Privacy Policy

This Privacy Policy explains how Silk Stitches Bridal Couture (“Silk Stitches”, “we”, “us”) collects, uses, shares, and protects your personal information. It applies to our booking and client platform at app.silkstitches.co.za and to the styling services we provide from our boutiques in Fourways, Johannesburg and Moreleta Park, Pretoria.

We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA). For the purposes of POPIA, Silk Stitches is the responsible party.

1. Who is responsible, and how to reach us

Responsible party: Silk Stitches Bridal Couture [registered name and company / trading registration number].
Information Officer: [name], reachable at info@silkstitches.co.za or [phone].
Addresses: The Gantry, Eagle Creek Building, Fourways, Johannesburg; and 1243 De Villebois Mareuil Drive, Moreleta Park, Pretoria.

2. The information we collect

We collect only what we need to arrange and deliver your bridal experience:

• Contact details — your name, email address, and phone number, so we can sign you in, confirm appointments, and stay in touch about your booking.
• Wedding details — your wedding date and venue, so we can schedule and prepare for your consultations and fittings.
• Style preferences and inspiration — the styles you like and any images or links you upload, so your stylist can prepare for your appointment. You choose what to share.
• Body measurements — only if and when you provide them, and only to fit your garment. See section 7.
• Payment records — the amount, date, method (bank transfer / BACS), and proof of payment you send us, so we can reconcile your fitting fees and deposits. We do not collect or store card numbers.
• Consent choices — whether you have opted in to marketing, and when you gave or withdrew that choice.
• Technical information — limited sign-in and usage information needed to keep your account secure and the service working.

3. Why we use it, and our lawful basis

Under POPIA we must have a lawful basis for each use. Ours are:

• To perform our contract with you — signing you in, scheduling consultations and fittings, arranging your garment, and reconciling payments.
• Your consent — for inspiration images you upload, for any use of your photographs in testimonials or marketing, and for marketing emails. You may withdraw consent at any time (section 6).
• Our legal obligations — for example, retaining financial records for the periods South African tax and business law require.

We do not use your information for any purpose we have not described here without asking you first.

4. Who we share it with

We do not sell your personal information. We share it only with the service providers who help us run the platform, each bound by a data-processing agreement and permitted to use your information only on our instructions:

• Supabase (database, authentication, file storage) — hosted in the European Union (Ireland).
• Resend (sending our emails) — United States.
• Cal.com (appointment scheduling) — European Union region.
• Twilio (WhatsApp messages, where you have chosen that channel) — United States.
• PostHog (product analytics, EU region) and Sentry (error monitoring, EU region) — used without your directly-identifying details wherever possible.

We may also disclose information where the law requires it, or to establish, exercise, or defend a legal claim.

5. Where your information is stored, and cross-border transfer

Your information is stored primarily on servers in the European Union (Ireland). The EU provides a level of data protection recognised as adequate under POPIA (section 72). Where a provider named above is in the United States, that transfer is necessary to provide the service and is covered by contractual safeguards.

6. Your rights under POPIA

You have the right to:

• Access your information — request a copy of the personal information we hold about you. You can download it yourself from your account (“Download my data”) or ask us at any time.
• Correct your information — update your details in your profile, or ask us to correct anything.
• Delete your information — ask us to delete your account and personal information. We will do so within a reasonable time, except where the law requires us to keep certain records (for example, financial records — see section 8).
• Object to direct marketing — opt out of marketing at any time, using the unsubscribe link in any marketing email or by contacting us. We will stop.
• Complain — lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za or enquiries@inforegulator.org.za.

To exercise any of these rights, contact our Information Officer (section 1).

7. Special personal information

Some information needs extra care. Body measurements could relate to health, so we collect them only when you choose to provide them, show them only to your assigned stylist and manager, and delete them after your wedding by default. Photographs you upload are treated as personal, not special, information; if an image includes a child we do not keep it beyond 90 days after your wedding.

8. How long we keep it

We keep information only as long as we need it, or as the law requires:

• Your profile — while you are a client, and for a period afterwards for our business records.
• Booking records — for a period after your wedding date.
• Payment records — for the period South African tax law requires.
• Inspiration images — deleted after your wedding unless you have asked us to keep them.
• Marketing consent and email records — kept as an accountability record while relevant.

[Confirm the exact retention periods with your advisor before publishing — a working set is documented internally in docs/compliance.md.]

9. How we protect it

We use encryption in transit and at rest, database-level access controls so one client cannot see another’s information, signed time-limited links for any files, and an audit trail of changes. No system is perfectly secure, but we take reasonable steps to protect your information and will notify you and the Information Regulator of a compromise as the law requires.

10. Children

Our services are for adults (18 and older). We do not knowingly collect information from children.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new effective date, and where the change is significant we will let you know.

12. Contact us

Questions about this policy or your information? Email info@silkstitches.co.za and mark it for the attention of the Information Officer.