Privacy policy

1. Who we are

nowww is a South African service. This policy covers our website at nowww.co.za, Noah, our WhatsApp integration, and customer, merchant and General (driver or delivery partner) services. For questions or privacy requests, email support@nowww.co.za.

Other businesses, including merchants, payment providers and WhatsApp, also process information under their own privacy policies. This policy explains our handling of information, including information received through those services.

2. Information we collect

• Account and contact details: your name, email address, phone number, account identifiers, role, saved addresses and sign-in information. Authentication providers manage passwords and sign-in credentials.
• Orders and services: requests, selected products, bookings, delivery or collection details, location you supply, order history, payment references, refunds, rewards and referral records.
• Conversations and support: messages to Noah, WhatsApp messages and phone number, conversation state, account-linking information, support requests, attachments you submit and communications about your orders.
• Partner onboarding: business details and documents supplied for merchant or General verification, such as identity, licence, vehicle, business registration, banking or regulated-goods documents. We collect these where relevant to the service or verification process.
• Device and usage information: technical request logs, IP addresses and browser information where logged by our infrastructure, authentication events, notification permissions and push-device tokens. Your browser shares precise location only when you grant permission to a location request.

Please share only information needed for your request. Do not put passwords, payment-card details, identity documents or unnecessary sensitive information in a Noah or WhatsApp conversation. Requests about dietary needs, health or safety may reveal sensitive information if you choose to include it.

3. Why we use information

We use information to create and secure accounts, answer requests, offer relevant options, arrange and fulfil orders or bookings, process payments and refunds, verify partners, provide support, send requested service notifications and prevent fraud or abuse. We also use service records to understand performance and improve reliability.

Depending on the activity, processing is necessary to provide the service you request or perform a contract, meet a legal obligation, protect a legitimate interest, or act on your consent. Optional permissions can be withdrawn through your device or browser. Withdrawing permission may limit the feature that needs it. Marketing communications require an appropriate permission or other lawful basis and an available opt-out.

4. Who receives information

• Merchants and Generals: the contact, order and location details needed to fulfil your chosen service.
• Infrastructure providers: services that host the app and store or authenticate data, including Vercel and Supabase, and Resend for email delivery.
• Payment providers: the configured payment processor, such as Paystack, receives information needed to complete payment. Payment-card entry is handled by the processor; nowww retains transaction references and payment status rather than full card numbers or CVV codes.
• Messaging, maps and AI providers: Meta/WhatsApp handles WhatsApp communications; configured mapping services handle location searches; Google Cloud Vertex AI may process conversation content when external AI assistance is enabled, as described below.
• Authorised personnel and legal recipients: people managing support, verification and operations, and authorities or advisers where required by law or necessary to protect rights and investigate abuse.

We do not sell your personal information. Some providers process or store data outside South Africa. Where we transfer personal information internationally, we seek applicable protection through provider terms and safeguards, a lawful transfer basis, or your consent where required.

5. WhatsApp and Noah

When you message Noah through WhatsApp, nowww receives your phone number, message content and delivery-related identifiers from Meta. We use these to reply, maintain the conversation, manage pending actions and link your nowww account if you choose to do so. WhatsApp account linking is optional. Disconnecting a link does not delete your account or historical service records.

Noah can use rule-based assistance and, when enabled, an external AI service through Google Cloud Vertex AI. External assistance receives your message, recent conversation context, the city or area relevant to the request and catalogue context. Personal information you write into those messages can therefore reach that provider. Suggestions require your review; a suggestion is not confirmation of an order or payment.

The WhatsApp worker clears message payloads and reply content from completed or expired queue jobs and removes short-lived hashed delivery receipts after seven days when cleanup runs. This is not a seven-day deletion rule for all WhatsApp information: conversation state, account links and records connected to orders or support can remain until no longer needed or until a deletion request is reviewed.

To request deletion of WhatsApp data, follow our public data deletion instructions. You do not need to sign in to email a request.

6. Cookies, browser storage and permissions

We use authentication cookies and browser storage for sign-in sessions, cart or conversation state, and preferences such as appearance. These support the service and are not described here as advertising trackers. Clearing browser data can sign you out or remove locally saved preferences. You can control location and push-notification permissions in your browser or device settings.

7. Retention and security

We keep information for as long as needed for its purpose, including active accounts, fulfilment, support, security, dispute resolution and applicable legal or financial record-keeping. Retention varies by record type; closing or unlinking an account does not automatically erase every transaction. When reviewing a deletion request, we explain any information that must be retained and why.

We use access controls, authenticated service routes and restricted document storage to protect information. No service can guarantee absolute security. Do not share sign-in links or one-time codes. Contact us if you suspect unauthorised access to your nowww information.

8. Your rights and choices

Subject to applicable law, including South Africa's Protection of Personal Information Act (POPIA), you may ask to access your personal information, correct inaccurate details, request deletion, object to certain processing or withdraw consent for consent-based processing. We may need proportionate information to verify ownership before acting on a request.

Email support@nowww.co.za or, if you are signed in, open a support request. State the account email or WhatsApp number concerned and what you want us to do. Do not send passwords or card details. Our data deletion page explains that process.

You may raise a complaint with South Africa's Information Regulator. Official POPIA request forms are also available.

9. Children and regulated services

Children should not submit identity documents or sensitive information without involvement of a parent or other legally competent person. Age-restricted goods and services may require age or identity verification. A parent or legally competent person can contact us about a child's information or request its deletion.

10. Contact and policy changes

Privacy contact: nowww support, South Africa — support@nowww.co.za. Include “nowww privacy request” in the subject. We will review your request and explain the outcome or any additional information needed.

We may update this policy as the service changes. The date above identifies the current version. Material changes will be communicated through an appropriate service channel where necessary.