Privacy Policy

Effective 28 October 2026

Saffron de la Rouviere, a sole proprietor trading as Saffron's Garden ("we", "us"), runs Plant Club by Saffron's Garden. This policy explains what personal information we collect, why, and what your rights are under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. What we collect

• Contact details: your name, email address and phone number.
• Delivery address: street address, suburb, city, province and postal code.
• Payment details: your card is entered directly into Paystack's secure window. We never see or store your full card number or CVV. Paystack gives us a token that lets us charge the card, plus the card type, first six and last four digits, and expiry date so we can tell you which card is on file.
• Subscription records: your subscription status, payment history and the boxes we've sent you.
• Emails: messages you send us.

This site doesn't use advertising or analytics cookies or tracking.

2. Why we use it

• To run your subscription: charge your card each month, pack and deliver your plant, and send you receipts and account emails (such as a failed payment notice).
• To answer your questions and handle refunds or complaints.
• To keep accounting and tax records as the law requires.

We use your information because it's needed to perform our agreement with you and to meet our legal obligations. We won't send you marketing unless you've opted in, and you can opt out at any time.

3. Who we share it with

We don't sell your information. We share only what's needed with service providers who process it on our behalf:

• Paystack: payment processing.
• Courier companies: your name, address and phone number, to deliver your box. We use different South African couriers depending on the month and your area.
• MongoDB Atlas: secure database hosting, outside South Africa.
• Resend: sending account emails.
• Our hosting provider: running this website.

Some of these providers store data outside South Africa. Where that happens we rely on them to protect it to a standard at least as high as POPIA requires, as section 72 of POPIA provides. We may also disclose information when the law requires it.

4. How we protect it

The site uses HTTPS throughout, access to customer data is limited to the people who run Plant Club, and card details stay with Paystack, which is PCI-DSS certified.

5. How long we keep it

We keep your information while your subscription is active. After you cancel, we keep payment and transaction records for five years, as tax law requires, and delete or anonymise the rest within 12 months unless you ask us to delete it sooner.

6. Your rights

You can ask us to:

• confirm what personal information we hold about you and give you a copy;
• correct or update it;
• delete it, where we don't need to keep it by law;
• stop using it for a particular purpose, including marketing.

Email [email protected] and we'll respond within 30 days. If you're unhappy with how we've handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

7. Information Officer

Saffron de la Rouviere
Email: [email protected]

8. Changes

We'll post any update to this policy here and change the effective date above. If a change materially affects how we use your information, we'll email you.