Privacy Policy

2. What We Collect

We collect and process the following categories of personal information:

• Account information: Name, email address, and password hash
• Organisation details: Company name, registration number, industry, employee count
• Assessment data: Answers to compliance assessment questions and resulting compliance scores
• Documents: Generated compliance documents (privacy policies, PAIA manuals, data registers)
• DSAR records: Data subject access request tracking information
• Breach records: Breach incident details and response timelines
• Billing information: Payment references and subscription status (processed via PayStack — we do not store card numbers)

3. Why We Process Your Information

We process your personal information for the following purposes:

• Delivering and maintaining the Talynth compliance platform
• Processing payments and managing your subscription
• Communicating with you about your account, service updates, and support requests
• Improving our product through aggregated, anonymised usage analytics
• Meeting our legal and regulatory obligations

4. Legal Basis for Processing

We rely on the following legal grounds under POPIA Section 11:

• Consent: Provided when you create your account and agree to these terms
• Contract performance: Necessary to deliver the services you have subscribed to
• Legal obligation: Retention of financial records as required by the Tax Administration Act

5. Third-Party Service Providers

We share personal information with the following operators who process data on our behalf:

6. Cross-Border Transfers

We do not transfer your personal information outside of South Africa. All data is stored and processed within the AWS Cape Town region (af-south-1) and our third-party providers operate within South African borders.

7. Data Retention

We retain your personal information according to the following schedule:

• Active accounts: Data retained for the duration of your subscription
• Deleted accounts: All personal data permanently deleted within 90 days of account closure
• Financial records: Retained for 7 years as required by the Tax Administration Act

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption at rest and in transit (AES-256, TLS 1.3)
• Multi-factor authentication (MFA) for administrative access
• Role-based access control (RBAC)
• Regular automated backups
• VPC network isolation with private subnets
• Regular security assessments and monitoring

9. Your Rights

Under POPIA, you have the right to:

• Access: Request confirmation of what personal information we hold about you
• Correction: Request correction or deletion of inaccurate information
• Deletion: Request destruction of your personal information
• Objection: Object to the processing of your personal information
• Portability: Export your data in a machine-readable format
• Withdraw consent: Withdraw your consent at any time (this does not affect the lawfulness of processing prior to withdrawal)

To exercise any of these rights, contact us at io@stratumlabs.tech.

10. Cookies

We use only essential session cookies required for authentication (NextAuth session management). We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

11. Children

Talynth is a business compliance platform and is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated to you via email at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when this policy was most recently revised.

13. Contact & Complaints

For any privacy-related queries or to exercise your rights:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator: