FayeBaby ("we", "us", "our") operates a product safety and recall monitoring platform accessible at our website and mobile application (the "Service"). The Service provides users with searchable recall data, AI-assisted safety analysis, and consumer protection tools related to baby, infant, and food products.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. We are committed to protecting your privacy and complying with the Protection of Personal Information Act, 2013 (POPIA) of South Africa, the General Data Protection Regulation (GDPR) where applicable to European users, and other applicable data protection laws in the jurisdictions we serve.

By accessing or using our Service, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please do not use the Service.

We collect the following categories of personal information:

Account Information: When you register, we collect your full name, email address, and authentication credentials. Your role (user or administrator) is assigned upon registration.

Subscription Information: If you subscribe to our Pro plan, we collect billing-related information including your subscription status, billing period, and payment confirmation metadata. Payment processing is handled by our third-party payment provider (Dodo Payments); we do not store your full credit card or banking details on our servers.

Search and Usage Data: We log your search queries (including product names, barcodes, and search type), search results viewed, and scan history. This data is linked to your account and used to provide and improve our services.

Contact Form Submissions: When you submit a contact form, we collect your name, email address, enquiry type, subject, message content, and any optional file attachments. For bug reports, we also collect browser metadata (user agent, current URL, timestamp, viewport size, and language).

Recall Submissions: If you submit a product recall report, we collect the product details you provide (name, brand, batch number, barcode, recall reason, risk level), your name and email address, and any additional notes.

Assurance Tickets: When you create a Certificate of Analysis (COA) request, we collect the product and brand details, batch number, recipient email, and your user email for follow-up communication.

Technical Data: We automatically collect certain technical information including IP address, browser type, device information, operating system, and usage logs for security and analytics purposes.

We use your personal information for the following purposes:

Service Delivery: To provide you with product recall search results, safety analysis, dashboards, and consumer protection tools as part of your subscription or free access.

Account Management: To create and manage your account, process subscriptions, verify your identity, and communicate with you about your account.

Communication: To respond to your enquiries, send you recall alerts for products you have saved or searched, notify you of COA request updates, and provide important service announcements.

Improvement and Analytics: To analyze usage patterns, improve our services, develop new features, and monitor the effectiveness of our recall database.

Security and Fraud Prevention: To detect, prevent, and address fraud, abuse, security incidents, and other harmful activities on our platform.

Legal Compliance: To comply with our legal obligations, respond to lawful requests from authorities, and protect our legal rights and interests.

For users in the European Economic Area (EEA), we process your personal data on the following legal bases:

Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications or collecting optional metadata in bug reports.

Contractual Necessity: Where processing is necessary to perform our contractual obligations to you, including providing the Service and processing your subscription.

Legitimate Interests: Where processing is in our legitimate interests, such as ensuring platform security, improving our services, and complying with legal obligations, and these interests are not overridden by your rights.

Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

We do not sell your personal information to third parties. We may share your information in the following circumstances:

Service Providers: We share information with third-party service providers who perform services on our behalf, including payment processing (Dodo Payments), email delivery, and cloud hosting infrastructure. These providers are contractually bound to protect your information and use it only for the purposes we specify.

Regulatory Authorities: We may disclose information to government or regulatory authorities, including the National Consumer Commission (NCC) of South Africa, the South African Health Products Regulatory Authority (SAHPRA), or equivalent international bodies, where required by law or where you have submitted a recall report for regulatory follow-up.

Legal Compliance: We may disclose information where required by law, court order, or governmental authority, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, we may transfer your information to the acquiring entity, subject to the protections of this Privacy Policy.

COA Requests: When you create an Assurance Ticket, the product details and your email address are sent to the recipient email you specify (typically a manufacturer's QA manager) for the purpose of obtaining a response.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL protocols and encryption of sensitive data at rest.

Role-based access controls that limit access to personal information to authorized personnel who need it to perform their duties.

Regular security assessments and monitoring of our systems for vulnerabilities and threats.

Secure authentication mechanisms, including session management and token-based authorization.

Despite our efforts, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly investigating and notifying affected users of any data breach in accordance with applicable laws.

We use cookies and similar tracking technologies to operate and improve our Service. Cookies are small data files stored on your device that help us authenticate your session, remember your preferences, and analyze how you use our platform.

Essential Cookies: These are necessary for the Service to function properly, including authentication and session management. They cannot be disabled.

Analytics Cookies: These help us understand how visitors interact with our Service, allowing us to improve performance and user experience.

You can control and manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

We retain your personal information for as long as your account is active or as necessary to provide our Service. Specific retention periods include:

Account data is retained for the lifetime of your account and deleted or anonymized within 90 days of account closure, unless retention is required by law.

Search and scan history is retained for the duration of your subscription and may be deleted upon request.

Contact form submissions and bug reports are retained for up to 24 months for quality assurance and dispute resolution purposes.

Recall submission records are retained for up to 36 months to support regulatory compliance and historical reference.

Subscription and billing records are retained for the period required by applicable tax and financial laws, typically 5 years.

You may request deletion of your personal data at any time, subject to our legal obligations to retain certain records.

Your personal information may be transferred to and processed in countries outside of South Africa, including the United States and European Union, where our service providers and infrastructure are located.

We ensure that such transfers comply with applicable data protection laws, including by using standard contractual clauses or other lawful transfer mechanisms where required.

By using our Service, you acknowledge and consent to the transfer of your personal information to these countries for the purposes described in this Privacy Policy.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: The right to request a copy of the personal information we hold about you.

Rectification: The right to request correction of inaccurate or incomplete personal information.

Erasure: The right to request deletion of your personal information, subject to legal retention obligations.

Restriction: The right to request that we restrict the processing of your personal information in certain circumstances.

Data Portability: The right to receive your personal information in a structured, machine-readable format and transmit it to another party.

Objection: The right to object to the processing of your personal information based on legitimate interests or for direct marketing.

Withdrawal of Consent: The right to withdraw consent for processing based on consent at any time.

To exercise any of these rights, please contact us through our Contact page. We will respond to your request within 30 days, as required by applicable law.

Our Service is designed for parents, guardians, and caregivers concerned about product safety for babies and young children. We do not knowingly collect personal information from children under the age of 16.

If you believe that a child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through our Contact page.

You may also contact our Information Officer (as required by POPIA) at the contact details provided on the Contact page.

We are committed to working with you to resolve any concerns about your privacy and the handling of your personal information.