Privacy & POPIA notice

1. Who we are

Comfort Shooting operates this subscription portal to manage client service packages, recurring billing, approvals, and related account administration for marketing, web, domain, and email services.

Contact for privacy requests: appdev@comfortshooting.com

2. Personal information we process

• Identity and contact details (name, billing email, phone)
• Business details (business name, domain, website URL, notes you provide)
• Subscription and billing records (package, amount, billing day, payment status, Paystack references)
• Account security data (password hash if set, session preferences, magic-link tokens)
• Operational logs (login events, approvals, terminations, email delivery attempts, webhook processing)

We do not store full card numbers or CVV. Card authorizations are handled by Paystack. Comfort Shooting only stores non-sensitive payment references and authorization/subscription codes required to manage renewals.

3. Why we process it (POPIA lawful basis)

• Contract: to assign packages, collect subscription fees, and deliver contracted services
• Legal obligation: to keep accurate billing/tax-supporting records where required
• Legitimate interests: to secure accounts, prevent fraud, audit admin actions, and recover failed payments
• Consent: where you choose optional preferences such as longer sessions or password-based login

4. Cookies and local storage

This portal uses essential browser storage only:

• cs_portal_session (HTTP-only cookie): keeps you signed in after magic-link or password authentication
• cs-theme (localStorage): remembers light/dark preference
• cs-cookie-consent (localStorage): remembers that you acknowledged this notice

We do not use advertising cookies, cross-site trackers, or third-party analytics cookies in this portal.

5. Operators and international processing

We use trusted operators to run the portal:

• Paystack — payment processing and recurring billing
• Neon — application database hosting
• Vercel — application hosting
• SMTP provider — transactional email delivery

Some operators may process data outside South Africa. We only share the minimum information needed for the service and require appropriate security controls from operators.

6. Retention

Account, subscription, payment, and audit records are retained while the commercial relationship is active and for a reasonable period afterwards for dispute handling, accounting, and security. Access tokens expire automatically. You may request deletion or correction subject to legal retention requirements.

7. Your rights under POPIA

Subject to applicable law, you may request to:

• access the personal information we hold about you
• correct or update inaccurate information
• object to certain processing, or request deletion where no longer required
• lodge a complaint with the Information Regulator (South Africa)

Email appdev@comfortshooting.com with the subject line “POPIA request”.

8. Security

We use signed session cookies, hashed passwords, expiring magic links, webhook signature validation, and role-based admin access. No security control is perfect; please protect your email inbox and report suspected unauthorized access immediately.