Privacy Policy

This Privacy Policy explains how neXon Labs (Pty) Ltd ("neXon," "we," "our," "us") handles personal information through the neXon application (the app being "Receipt Champ") and the neXon hardware installed at participating retailers.

We have written this policy to be plain-spoken. If anything is unclear, contact us at privacy@nexonlabs.io and we will explain it.

1. Who we are

neXon Labs (Pty) Ltd is a private company registered in South Africa, with offices in Cape Town. Our product is hardware that captures completed in-store transactions and delivers the receipt to the customer's phone.

Contact: privacy@nexonlabs.io

2. Our role: we are a processor, not the owner of your data

This is the most important thing to understand about how neXon works.

When you use the App at a participating retailer, the retailer is the "responsible party" (under the Protection of Personal Information Act) or "controller" (under the General Data Protection Regulation) for your personal information. They own the relationship with you. They decide why your data is being collected. Their own privacy policy governs how they use it.

neXon is the "operator" or "processor." We operate the technology that captures the transaction and delivers the receipt. We process your data only on the instructions of the retailer who served you, and only for the purposes set out in this policy.

Practically, this means:

• The retailer is the one you have a relationship with. They are the reason your data is being collected.
• neXon is the pipe. We move the data from the till to your phone, and we hold a copy so you can see your receipts later.
• Anything the retailer does with your data beyond delivering your receipt to you is governed by their privacy policy, not ours.

3. What information we collect

3.1 What you give us

• Your mobile phone number or email address, entered into the App at a participating retailer's till. You choose which one. You can use both if you prefer.
• We only capture your location in order to fetch the location to populate the user's country code based on their current location. This information is not stored.

3.2 What the retailer's till gives us

• The completed transaction itself: the store, the till, the date and time, the items purchased, the price of each item, the total, the payment method type (for example "card" or "cash" — not the card number or any banking detail).
• This data is captured by neXon hardware installed between the till's scanner and printer. It is the same data that is printed on your paper receipt.

3.3 What the App and your phone give us

• Basic device information needed for the App to function: device model, operating system version, language.
• Crash and diagnostic data, if you have agreed to share this with developers in your iOS settings.

3.4 What we do not collect

• We do not collect or store your payment card number, bank account, CVV, or any banking credential. neXon never sees these. They stay with the retailer's payment system.
• We do not collect government identifiers (ID number, passport, tax number).
• We do not collect biometric data, health data, contact lists or photos.
• We do not track you across other apps or websites.

4. What we use your information for

We use your information for exactly four things:

• To match your transaction at the till to your phone number or email, so we know which receipt belongs to you.
• To deliver your digital receipt to your device and, if you choose, to the App (if installed).
• To keep your receipts available to you over time, so you can look at your purchase history whenever you want.
• To return the matched receipt to the participating retailer who served you, so that they can recognise you as a customer and provide loyalty, returns, warranty, and related services.

We do not use your information for any other purpose. We do not build advertising profiles. We do not enrich your data with information from other sources. We do not analyse your data for purposes outside the four above.

5. Who we share your information with

5.1 The retailer who served you

When you complete a transaction at a participating retailer, the matched receipt is shared with that retailer. Only that retailer. The retailer at Store A never sees your transactions at Store B.

Once the retailer receives your matched transaction, they become responsible for it under their own privacy policy. They may use it to power their loyalty programme, to give you better service, or for their own analytics and marketing — in line with their privacy policy and the law. If you have questions about what a particular retailer does with your data, you should contact that retailer.

5.2 Service providers we rely on to run the App

To operate the App, we use a small number of standard service providers:

• Cloud infrastructure providers, who host the App's servers and storage.
• Apple (Apple App Clip or full App) for delivery of receipts and for push notifications via Apple Push Notification service.
• Google (a progressive web app, browser or home screen) for delivery of receipts (on Android).

These providers process your data only on our instructions and are contractually required to protect it. They do not use it for their own purposes.

5.3 Legal compliance

If we are required by law, court order, or lawful regulatory request to disclose information, we will. We will tell you about it where we are legally allowed to.

6. How long we keep your information

We keep your receipts for as long as you want them. We do not delete them on a schedule.

The reason: your receipts belong to you. You may need them years from now for a warranty, a return, a tax record, or just to remember what you bought. We will not take that away from you by default.

You can delete your entire account and all associated data, at any time by deleting the App. When you delete your account (the App):

• Your identity record (phone number and/or email) is permanently deleted within 30 days.
• Your receipts in our system are permanently deleted within 30 days.
• Receipts that have already been shared with retailers remain in the retailer's system and are governed by the retailer's privacy policy. You will need to contact each retailer directly to ask them to delete their copy.
• Backup copies are purged on rolling schedules and will be fully removed within 90 days.

7. Your rights

You have the right to:

• See what we hold about you.
• Correct anything that is wrong.
• Delete individual receipts or your entire account at any time, from within the App.
• Get a copy of your data in a portable format.
• Object to specific processing, or withdraw your consent.
• Complain to a regulator. In South Africa: the Information Regulator. In the EU/UK: your national data protection authority.

Because retailers are the responsible party for the data shared with them, requests about how a retailer uses your data should go to that retailer. We will help you find the right contact if you ask.

To contact us about any of these rights: privacy@nexonlabs.io. We will respond within 30 days, usually much sooner.

8. How we protect your information

We apply standard security practices, including:

• Encryption of your data in transit using TLS 1.2 or higher.
• Encryption of your data at rest.
• Strict access controls so that only authorised personnel can access production systems, with multi-factor authentication.
• Logging and monitoring of access to personal information.
• Regular review of our infrastructure and service providers.

No system is perfectly secure. If we ever become aware of a security incident affecting your personal information, we will notify you and the relevant regulators in accordance with the law.

9. Where your information is stored

Your information is stored on commercial cloud infrastructure. Primary storage is in regions selected to provide good performance to the South African market. Some service providers (for example Apple and Google) are based in other countries, including the United States. Where data crosses borders, we rely on the safeguards provided by those providers and on applicable contractual protections.

10. Children

The App is not intended for children under 13, and we do not knowingly collect information from children under 13. If you believe a child has provided information to us, please contact privacy@nexonlabs.io and we will delete it.

11. Sign in with Apple

The App offers Sign in with Apple as an optional way to provide your email. If you use it, you can choose to share your real email or a private relay email that Apple manages on your behalf. Either works. Apple's own privacy practices govern the sign-in process itself.

12. Apple App and Google Progressive Web App

Receipts delivered to your device can be saved to the App. Once saved, those receipts live on your device under Apple's or Google's privacy practices.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will tell you through the App or by contacting you directly before the changes take effect. The "Effective date" at the top of this policy reflects the most recent version.

14. Contact

If you have questions about this policy or how we handle your information:

neXon Labs (Pty) Ltd

Email: privacy@nexonlabs.io

Postal: Unit 116, 1st Floor, Block 2, Northgate Park, Cnr Section Street & Koeberg Rd, Cape Town, 7441

Information Officer: Jonathan Williams