1. Introduction

FuelPrice ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African legislation. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the FuelPrice website and API services ("Service").

2. Information We Collect

2.1 Information You Provide

Email address — when you register for an API key or claim a fuel station
Company name — optionally provided during registration
Payment information — EFT payment references (we do not store bank account details)

2.2 Station Owner Information

When you claim and manage a fuel station, we additionally collect:

Owner name and contact details — name, email address, and phone number provided during the claim process
Business registration number — optionally provided to verify station ownership
Station listing content — fuel prices, opening hours, facilities, loyalty programs, and logos you upload
Station analytics data — aggregated view counts, direction clicks, and phone clicks for your station

2.3 QR Code Scan Data

When someone scans a QR code generated by a Premium station owner, we collect:

Partial IP address — only the first three octets of an IPv4 address (e.g. 192.168.1.xxx) are stored. We never store the full IP address, in compliance with POPIA.
User agent — the browser or device identifier sent with the request (truncated to 512 characters)
Timestamp — when the scan occurred

This data is used solely to provide scan analytics to the station owner. It is not used for advertising, profiling, or shared with third parties. Scan data is subject to the same retention period as other analytics data.

2.4 Information Collected Automatically

API usage data — endpoints called, timestamps, response status codes
Server logs — IP addresses, user agents, request metadata
API key identifiers — hashed keys and key prefixes for authentication

2.5 Information We Do Not Collect

We do not use cookies for tracking or advertising purposes
We do not collect sensitive personal information as defined in POPIA
We do not use third-party analytics or tracking services on the website

3. Purpose of Processing

We process your personal information for the following purposes, as permitted under POPIA Section 11:

Service delivery — to provide and manage your API access, credits, and station listings
Station directory — to display your station information publicly as part of the directory service
QR code analytics — to provide scan statistics to Premium station owners for their QR code marketing campaigns
Communication — to send invoices, account notifications, and service updates
Security — to protect against abuse, fraud, and unauthorised access
Legal compliance — to comply with applicable laws and regulations
Service improvement — to monitor and improve the performance of the Service

4. Legal Basis for Processing

We process your personal information based on:

Contract — processing necessary to provide the Service you have requested (POPIA Section 11(1)(b))
Legitimate interest — processing necessary for our legitimate business interests, such as security and service improvement (POPIA Section 11(1)(f))
Legal obligation — processing required to comply with South African law (POPIA Section 11(1)(c))

5. Data Storage and Security

Your personal information is stored on secure servers. We implement appropriate technical and organisational measures to protect your data, including:

API keys are stored as one-way cryptographic hashes (bcrypt) — we cannot retrieve your original key
Admin passwords are bcrypt-hashed
Station owner magic login links are single-use, time-limited tokens — we do not use passwords for station owner access
All data is transmitted over HTTPS/TLS encryption
Database access is restricted and credentials are securely managed

While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as:

Your account is active and you continue to use the Service
Necessary to fulfil the purposes outlined in this policy
Required by South African law (including tax and financial record-keeping obligations)

API usage logs are retained for operational and security purposes. You may request deletion of your account and personal data at any time, subject to our legal retention obligations.

7. Sharing of Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Service providers — email delivery services used to send invoices and notifications
Legal requirements — when required by law, court order, or government request
Protection of rights — to enforce our Terms of Service or protect our rights and safety

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

Access — request confirmation of what personal information we hold about you
Correction — request correction of inaccurate or incomplete personal information
Deletion — request deletion of your personal information, subject to legal retention requirements
Objection — object to the processing of your personal information on reasonable grounds
Complaint — lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us via the details on the About page.

9. Information Regulator

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za

10. Children's Privacy

The Service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact

For any questions regarding this Privacy Policy or your personal information, please contact us via the details provided on the About page.