Privacy Policy

1. Who we are

This Privacy Policy describes how CORETRUST TECHNOLOGIES (PTY) LTD (registration number 2025/935641/07), a private company incorporated in the Republic of South Africa on 4 December 2025 ("CoreTrust", "we"), processes personal information when you use the VendorTrust website, mobile applications, and related services (the "Service").

CoreTrust is the responsible party under the Protection of Personal Information Act, 2013 (POPIA) and the data controller under the Zimbabwe Cyber and Data Protection Act [Chapter 12:07] (CDPA) for personal information for which we determine the purpose and means of processing.

The Service is offered for users in South Africa and Zimbabwe. See Legal information. We do not sell personal information.

2. What we collect

Depending on how you use the Service, we may collect:

• Account and profile — name, username, email, password (hashed), business details, tax or registration numbers you supply, profession, location text, address, bio, skills, and profile photo.
• Identity and business documents — government ID, passport, driver's licence, company registration, proof of authority, and selfie images you upload for verification.
• Marketplace and transaction data — listings (including location), bids, cart, orders (including delivery phone and address), escrow agreement details, ledger records, reviews, ratings, and trust scores.
• Shipment location — where a courier or agent shares GPS or status for an order.
• Payment metadata — when Paystack is enabled: transaction references, amounts, status, and checkout email. We do not store full card numbers or CVV. Paystack processes card data (Paystack privacy).
• Communications — in-app messages, support tickets, and reports you file about other users.
• Device and technical data — device type, OS, app version, IP address, log data, crash diagnostics, and push tokens when you enable notifications.
• Sign-in with third parties — Google, Facebook, or Apple, if you use those options: basic profile as permitted by that provider.
• Cookies and similar technologies — Cookie notice.

3. Special personal information

Under POPIA, biometric information (including a selfie used for liveness or face matching) is special personal information. We process it only with your consent when you choose to upload it for verification, or where another POPIA s27 exception applies (for example a legal obligation). We do not rely on "legitimate interests" for biometrics.

Copies of identity documents are ordinary personal information, but we treat them as highly sensitive: limited staff access, processors under contract, not used for marketing, not sold.

4. Mandatory and voluntary information

Mandatory for an account: email, username, password (or OAuth), user type, age confirmation, and acceptance of these policies.

Mandatory for an order or payout: phone and delivery address for fulfilment; identity or business documents we reasonably require for verification or payouts. Without them we may refuse the listing, deal, or payout.

Voluntary: profile photo, bio, optional push notifications, and marketing consent.

5. Why we use it and lawful basis

• provide and secure the Service — contract;
• authenticate users and prevent fraud — legitimate interests and, where required, legal obligation;
• fulfil orders, messaging, and support — contract;
• Paystack payments when enabled — contract;
• identity selfies — consent (POPIA s27);
• comply with lawful requests — legal obligation;
• unsolicited electronic marketing — only with opt-in consent (POPIA s69). Service messages (security, receipts, disputes) are not marketing. You can withdraw marketing consent by emailing info@coretrust.tech.

Under the Zimbabwe CDPA we rely on equivalent grounds: contract, legal obligation, legitimate interest for ordinary data, and consent for sensitive data unless another statutory ground applies.

6. Trust scores and automated processing

Trust scores, listing ranking, and fraud screening may use automated processing, including third-party AI (currently Anthropic) on listing text, messages, reports, or shelf photos you submit on Prices. These outputs are informational for other users and for our risk review. They can affect visibility. Account suspension or ban is subject to human review where practicable. You may ask us to explain a score or flag that affects you by emailing info@coretrust.tech.

7. Device permissions

The mobile app may request camera and photo-library access so you can upload verification documents, profile photos, listing images, and Prices shelf-price photos. Push notifications are optional.

