Privacy Policy

This policy explains what personal information Shoku ("Shoku", "we", "us") collects when you use the Shoku and Shoku Contractor apps, the Shoku websites (shoku.co.za and its user, contractor and referrals sites), why we collect it, and how you can exercise your rights under South Africa's Protection of Personal Information Act, 2013 (POPIA). It applies to homeowners, contractors and referral partners, and — where section 1 says so — to people who are recommended to us.

1. Information we collect

Account information. Your name, email address, phone number and password, plus whether you're using Shoku as a homeowner or a contractor. Passwords are handled by Firebase Authentication; we never see them.

Job and quote information. Job descriptions, the address for the work, any photos you attach, quotes submitted by contractors, schedules proposed for a job, and the rating and review a homeowner leaves when signing off a job.

Messages. The content of chat messages between a homeowner and a contractor.

Contractor payout and identity details. If you register as a contractor, we collect your bank account details and the South African ID number, passport number or business registration number that Paystack requires to verify the account. We keep these to pay out what you earn; the identity number is never shown to other users.

Referral partner details. If you are a Shoku referral partner, we hold your name, email address, phone number and bank account details. Your ID or business registration number is sent to Paystack to verify your bank account; we don't keep it. When you sign in, we email you a one-time code; we store only a one-way hash of it, and it expires after 10 minutes.

People recommended to us. If a homeowner recommends a tradesperson, we store the name, email address or phone number and the rating and comment the homeowner gives, and we email the tradesperson an invitation that names the homeowner who recommended them. Please only recommend someone who is happy for you to share their contact details with us.

Payment information. When a homeowner pays for a job, card details are captured and processed directly by Paystack, our licensed third-party payment processor. Your full card number never touches Shoku's own servers.

Location information. The address you provide when posting a job, which we convert to map coordinates so that nearby contractors can find it, and — for contractors — the service area you choose, used to show you nearby jobs.

Device and usage information. Basic technical information, such as device type and app version, and the push-notification token for your device, needed to run, secure and support Shoku and to send you notifications.

Website analytics. On this marketing website we use Google Analytics for Firebase to count visits and clicks on its buttons. We honour your browser's Do-Not-Track signal: if it's enabled, no analytics script is loaded and no analytics data is collected for your visit.

Web app analytics and session recordings. On the homeowner and contractor websites we use Amplitude to understand how pages are used — page views, clicks and a recording of the screen during your session. All text on the page and everything you type is masked in the recording before it leaves your browser, and we don't attach your name or email address to it.

Error reports. When something goes wrong in our websites or servers, technical details about the error — what failed, on which page or feature, and your browser type — are sent to Sentry so we can fix it. We've configured it not to collect your IP address, the contents of your requests or your account details.

2. How we use your information

• To match homeowners with contractors and let you browse, quote on and manage jobs.
• To enable chat, schedule proposals and job sign-off between homeowners and contractors.
• To process payments via Paystack, pay contractor payouts to their bank account and pay referral partners their commission.
• To send you emails and notifications about your jobs, payments and account, sign-in codes for referral partners, and invitations to tradespeople a homeowner recommends.
• To maintain trust and safety on the platform, including vetting contractors and investigating disputes.
• To operate, secure and improve Shoku, including fixing errors.
• To keep accounting records and meet our legal, tax and regulatory obligations.

3. Who we share it with

We share information only where it's needed to provide the service:

• The other party to a job. A contractor sees the job details, address and photos a homeowner posts, and both sides see each other's chat messages. A homeowner sees a contractor's public profile.
• Referral partners see how many contractors they have referred and the commission they have earned — not those contractors' names, contact details or jobs.
• Paystack, to process card payments, pay contractors and referral partners, and verify bank accounts, including the identity or registration number described in section 1.
• Google Cloud Platform / Firebase, our infrastructure provider, for hosting, our database, sign-in, file storage, push notifications and marketing-site analytics.
• Google Maps Platform, which receives the addresses you type so it can suggest and locate them.
• Resend, which delivers our emails and so receives your email address and the content of each email.
• Amplitude, for the web app analytics and masked session recordings described in section 1.
• Sentry, for the error reports described in section 1.
• Xero, our accounting system, which receives payment references and amounts — not your name or contact details.
• Regulators or law enforcement, where we're legally required to disclose information.

These providers process information on our behalf under their own security and data-protection commitments. We do not sell your personal information.

4. Where your information is processed

Our main database and servers run on Google Cloud in Johannesburg, South Africa. Some of the providers in section 3 process information outside South Africa: Amplitude and Sentry in the European Union, and Google, Paystack, Resend and Xero in other countries, depending on their infrastructure. Where information is processed outside South Africa, we rely on the safeguards those providers make available to protect your information to a standard consistent with POPIA.

5. How long we keep it

We retain personal information for as long as necessary to provide the service described above, and for as long as required by law afterwards — for example, financial records relating to payments and payouts. Referral-partner sign-in codes expire after 10 minutes.

6. Your rights under POPIA

Subject to POPIA, you have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete personal information we no longer have a lawful basis to keep, or to close your account.
• Object to certain processing of your personal information.
• Lodge a complaint with South Africa's Information Regulator if you believe we've handled your information improperly.

You can exercise any of these rights, or ask us anything about this policy, by emailing shoku-support@businessblacksmiths.com.

7. Security

We use reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and misuse. No system is completely secure, but we work to keep yours as safe as practically possible.

8. Children

Shoku is intended for people aged 18 and over. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time as the product changes. We'll update the "Last updated" date above when we do.

10. Contact us

For any question about this policy or your personal information, email shoku-support@businessblacksmiths.com.