Who we are

This policy covers Shifa Natural Healing (Durban, South Africa), the operator of this website and its connected social and messaging accounts.

Information we collect

When you place an order, we collect your name and, where you provide them, your phone number and/or email address. If you choose courier delivery, we also collect your delivery address. We only ask for what's needed to fulfil that specific order.

If you message us — on WhatsApp, Facebook Messenger, or this site's chat widget where active — we (or, where enabled, our automated assistant) see the content of that conversation and your contact identifier (phone number, Messenger ID, or similar) in order to reply to you.

Payments

Card and payment details are handled directly by our payment service providers — Yoco and/or Paystack — this website does not receive or store your card number. Those providers receive your order amount and the contact details needed to process the transaction.

Delivery / courier

Where you choose courier delivery, your name, delivery address and phone number are shared with our courier partner (The Courier Guy) and, for certain delivery methods, other delivery partners we use for that specific order, solely to arrange delivery.

Order and account emails

Order confirmations and internal order alerts are sent using a Google Gmail mailbox we operate. Google processes the email content and your email address as our mail provider for that purpose.

Browser storage (not tracking cookies)

Your shopping cart is stored in your browser's local storage on your own device, not on our servers, so it stays with you between visits until you clear it or complete checkout. A small session-storage flag remembers that you've already seen the homepage's brief entrance animation, so it doesn't replay on every visit. Neither is a tracking cookie, and neither is shared with us or any third party. This site does not currently use advertising or third-party analytics tracking cookies. A basic first-party analytics event log exists in the site's code for future use but is not currently connected to any analytics service or sent anywhere.

The "Stay in the loop" email sign-up on our homepage is not active yet — submitting it does not send or store your email address anywhere, as the "Email updates are launching soon" message on that form says.

Accounts

You don't need an account to order from us — checkout is guest checkout only.

WhatsApp Business (current, manual)

"Message us on WhatsApp" links and buttons open WhatsApp itself on your device, to our WhatsApp Business number. Those conversations happen inside WhatsApp, between you and whoever at Shifa replies — we don't currently store a separate copy of them on this website.

Facebook, Instagram, Messenger and WhatsApp Cloud API (built into our systems; not all of it is active for customers yet)

We use Meta's Graph API to manage our Facebook Page and Instagram account — for example, publishing posts, and syncing our product catalogue for Facebook/Instagram Shop. Where we do this, Meta processes the content we publish and related engagement data (likes, comments, reach) under Meta's own data policy.

Separately, we have built — but not yet turned on for real customers — an AI-assisted customer service system that can answer product, order and FAQ questions on this website's chat, on Facebook Messenger, and via a dedicated WhatsApp Business Cloud API connection (distinct from the manual WhatsApp Business app above). When any of these are switched on, messages sent to us through that channel, your contact identifier, and our replies are processed by our systems (and, only if we've separately enabled an optional paid AI provider, OpenAI) in order to answer you or hand you over to a person. We do not use this system to give medical advice.

A customer's message content and contact identifier are kept as a conversation record in our systems for as long as we need them for customer service purposes; we do not currently have an automatic deletion schedule for these records. See "Your rights" below to request deletion.

WhatsApp marketing messages and consent

We do not currently send promotional/marketing WhatsApp messages. If we introduce this in future, we will only message numbers that have given us explicit opt-in consent, and we will honour opt-out requests at any time. Order confirmations and delivery updates are treated as transactional, not marketing, messages.

How we use what we collect

Order details are used to prepare, fulfil and communicate with you about that order, and to keep business and accounting records. Message content is used to respond to you and to improve the accuracy of our customer service. We do not sell personal information to third parties.

Third-party service providers

Depending on which of the above are in use, your information may pass through: Yoco and/or Paystack (payments), The Courier Guy (delivery), Google (order/alert email), and, where those particular integrations are switched on, Meta Platforms (Facebook, Instagram, Messenger, WhatsApp) and OpenAI (optional AI replies). Several of these providers process data outside South Africa; we have not yet obtained or documented a formal cross-border transfer assessment for each one — flagged here for the outstanding professional legal review.

Data security

Personal information collected through this website is stored in our private, server-side systems, accessible only to authorised Shifa administrators — it is not publicly browsable. Access credentials for our connected services (payments, courier, email, Meta, AI) are kept as server-side configuration and are never exposed in the website itself.

Your rights

Under POPIA, you have the right to access, correct, or request deletion of your personal information. Contact us on WhatsApp to exercise these rights, or see our Data Deletion page for exactly how to make a deletion request and what we need from you to process it.

Changes to this policy

We may update this page as our systems change. Material changes — especially once the outstanding legal review above is complete — will be reflected here directly.