Privacy policy

This policy explains how Good Food Studio ZA (Pty) Ltd ("Good Food Studio", "we", "us") collects, uses and protects personal information when you use our website at goodfoodstudio.co.za (the "Website") and the Good Food mobile app (the "App"). We process personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

By using the Website or the App you acknowledge this policy. If you do not agree with it, please do not use them.

1. Who we are

Good Food Studio ZA (Pty) Ltd.

• Email: [email protected]
• Phone: +27 61 845 1760

2. Information we collect

2.1 When you use the Website

Enquiries. When you send an enquiry we collect:

• your name, email address and phone number;
• your company name, if you give one;
• the service, package or menu you are interested in;
• event details such as the date, number of guests and location;
• dietary requirements you tell us about;
• your message;
• the page you sent the enquiry from; and
• your consent to us processing the enquiry.

Technical information. Like most websites, our servers and hosting providers log technical details such as your IP address, browser type, the pages you request and the time of your visit. We use these logs to keep the Website running and secure.

We do not use advertising or analytics trackers on the Website.

2.2 When you use the App

Account information. To create an account we collect your email address. If you sign in with Google or Apple, we receive your name and email address from that provider. If you use Apple's "Hide My Email", we receive a relay address instead of your real one. If you sign in with email, we send you a one-time code to verify your address.

Profile information. During onboarding we ask for your first name, surname, date of birth, gender, height and weight, and whether you prefer metric or imperial units. We use these to set up your profile and to personalise portions and nutrition information.

Content you create. We store what you do in the App so it is there when you come back, including:

• recipes you like and bookmark;
• recipe collections you create;
• meal plans and meal logs, including the calorie and nutrition values of logged meals;
• shopping lists and the items on them; and
• a profile picture, if you add one.

Shared shopping lists. If you share a shopping list, the people you share it with can see the list and its items, and can see that it belongs to you. If someone shares a list with you, they can see the items you add to it.

Camera. If you use the barcode scanner, the App asks for permission to use your camera. The camera is used only to read the barcode on your device. We do not store or upload camera images.

Push notifications. If you allow notifications, we store a push notification token for your device so we can send you notifications. We keep a record of the notifications we send you.

Subscriptions. Subscriptions are sold through the Apple App Store or Google Play. Apple or Google processes your payment; we never see your card details. We use RevenueCat to manage subscriptions, so RevenueCat receives an anonymous app user identifier and your purchase and subscription status.

Technical information. Our servers log technical details such as your IP address, device type, operating system, app version and the time of each request. We use these logs to keep the App running and secure.

We do not use advertising or analytics trackers in the App, and we do not track you across other companies' apps or websites.

2.3 Special personal information

Some information you give us may reveal details about your health (for example height, weight, meal logs, allergies) or your religious beliefs (for example halal or kosher dietary requirements). We only use this information to provide the service you asked for, and we process it with your consent. You can withdraw consent at any time by deleting the information or your account, or by contacting us.

3. How we use your information

We use personal information to:

• create and manage your App account and sign you in;
• provide App features such as recipes, meal planning, meal logging, shopping lists and collections;
• personalise portions, units and nutrition information;
• manage your subscription and check what you have access to;
• send you push notifications you have agreed to receive;
• send you account emails, such as verification codes;
• reply to enquiries, prepare quotes and deliver services you book with us;
• keep the Website and App secure, and prevent fraud, spam and abuse;
• fix problems and improve the Website and App; and
• meet our legal, tax and accounting obligations.

We rely on one or more of these grounds under POPIA: your consent, performing a contract with you or taking steps you asked for before entering one, complying with the law, and our legitimate interests (such as keeping our services secure), where those interests are not outweighed by yours.

We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Marketing

We will only send you direct marketing by email or SMS if you have opted in or are an existing customer, as POPIA allows. Every marketing message will include a way to opt out. Push notifications can be switched off at any time in your device settings.

5. Who we share your information with

We share personal information only with service providers who help us run the Website and App, and only as much as they need. They act on our instructions and must keep your information confidential and secure.

We may also disclose personal information:

• when the law requires it, or to respond to a valid request from a court, regulator or law enforcement;
• to protect the rights, property or safety of Good Food Studio, our users or others; or
• to a buyer or successor if we sell or restructure our business, who must protect it as this policy describes.

6. Transfers outside South Africa

Some of our service providers (including Google, Apple, RevenueCat, Expo, Cloudflare and Edamam) store or process information outside South Africa, mainly in the United States and the European Union. We only transfer personal information where POPIA allows it, for example where the recipient is bound by laws, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is needed to provide the service you asked for.

7. How long we keep your information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

• App account information is kept while your account is active. When you delete your account, we delete or anonymise your personal information within 30 days. Copies in backups are overwritten within a further 90 days.
• Enquiries that do not lead to a booking are kept for up to 2 years, then deleted.
• Booking, invoicing and transaction records are kept for at least 5 years, as South African tax law requires.
• Server logs are kept for up to 90 days, unless we need them longer to investigate a security incident.

8. How we protect your information

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, including:

• encrypting data in transit with HTTPS;
• storing sign-in tokens in your device's secure storage;
• verifying email addresses with one-time codes;
• limiting staff access to people who need it; and
• requiring our service providers to protect your information.

No system is completely secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and ask for a copy of it;
• ask us to correct or update inaccurate, incomplete or out-of-date information;
• ask us to delete information we are no longer allowed to keep;
• object to processing based on our legitimate interests, and to direct marketing;
• withdraw consent you have given, without affecting processing that happened before; and
• complain to the Information Regulator.

You can update most of your profile in the App. To delete your App account, or to exercise any other right, email [email protected] from the email address linked to your account. We may need to verify your identity first, and we will reply within a reasonable time, and in any case within 30 days.

Deleting the App from your device does not delete your account. Cancelling your account does not cancel a subscription; manage subscriptions in your App Store or Google Play account settings.

10. Children

The App and our services are intended for people aged 18 and over. Under POPIA, a child is anyone under 18. We do not knowingly collect personal information from children without the consent of a parent or guardian. If you believe a child has given us personal information without that consent, contact us and we will delete it.

11. Cookies and local storage

The Website uses only cookies and similar technologies that are needed for it to work, including those set by Cloudflare Turnstile to protect our forms. We do not use advertising or analytics cookies.

The App stores sign-in tokens and your settings on your device so you stay signed in. Signing out removes your sign-in tokens.

12. Third-party links and services

The Website and App may link to other websites and services, such as WhatsApp and social media. Their own privacy policies apply when you use them, and we are not responsible for how they handle your information.

13. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make significant changes, we will tell you through the App or by email before they take effect.

14. Contact us and complaints

If you have questions about this policy or how we handle your information, contact us at [email protected] or +27 61 845 1760.