Privacy Policy

1. Who we are (Responsible Party)

MDB TechWorks ("we", "us", "our") operates GearHunter at gearhunter.co.za. We are the Responsible Party as defined in POPIA.

Contact: michael@mdbtechworks.com

2. What personal information we collect

Category	Examples	Source
Account data	Email address, password (hashed), subscription plan	Provided by you at signup
Usage data	Pages visited, search queries, products viewed, filter choices	Collected automatically
Preference data	Categories selected, watchlist items, alert settings	Saved when you use the service
Payment data	Billing name, last 4 card digits, billing address	Collected by Stripe on our behalf
Technical data	IP address, browser type, device type	Collected automatically by our servers

We do not collect sensitive personal information (race, health, political views, etc.) as defined under POPIA.

3. Why we collect it (purpose)

• Service delivery: to provide your account, deliver deal alerts, and show personalised price data
• Billing: to process subscription payments via Stripe
• Communications: to send your daily deal digest and service notices
• Improvement: to understand how the service is used and fix issues
• Legal compliance: to meet our obligations under POPIA and other South African law

We process your personal information only for these stated purposes and do not use it for automated decision-making that produces legal or similarly significant effects.

4. Legal basis for processing

Under POPIA, we process your personal information on the following grounds:

• Contract: processing necessary to deliver the subscription service you signed up for
• Consent: for marketing communications (you may withdraw consent at any time)
• Legitimate interest: for fraud prevention, security, and service improvement, balanced against your right to privacy

5. Payment processing (Stripe)

Subscription billing is handled by Stripe, Inc., a third-party payment processor. When you subscribe, your payment card details are transmitted directly to Stripe — we never store full card numbers on our servers. Stripe processes payments under their own Privacy Policy. Stripe is certified to PCI DSS Level 1.

6. Who we share your information with

We do not sell your personal information. We share it only with:

• Stripe — payment processing (see above)
• Supabase — our database and authentication provider (data hosted in EU West region; covered by standard contractual clauses)
• Vercel — our hosting provider (edge infrastructure)
• Resend — transactional email delivery (email address only)
• Legal authorities — if required by South African law or a valid court order

Each operator we use is bound by data processing agreements consistent with POPIA requirements.

7. How long we keep your data (retention)

Data	Retention period
Account and subscription data	Duration of your account + 3 years after closure (for legal and tax purposes)
Price-history and catalogue data	Retained indefinitely for trend analysis; not linked to individual users
Usage logs	90 days, then deleted or anonymised
Payment records	7 years (South African tax law requirement)

You may request earlier deletion — see your rights below.

8. Your rights under POPIA

As a data subject under POPIA you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Deletion — request that your account and personal information be deleted (subject to our legal retention obligations)
• Objection — object to processing based on legitimate interest
• Withdraw consent — opt out of marketing emails at any time via the unsubscribe link or by contacting us
• Lodge a complaint — with the Information Regulator (South Africa) if you believe your rights have been violated: inforegulator.org.za

To exercise any right, email michael@mdbtechworks.com. We will respond within 30 days.

9. Cookies and tracking

GearHunter uses the following limited storage mechanisms:

• localStorage (theme preference): stores your dark/light mode choice — no personal data, no expiry, never transmitted
• Supabase session token: stores your authentication session in localStorage — required to keep you logged in; cleared on sign-out

We do not use third-party advertising cookies, tracking pixels, or cross-site analytics.

10. Security

We apply industry-standard security measures including TLS encryption in transit, hashed password storage (via Supabase Auth), and row-level security on the database. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we work to maintain appropriate safeguards.

11. Children

GearHunter is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the service grows or regulations change. Material changes will be notified by email at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact and complaints