator (South Africa)
• Website: inforegulator.org.za
• Email (complaints): complaints.IR@inforegulator.org.za
• Email (POPIA): POPIAComplaints@inforegulator.org.za