Halfway Express

1. Summary

Halfway Express collects only the personal information needed to (a) take golf-course orders, (b) deliver them to the kitchen via WhatsApp, (c) operate paid subscriptions for courses and sponsors, and (d) send transactional emails. We comply with the Protection of Personal Information Act (POPIA) of South Africa. We do not sell your personal data.

2. Who is the responsible party

Halfway Express is the responsible party for personal information collected through this Service. Information officer: admin@halfwayexpress.co.za.

3. What we collect

We collect the following categories of personal information:

From players (anonymous)

Name and WhatsApp number — required to send the order to the kitchen and to identify whose order is whose at the halfway house.
Order contents and notes — what was ordered, including any allergy or preference notes.
Anonymous device-side preferences — your name and phone are stored locally in your browser (localStorage) so re-ordering is faster. We do not transmit this back to our servers; it lives on your device only.

From course administrators

Name, email address, and (optional) phone number of the contact person at the course.
Course branding, menu content, kitchen WhatsApp number, and operating hours.

From sponsor administrators

Name, email address, and (optional) phone number of the contact person at the sponsor.
Brand name, tagline, website, logo, and chosen courses.

From sponsor lead submissions

The email address you submit when you tap "Get more info" on a sponsor block.
Optionally your name and a free-text message.

Operational telemetry

Sponsor impressions (which sponsor was shown on which order confirmation page).
Sponsor clicks (logo, website, CTA, lead form submission). We do not record IP addresses or browser fingerprints in these tables.
Standard server logs from our hosting provider (Vercel) for security and debugging.

Payment information

Card data is collected and tokenised by PayFast — Halfway Express never sees your full card number. We store only PayFast's recurring billing token (a non-reversible identifier) and the payment confirmation metadata returned in PayFast's ITN webhook.

4. Why we use it

Player name + phone: route the order to the right kitchen and identify the customer at the halfway house.
Course/sponsor contact details: account administration and required transactional communication (signup welcome, payment receipts, approval, suspension, lead notifications, monthly receipts).
Sponsor leads: emailed to the sponsor whose block triggered the lead, so they can follow up. Leads are not shared across sponsors.
Impressions and clicks: provide aggregate reporting to sponsors so they can measure their sponsorship.
Card token: charge the recurring monthly subscription.

5. Who we share with (operators)

We share personal information only with the operators below, each of whom has its own privacy commitments:

Supabase Inc. — managed Postgres, authentication, storage, and realtime infrastructure. Data is hosted in the EU-West region.
Vercel Inc. — application hosting, edge network, and serverless functions.
Resend Inc. — transactional email delivery.
PayFast (Pty) Ltd — card and EFT payment processing for South African rand transactions.
Meta Platforms (WhatsApp) — WhatsApp deep-link delivery to the kitchen tablet. The order text is composed in your phone and dispatched by your WhatsApp client; we do not relay it through a server.
Sponsors — only the lead form data you submit, only to the sponsor whose block prompted you to submit it.

We do not sell or rent personal information to advertisers, brokers, or any other third party.

6. How long we keep it

Orders and order items: retained for the lifetime of the course's account; aggregate counts may be retained indefinitely for sponsor reporting.
Sponsor impressions and clicks: retained for the lifetime of the sponsorship plus 24 months for historical reporting.
Sponsor leads: retained for the lifetime of the sponsorship; sponsors are responsible for their own copy and any onward use.
Account contact details: retained while the account is active and for up to 7 years after closure for tax/audit purposes (South African Revenue Service requirement).
PayFast tokens: deleted on cancellation.

7. Cookies and similar

We use only the cookies and storage strictly necessary to operate the Service:

Authentication cookies set by Supabase Auth, required to keep you signed in to the course admin, sponsor portal, super admin, or kitchen view.
localStorage on the player view to remember your name and phone between orders at the same course. You can clear this any time from your browser.

We do not use advertising cookies, pixels, or third-party trackers.

8. Your rights under POPIA

You have the right to:

Be informed of the personal information we hold about you.
Request a copy or correction of that information.
Request deletion where we are not required by law to retain it.
Object to processing on legitimate grounds.
Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

To exercise any of these rights, email admin@halfwayexpress.co.za. We will respond within 30 days.

9. Cross-border processing

Some of our operators (Vercel, Resend) process data outside South Africa. Data hosted in Supabase is in the EU-West region. We rely on the standard contractual safeguards each operator publishes; if you would prefer your data not to be processed in those regions, please email us before signing up so we can discuss the implications for your account.

10. Children

The Service is not directed at children under 18. Players placing food orders should be of legal age to enter into a transaction at a halfway house, which generally means an adult or a minor accompanied by an adult.

11. Changes

We may update this Policy from time to time. Material changes will be communicated to account holders by email at least 14 days before they take effect.

12. Contact

admin@halfwayexpress.co.za