Privacy Policy

1. Who we are

STORI is operated by STORI GROUP (PTY) LTD. Our Information Officer is Paulo Goncalves, registered with the Information Regulator. Contact us at hello@thestori.co.za, or use Talk to the STORI team in the help chat. Our full company details are at the end of this page.

2. What we collect

• Your account: name, email address, and your password (stored only as a one-way hash — we can't read it); that you confirmed you're 18 or older.
• Orders: what you bought, your delivery address and phone number (required at checkout so the courier can reach you), and how you paid as PayFast reports it (for example “Credit Card”) — never your card details.
• Maker applications: your name, email, phone, craft, region, portfolio link, why you'd like to join, how you heard about STORI, the photos you send, and any referral code. An application that isn't approved is deleted, with its photos, 3 months after it was sent.
• Makers: shop and story details, collection address, phone number, banking details, and SARS tax number if you add it.
• Help chat: what you type to the assistant (with passwords, card and ID numbers removed first), and tickets passed to the STORI team.
• Returns: your reasons and the photos you upload.
• Competitions: your entry, and a scrambled (hashed) form of your IP address to stop repeat entries, deleted 90 days after the draw. A winner's ID is checked by the independent certifier and is never stored on our site.
• Referrals: if you arrive through a maker's referral link, a cookie remembers it for 30 days.
• Emails we send: a record of each email (date, subject, delivery). The email's contents are deleted if you delete your account.
• Analytics: how pages are used — only if you accept analytics cookies (see 7).

3. Why we use it

To run your account, take payment, deliver and return orders, review maker applications, pay makers, answer your questions, prevent fraud, meet our legal and tax duties, and — only if you sign up — send our newsletter.

4. Who we share it with

• The Courier Guy: your name, delivery address, phone number and email, to deliver your order; for makers, your shop name, collection address, phone number and email, to collect parcels.
• The maker of your order: your name and delivery address (on the order and the waybill), and what you tell them on a made-to-order order.
• PayFast: payments and refunds.
• Resend: sending our emails.
• Cloudflare (R2): storing photos.
• Vercel and Neon: hosting the site and its database.
• Google: Gemini, for the help chat assistant (your chat text, with passwords, card and ID numbers removed; Google may keep it up to 55 days for abuse monitoring and doesn't use it to train its models), and Google Maps for checking addresses.
• PostHog: analytics, only with your consent.
• The competition certifier: to check a winner's eligibility.

We don't sell your information.

5. Information sent outside South Africa

Some of these providers store or process information outside South Africa: Vercel, Neon, Resend, Cloudflare, Google and PostHog (in the European Union). We use them because they apply protections at least as strong as POPIA's, under their data processing terms (POPIA section 72).

6. How long we keep it

• Orders, payments and settlements: 5 years, for tax and company law. If you delete your account, your street address and phone number are removed from them.
• Maker applications that aren't approved: 3 months.
• Help chats: 90 days; chats passed to the team, with their ticket: 12 months.
• Competition IP hashes: 90 days after the draw.
• Saved baskets: 7 days.
• Backups: 14 days.

7. Cookies

• Sign-in (essential): keeps you signed in.
• Referral (30 days): remembers a maker's referral link.
• Competition strip (120 days): remembers that you closed the competition banner.
• Your choice: remembers whether you accepted analytics cookies.
• Analytics (PostHog): only if you accept.

Your basket is kept in your browser's storage, not a cookie.

8. Your rights

You can ask to see, correct or object to the use of your information, and complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; 010 023 5200; inforegulator.org.za.

You can delete your account yourself — on the website under My Account → Privacy, in the app under Account → Delete account. We then remove your name, email, phone, saved address, wishlist and newsletter sign-up, and blank the emails we sent you. Order records are kept for 5 years, as the law requires, without your street address and phone, and linked to no one who can sign in.

9. Marketing

We send our newsletter only if you sign up, and every issue has an unsubscribe link.

10. Age

STORI is for people aged 18 and over.

11. Security

Passwords are hashed; payments go through PayFast, so we never see card details; staff access is limited by role; backups are encrypted.