Privacy policy

Effective date: 19 October 2026 · Last updated: 20 October 2026

Prysly is a browser extension that shows the price history of a product (from shoppers and our own checks) and cheaper prices at other South African stores, and this website (prysly.com) explains it. This policy explains what information Prysly handles, why, and your rights, in line with the Protection of Personal Information Act 4 of 2013 (POPIA). Prysly has no accounts and does not ask who you are.

1. Who is responsible

The responsible party for Prysly is Luciatech (Pty) Ltd (registration number 2019/548229/07), trading as Prysly, of Sandton, Johannesburg, South Africa ("Prysly", "we", "us").

Our Information Officer can be reached at privacy@prysly.co.za or at the physical address above. See also our contact page and our PAIA manual.

2. Where Prysly runs

The extension only runs on these 35 store websites: Takealot (takealot.com), Amazon South Africa (amazon.co.za), Makro (makro.co.za), Game (game.co.za), Incredible Connection (incredible.co.za), HiFi Corp (hificorp.co.za), Superbalist (superbalist.com), Bash (bash.com), Dis-Chem (dischem.co.za), Hirsch's (hirschs.co.za), Baby City (babycity.co.za), Computer Mania (computermania.co.za), Exclusive Books (exclusivebooks.co.za), Evetech (evetech.co.za), Checkers (checkers.co.za), Shoprite (shoprite.co.za), Clicks (clicks.co.za), Woolworths (woolworths.co.za), Pick n Pay (pnp.co.za), Mr Price (mrp.com), Digital Experience (digitalexperience.co.za), Loot (loot.co.za), Sportsmans Warehouse (sportsmanswarehouse.co.za), Faithful to Nature (faithful-to-nature.co.za), Leroy Merlin (leroymerlin.co.za), CTM (ctm.co.za), Italtile (italtile.co.za), Chamberlain (chamberlains.co.za), Adendorff Machinery Mart (adendorff.co.za), Tile Africa (tileafrica.co.za), Brights Hardware (brights.co.za), Cashbuild (cashbuild.co.za), Mica (micashop.co.za), The Lighting Warehouse (lightingwarehouse.co.za) and ACDC Dynamics (acdc.co.za). It cannot see any other website you visit. On those stores it only reads product pages and cart or checkout pages. On cart and checkout pages it reads only the cart total and the applied-code text, and types codes into the coupon box (it never reads what is in it). It sends only what is described under "At checkout" below. On Checkers, Shoprite, Pick n Pay and Cashbuild, prices differ by store and Prysly does not read your delivery address or chosen store: the prices it records and shows are the website's default store price, and are labelled that way.

3. What the extension sends

When you open a product page on one of those stores, the extension sends the following to the Prysly server (api-production-e946.up.railway.app):

• the product page address (URL);
• the product title;
• the price and the "was" price shown on the page, if any;
• the barcode (EAN), model number and brand shown on the page, if any;
• whether the product is shown as in stock.

If the page shows its "was" price only a moment after the price (within 3 seconds), the extension sends the same information once more, now with that "was" price. It is sent at most twice per page.

If the extension cannot read part of a product page, it sends a short error report with the store's name and the name of the field it could not read (for example "price"). The report contains nothing else. The Prysly server does not keep the field name: it only adds the report to that store's hourly health counts, together with the confirmation code (see section 5) of the shopper who hit the error. A product page the server receives with a price it accepts (stored, or within 10% of the accepted price) counts as a successful view in the same hourly counts, also under the shopper's confirmation code.

Searching other stores for you. When Prysly has no cheaper offer yet for the product you are viewing (or too little price history), your browser searches the other supported stores that offer a public search: Takealot, Incredible, HiFi Corp, Bash, Dis-Chem, Hirsch's, Baby City, Computer Mania, Exclusive Books, Clicks, Woolworths, Mr Price, Digital Experience, CTM, Italtile, Chamberlain, Adendorff Machinery Mart, Mica and The Lighting Warehouse (Incredible's, HiFi Corp's, Dis-Chem's, Hirsch's', Baby City's, Mr Price's, CTM's, Italtile's, Chamberlain's and Adendorff Machinery Mart's search is run by their search provider, Klevu, Clicks' by Algolia and Woolworths' by Constructor.io). Each search contains only a search term made from the product's name, or its brand and model number. It is sent without your cookies, so a store can't link it to your account there, but like any search you type, that store (or Klevu, Algolia or Constructor.io) sees your IP address. Your browser then sends the search results (public product listings: address, name, price, barcode, brand, stock) to the Prysly server (/v1/found), which keeps only the ones that are the same product as the one you are viewing, as described for product pages above, and shows you the cheaper ones.

