Privacy notice

This notice explains what personal information Wins ("we") processes and why, as required by the Protection of Personal Information Act (POPIA).

What we collect

• Your account: your name, and your email address if you sign in with Google. We never store passwords.
• Waiting list: the store name you entered, when you joined, and a phone number if you chose to leave one, used only to tell you you're in.
• Passkeys: only the public part of the key. The private key stays on your device.
• Your store: its name, settings, menu, recipes, ingredient prices and your Yoco API key (encrypted).
• Sales read from your Yoco account: what sold, how many, totals and the day. No card or customer details.
• Documents you upload (slip and invoice photos, PDFs, bank statements) and what is read from them: suppliers, lines, amounts and bank transactions.
• Billing: which plan you paid for and when. Card details are handled by PayFast and never reach us; we keep only PayFast's reference to your subscription, encrypted.
• Technical data: IP address for rate limiting, kept for no more than a day.

Why we use it

• To run the service you signed up for: working out your costs, margins and profit, and reading the documents you upload.
• To bill you and to work out your plan from your daily order count.
• To keep the service secure and stop abuse.

We don't sell your information, and your documents are never used to train AI models. If we advertise on Google, the public pages and sign-up load Google's ad tag so we can tell whether an ad led to a new store. We send it no names, emails or business data, only that a sign-up or payment happened.

Signing in with Google

If you choose Google, we ask Google only for your basic profile: your name, your email address and Google's account id for you. We use them only to sign you in and to show which account you're using. We don't read your Gmail, contacts, files or anything else in your Google account, and we never share this information or use it for advertising. Our use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements. To remove it, delete your account in Settings, or remove Wins from your Google account's third-party connections.

Other people's information in your documents

Slips, invoices and bank statements can contain other people's details (a supplier's contact, a name on a payment). For those you are the responsible party and we process them on your behalf, only to run the service for you.

Who else handles it

• Cloudflare, which hosts the app, database and uploaded files, and runs most of the automated reading (servers may be outside South Africa).
• Anthropic, which reads the occasional document or recipe the first step can't, when enabled. It doesn't train its models on what it's sent.
• Yoco, which we read your sales and menu from.
• PayFast, which processes subscription payments and stores your card.
• GitHub, which keeps private nightly backups of the database for 30 days so the service can be restored after an outage.
• Google, if you choose to sign in with Google, and to measure our Google ads (see above).

How long we keep it

Daily sales are deleted after about 13 months; when you link Yoco we copy up to that much history once. Documents, recipes and your account and store data stay until you delete them in Settings. Backups roll off after 30 days, so deleted data is gone from them within a month. Payment records are kept as long as tax law requires.

Your rights

You can download all your store's data or delete your store and account at any time in Settings. You can also ask us to correct or delete information, or object to how we use it, by emailing [email protected]. Our information officer can be reached at the same address. You may complain to the Information Regulator (inforegulator.org.za).