Privacy Policy

Account details: your name, email address, phone number, date of birth and the area you live in. If you sign in with Apple or Google we receive the name and email address they share with us.

Location: your precise location while you use the app, to show nearby shops, set your delivery point and work out delivery fees. If you are a runner on an active job, your live location is shared with the customer for that job.

Delivery addresses and instructions you save.

Orders and payments: what you order, prices, fees, refunds and payment status. Card payments are handled by PayFast; we do not receive or store your full card number.

Messages: chats with shops, runners and Mzala Support, including photos you send and products you share.

Shop and runner details: for sellers, your shop name, location, opening status, products, photos and business contact details; for runner applicants, the information in your application.

Searches: the words you search for, and an approximate area (about 1 km) to improve results.

Device information: a push notification token so we can send you message and order notifications.

To run your account, show nearby shops and products, process orders and payments, match runner requests with nearby runners, deliver messages and notifications, give refunds and provide support.

To keep Mzala safe: verifying shops and runners, preventing fraud, and reviewing reported chats.

To improve search and the service. Search text may be processed by an AI service (see below) to understand requests such as "a braai for 6 under R300"; your name and contact details are not sent with it.

We do not sell your personal information.

Shops and runners you deal with see what they need to fulfil your order: your first name and surname initial, the items and your delivery location. They do not see your email address or date of birth.

Service providers who process information for us: Supabase (database, sign-in and file storage), PayFast (payments), Google (AI search and Google sign-in), Apple (Sign in with Apple and notifications) and Expo (sending push notifications).

Authorities, when the law requires it, or to protect someone's safety.

Some providers store information on servers outside South Africa. We use providers that protect personal information to a standard comparable to POPIA.

We keep your account information while your account is open.

Order, payment and refund records are kept for as long as tax and financial laws require (generally five years), even after an account is deleted, but without your name or contact details.

Chats about a runner job or order close 24 hours after the job ends; the history stays available to the people in that chat.

You can view and update your profile in the app, turn off location and notifications in your phone's settings, and block or report anyone you chat with.

You can delete your account at any time in the app: Profile → Settings and privacy → Delete account. This removes your personal details and closes your sign-in. Records we must keep by law are kept without your personal details.

Under POPIA you may ask to access or correct your information, or object to how it is used. To do this, message Mzala Support in the app (Inbox → Chat to Mzala Support).

If you are unhappy with how we handled your information, you may complain to the Information Regulator (South Africa).

Mzala accounts are for people aged 18 and older. We do not knowingly collect information from children.

If we change this policy we will update the date above and tell you in the app when the change is significant.

Questions? Message Mzala Support in the app (Inbox → Chat to Mzala Support).