While Prysly is still looking for the product at other stores, the extension asks the server for updated offers up to twice (about 8 and 20 seconds after the page opens). That request contains only Prysly's listing number for the product you are viewing.

The extension keeps a copy of the list of supported stores (and how to read their product pages) on your device. When you open a page on a supported store and that copy is more than one hour old, or the server says it is out of date, the extension downloads a fresh list. That request contains no information about you or the pages you view.

When you click a store link in the Prysly card, your browser goes through the Prysly server (/v1/go/…), which records that a click happened for that product listing and store, the time, whether the link was an affiliate link, and whether it was a repeat click on the same listing from the same connection within the hour (so repeats are not counted twice). To tell repeats apart, the server keeps the daily IP code of each click in memory only, for one hour; it is never written to the click record. It does not record who clicked.

At checkout. On a supported store's cart or checkout page, the extension asks the server for that store's coupon codes (it sends only the store's name). If you press "Try them", it tries up to 10 codes, one at a time, in the store's own coupon box, and for each code it sends the code's number, whether it worked, and a cart total range (the cart total, in a band). To find the best rewards card for your cart, it also sends the cart total rounded down to the nearest R50. Nothing else about your cart is sent: no items, names, addresses, card numbers or order details. Coupon auto-try runs only when you click; the extension never types into the store's fields otherwise. Your picked cards (the rewards cards you tell Prysly you hold) and the dates a store is paused for you (Prysly stands down for 30 days at a store after you arrived through someone else's affiliate link) stay on your device, in extension storage, and are never sent to us.

When you click "Get this card", your browser goes through the Prysly server (/v1/card/…), which records the click like a store link click (card programme, time, whether it was a repeat click) and keeps it for 1 year. It does not record who clicked.

4. What the extension never sends

• your name, email address, account details or any other identity information;
• anything about websites other than the 35 stores above, or about store pages that are neither product pages nor cart and checkout pages;
• anything you type into a form, including search terms, addresses, passwords and payment details;
• your cart's items, orders, wish lists or store account information (at checkout it sends only the coupon results and cart total range described above);
• cookies or browsing history.

The extension asks your browser only for the storage permission (used to keep the supported-store list, the pill corner you chose per store, the rewards cards you picked, and the stand-down and last-click times per store, all on your device and never sent) and for access to the eight store websites (and their subdomains) and the Prysly server, https://api-production-e946.up.railway.app. It does not use the cookies, history, tabs or web-request permissions.

5. How your IP address is used

Like any website, the Prysly server sees your internet (IP) address when your browser contacts it. The Prysly service never stores or logs that address; our hosting provider may keep standard request logs under its own terms. Instead, Prysly immediately turns the address into a one-way code: a SHA-256 hash of a fixed secret combined with the current UTC date and the address (for an IPv6 address, only its first half, the network part, so every device on one home connection gets the same code), so the code changes every day. That code is used only to:

• limit how many requests one connection can make per hour, so the service cannot be abused (these counters live in memory for one hour);
• check that an unusual price change was confirmed by two more, different shoppers (or by Prysly reading the store page itself) before it is trusted (an unconfirmed price waits for up to 7 days, then is deleted);
• check that a store listing first reported by the extension was seen by three different shoppers on the same UTC day before other shoppers are shown its price, on stores whose pages Prysly cannot read itself (elsewhere Prysly reads the page itself instead). For this, the new listing keeps the confirmation codes of up to 2 shoppers until the third one confirms it or that day is over;
• count at most one price per shopper per product listing per day, so reloading a page (or reconnecting from another address in the same home or office network) does not count as extra evidence. For this, each price your browser sends is stored with that day's coarser code (see below);
• count how many different shoppers viewed a store's product pages and how many of them hit a page-reading error, so a few connections can't take a store offline. For this, a store's hourly health counts keep the confirmation codes (see below) of up to 50 shoppers in that hour, each with how many of their views worked or failed, for 2 days; and
• count a click on a store link at most once per connection per listing per hour (kept in memory for one hour, never stored); and
• count one coupon report per coupon per shopper per day (the shopper's coarser daily code is kept for 2 days, apart from the report, which carries no code).

For the one-price-per-day rule, for counting different shoppers when they confirm a price or report a change in stock, and in store health counts (the checks above), Prysly uses a second, coarser daily code made the same way, but for an IPv6 address from only its first 48 bits (one customer's whole network), so a single customer can't pose as several shoppers. It is stored with prices sent by the extension, unconfirmed prices, new-listing confirmations, stock reports and store health counts, never on its own.