Prices location. Snapping a shelf price always uses one precise location check so we can confirm the shop and suburb and pin that shop. We may also look up nearby grocery places on maps (Google Places when configured, otherwise OpenStreetMap) using that one-shot location to suggest the shop name — you can edit the suggestion before posting. That check is not stored as a location history — we keep the shop pin. Separately, if you turn on “notify me when I am at the shop”, the app may read precise location while Prices is open to tell whether you are already within about 150 metres of a shop pin. We do not ask you to travel somewhere to confirm a price. You can turn confirm prompts off in Prices settings or deny location in your phone settings (snaps will then not post until location is allowed).

8. Sharing and subprocessors

We may share information with:

• Other users — public profile, listings, and messages to a counterparty.
• Processors under contract (countries include the United States and the EU, depending on the vendor):
  • Vercel — hosting and Vercel Analytics;
  • MongoDB Atlas — database;
  • Cloudflare R2 — object storage;
  • Upstash Redis — rate limiting;
  • Expo — push delivery;
  • our email / SMTP provider (for example Zoho);
  • Paystack — card payments when enabled;
  • Sentry — error monitoring and session replay on the website (text masked);
  • Anthropic — fraud and listing/message screening, and reading a Prices shelf photo you submit, when that feature runs;
  • n8n (when configured) — assisted listing import from a URL you submit;
  • Google, Facebook, Apple — only if you use those sign-in options.
• Authorities — when required by law or to protect rights, safety, and security.

9. Cross-border transfers

The processors above may process information outside South Africa and Zimbabwe (including the United States and the EU). For POPIA s72 we rely on: (a) the transfer being necessary to perform the contract with you (hosting, email, payments); (b) contractual clauses with processors; and (c) for optional tools (OAuth, optional AI screening of content you submit), your use of that feature. We do not treat the general account tick as consent for every future transfer. Zimbabwe CDPA transfer rules also apply to Zimbabwe data subjects.

10. Information Officer contact

Privacy requests: info@coretrust.tech. You may also lodge a complaint with the Information Regulator (inforegulator.org.za) or, for Zimbabwe data subjects, POTRAZ (www.potraz.gov.zw).

11. Retention

• Account profile: while the account is open; then deleted or anonymised except as below.
• KYC documents: while needed for verification, fraud prevention, and disputes. We are not a FICA accountable institution by default; we do not keep identity documents for a fixed five-year FICA period unless a legal duty to do so arises. Typical maximum for closed accounts is the longer of 12 months or the life of an open dispute.
• Transaction and ledger records: at least 5 years where tax or company-record rules require it.
• Messages: with the conversation, unless a dispute hold applies.
• Server and security logs: typically up to 12 months.
• Self-service deletion may be delayed 30 days after recent escrow activity and up to 12 months after a closed dispute.

12. Security

We implement reasonable technical and organisational measures (access control, hashing of passwords, HTTPS, HttpOnly session cookies). No method is perfectly secure. Payment card data is handled by Paystack, which is required to meet card-network security standards.

13. Your rights (South Africa — POPIA)

You may request access, correction, deletion, or restriction, and object on reasonable grounds to legitimate-interest processing. For unsolicited electronic marketing you may withdraw consent. Email info@coretrust.tech from your registered address. We may need to verify your identity. We aim to respond within 30 days (PAIA timeframe for access requests; we use the same target for POPIA requests).

Lodge a complaint with the Information Regulator at inforegulator.org.za. PAIA access requests may be sent to the same email; we aim to respond within 30 days.

14. Your rights (Zimbabwe — CDPA)

Zimbabwe data subjects may request access, correction, deletion, and restriction, and object to certain processing, as the CDPA provides. You may complain to POTRAZ (www.potraz.gov.zw).

15. Security incidents

Where a security compromise presents a risk to you, we will notify the Information Regulator as POPIA requires, POTRAZ where the CDPA requires (including any 24-hour notice duty), and affected users where the law requires.

17. Children

The Service is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, email us and we will delete it.

18. Contact

Privacy questions or rights requests: info@coretrust.tech from the address registered on your account.