POPIA & GDPR Compliant · Protection of Personal Information

Privacy Policy

Last Updated: October 2026 · Committed to transparency, encryption, and data sovereignty

1. POPIA & Statutory Compliance

Whatshop (operated under Maluti Technology Group) complies with the South African Protection of Personal Information Act No. 4 of 2013 (POPIA), the Electronic Communications and Transactions Act No. 25 of 2002 (ECTA), and the General Data Protection Regulation (GDPR) for international users.

2. Web Storefront Privacy (whatshop-storefront)

When shoppers visit standalone storefronts at https://{slug}.whatshop.site or custom domains:

Zero Tracking Cookies: Storefronts do not use behavioral tracking cookies or advertising data brokers. We only use essential browser LocalStorage to preserve cart contents and variant selections.

1-Click WhatsApp Checkout: When a shopper clicks "Checkout via WhatsApp", their cart items and variants are transferred directly into the secure chat with the merchant's verified WhatsApp business number.
Web Order Checkout: Delivery addresses, names, and phone numbers are dispatched into secure queues (Redis / BullMQ) solely to generate the order and waybill.

3. Zero Credit Card Storage (BYOK Security)

Whatshop NEVER stores, sees, or transmits raw credit card numbers or CVV codes. Payments settle directly through merchant-connected gateways (Paystack, Yoco, Ozow Instant EFT) which maintain level 1 PCI-DSS certified security.

4. Meta Platform & WhatsApp Cloud API Integration

Whatshop connects to WhatsApp Business and Facebook Pages via our registered Meta Developer Application:

Meta App Name: watshop.site

Meta App ID: 3991818844310251

Developer & Privacy Contact: [email protected] · [email protected]

App Domains: watshop.site, whatshop.site, dash.whatshop.site

Data Categories: We receive customer phone numbers (JIDs), WhatsApp profile names, incoming message contents, media attachments, and message delivery receipts strictly to power automated storefront checkout, AI assistance, and team conversation management. We do not sell WhatsApp message data to brokers or share it for advertising purposes.

5. Instant Self-Service User Data Deletion Portal

In accordance with Meta Developer Policies, POPIA Section 5, and GDPR Article 17, any user or merchant can request the immediate suspension and permanent deletion of their account, WhatsApp credentials, and customer logs without requiring password login:

Self-Service Deletion Portal: https://dash.whatshop.site/delete-my-data

Simply enter your registered email address to receive a secure 6-digit confirmation code. Once confirmed, WhatsApp sessions are severed immediately, accounts are suspended, and all stored data is scheduled for permanent erasure within 24–48 hours with an official confirmation tracking code.

Revoking Access via Facebook: You can also remove watshop.site directly from your Facebook account at Facebook Settings > Apps and Websites.

6. Information Officer & Developer Contact Details

For privacy queries, manual data erasure requests, or POPIA Form 1/2 requests:

Information Officer & Meta App Developer — Whatshop
Email: [email protected] · [email protected]
Developer Direct: [email protected]
Johannesburg, Gauteng, Republic of South Africa