Because the date is part of the hash, the code from one day does not match the code from another day, and without the secret it cannot be turned back into your IP address. Because Prysly holds the secret, we treat these daily codes as personal information under POPIA.

6. This website

prysly.com is a static website. It sets no cookies, runs no analytics or advertising scripts, and loads nothing from other websites (no web fonts, no content delivery networks, no tracking pixels). Like any web host, our hosting provider may keep standard request logs (such as IP address, browser type and the page requested) under its own terms.

If you email us, we receive your email address and whatever you write. We use it only to answer you or deal with your request, and delete it when it is no longer needed for that, unless the law requires us to keep it.

7. What we store, and for how long

Records the Prysly service keeps, and for how long

Information	Kept for
Products and store listings (title, barcode, model, brand, page address with tracking and search codes removed, latest price and "was" price, whether it is in stock)	As long as the service runs
Price history (price, "was" price, time and, for prices sent by the extension, the coarser daily code)	2 years
Unconfirmed unusual prices, with the daily IP code	Up to 7 days
For a new listing first reported by the extension on a store Prysly cannot read itself: the daily confirmation codes of up to 2 shoppers who reported the same price that UTC day	Deleted when a third shopper confirms the listing, or at the next twice-daily cleanup after that UTC day ends (at most about 36 hours)
For a listing other shoppers are shown: the daily confirmation code of a shopper who reported it back in stock, or who reported it out of stock, that UTC day (one shopper's report alone does not change whether it is shown)	Deleted when a second shopper reports it out of stock, or at the next twice-daily cleanup after that UTC day ends (at most about 36 hours). Back-in-stock reports likewise: deleted when a second shopper reports it back in stock, or at that cleanup
Click records (listing, store, whether the link was an affiliate link, time, whether it was a repeat click)	1 year
Coupon reports (coupon number, whether it worked, cart total range, time). No daily IP code is kept with the report; to count at most one report per coupon per shopper per day, the server keeps a separate one-way daily code for 2 days only, and it is kept apart from the report	180 days (the 2-day codes: 2 days)
Card-referral click records (card programme, time, whether it was a repeat click)	1 year
Store health counts (store, hour, success/failure counts, the confirmation codes of up to 50 shoppers, each with their success/failure counts)	2 days
Emails you send us	Until your request is dealt with, unless the law requires longer

The records kept by the service (all but your emails) contain no user ID, name, email address or IP address, and the time-limited ones are deleted automatically. Within a single UTC day, the daily IP code lets Prysly see which products the same connection reported prices for; that link is kept with the price history for up to 2 years. Prysly also checks product pages itself, directly from the stores, about every 12 hours for products someone viewed in the last 7 days.

8. Why we process it, and your choice

We process this information to run Prysly: to work out price histories and verdicts, to find the same product at other stores, to keep prices honest (confirmation checks), to detect stores whose pages can no longer be read, to stop abuse of the service, and to count clicks on store and card links (including for reconciling affiliate commissions), and to count coupon reports once per shopper per day. We rely on our legitimate interest, and yours as a shopper, in running an accurate and abuse-free price-check service (POPIA section 11(1)(f)), and, where applicable, on your consent when you choose to install the extension (section 11(1)(a)). We collect only what is needed for these purposes (section 10) and do not use it for anything else. We do not use it for direct marketing, profiling or decisions about you.

What section 18 of POPIA asks us to tell you

• Source. Product details come from the store product page you open, read by the extension on your device; the daily code comes from your connection's IP address when your browser contacts our server; other prices come from Prysly's own reads of public store pages; emails come from you.
• Voluntary. Using Prysly is voluntary and needs no account. No law requires you to supply any of this information, and no law requires or authorises us to collect it.
• If you don't supply it. Don't install the extension, or remove it: nothing is sent, and you simply don't get the Prysly price card (the badge) on store pages. Shopping on the stores works exactly as before.
• The rest: who we are (section 1), the purposes (above), recipients (section 11), transfers abroad (section 12), and your rights, including to object and to complain (section 16).

9. Use of AI

Prysly uses an AI model from one provider at a time, either Anthropic (Anthropic, PBC) or OpenAI (OpenAI, L.L.C.), through its API, for three jobs: deciding whether two product listings are the same product, reading a product page when Prysly's normal page reader fails, and reading the written terms of a coupon. The AI only ever receives public product information (titles, brands, model numbers, barcodes and the text of a store's public product page that the Prysly server fetched itself). It never receives anything about you: no IP address or IP code, no identifiers and nothing you typed. For the coupon job, only the description Prysly's owner typed in for the coupon (for example a minimum spend) is sent; it is shown for information and never decides which codes are tried. The provider in use processes these requests in the United States under its API terms.

10. Affiliate links

Some links to stores in the Prysly card are affiliate links. Prysly only uses them when you click a store link in the Prysly card, and never replaces other links. If a store pays Prysly a commission for a purchase after such a click, the price you pay does not change. The store, or its affiliate network, may set its own cookies when you arrive on its site; that is covered by its own privacy policy. See our affiliate disclosure.

Card links in the "Get this card" section of the Prysly card on a product page are affiliate links too. They are labelled as such, only used when you click them, and not shown at a store where Prysly has stood down because you arrived through someone else's affiliate link.

11. Who else processes it

We use these service providers (operators), each bound by its own data-protection terms:

• Railway: runs the Prysly server;
• MongoDB Atlas: stores the records listed in section 7;
• Anthropic (Anthropic, PBC, United States) or OpenAI (OpenAI, L.L.C., United States), one at a time: the AI described in section 9 (public product information, and owner-written coupon descriptions; never anything about you);
• Resend: sends service alerts (for example "a store's pages can't be read") to Prysly's own team; these contain no shopper information;
• our website host and email provider, for the website and emails you send us.

Prysly does not sell or rent any information, and does not share it with advertisers. We may disclose information if the law requires it.

12. Transfers outside South Africa

Our server and database providers host the service in the European Union, and may process information outside South Africa. Where personal information (in practice, the daily IP codes) leaves South Africa, we transfer it only as POPIA section 72 allows, for example to providers bound by agreements or rules that give it protection substantially similar to POPIA. The AI requests in section 9 go to Anthropic, PBC or OpenAI, L.L.C. (one at a time) in the United States under its API terms; they contain public product information and owner-written coupon descriptions only, no personal information.

13. Security

We protect information with reasonable technical and organisational measures (POPIA section 19), including:

• the extension talks to the Prysly server over HTTPS only;
• the Prysly service doesn't store or log IP addresses, only daily one-way codes made with a secret key (our hosting provider may keep standard request logs);
• per-connection rate limits against abuse;
• time-limited records are deleted automatically when their period ends;
• access to the database and hosting accounts is limited to the people who run Prysly.

If we have reason to believe personal information has been accessed by someone without authority, we will notify the Information Regulator and, where we can identify them, the people affected, as section 22 requires.

14. Cookies and local storage

This website sets no cookies. The extension sets no cookies either; it keeps the list of supported stores in your browser's extension storage, config, with when it was downloaded, refreshed when it is more than one hour old; and, only if you move the Prysly pill, pos:<store>: the store's name and a corner; never leaves your device. Neither contains anything about you. Details are on our cookies and storage page.

15. Children

Prysly is a general shopping tool and is not aimed at children. Because it collects no names, accounts or contact details, it does not knowingly process personal information of children (people under 18). If you believe a child has sent us personal information, for example by email, contact us and we will delete it.

16. Your rights

Because Prysly does not know who you are, it normally holds no information that it can link to you. Under POPIA you still have the right to:

• access: ask whether we hold personal information about you, free of charge, and ask for a description of it, who has had access to it and, for records, a copy (section 23). Under section 25, a request for access is made in the manner set out in section 53 of PAIA for private bodies, as described in our PAIA manual;
• correction and deletion: ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that we are no longer authorised to keep (section 24);
• objection: object, on reasonable grounds, to our processing of your personal information (section 11(3)), for example with Form 1 of the POPIA Regulations;
• complain to the Information Regulator (POPIA section 74; see section 17 below).

How to make a request. Email our Information Officer at privacy@prysly.co.za (use the subject "POPIA request") and say what you want. For a correction or deletion you may use Form 2 of the POPIA Regulations (request for correction or deletion of personal information), and for an objection Form 1, but an email is enough. To let us find records linked to you, tell us what to look for: for an email you sent, your email address; for the daily IP codes, your IP address and the dates concerned (we can then compute those days' codes and look them up). We may ask for proof of identity before we disclose or change anything, and will answer within 30 days. You can stop all data collection at any time by removing the extension.

17. Complaints

Please contact us first so we can try to resolve your concern. Under section 74 of POPIA you may also complain to the Information Regulator (South Africa), using its Form 5 (complaint regarding interference with the protection of personal information):

• Website: inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Please check the Regulator's website for its current contact details and complaint forms.

18. Changes

If this policy changes, the new version will be posted on this page with a new effective date. If a change affects how we use information we already hold, we will say so here before it takes effect.

Contact

Questions or requests: privacy@prysly.co.za (privacy@prysly.co.za), or see the contact page.