Privacy Policy

ComplyMate (https://complymate.co.za) is operated by Thannlab Pty Ltd, a company registered in the Republic of South Africa. ComplyMate provides POPIA compliance assessment tools for South African businesses. For privacy enquiries, contact us at hello@complymate.co.za.

Free assessment (no account): Your quiz answers are processed in your browser and stored temporarily in session storage on your device until you create an account.

Account holders: When you register, we store your email address, name (if provided), assessment answers, scores, and subscription status in our database (Supabase, EU/US hosting per provider terms).

Payments: Card and payment details are processed by Paystack. We receive payment confirmation, transaction references, and billing status, not your full card number.

Feedback: Optional product feedback you submit after an assessment (ratings, feature preferences, comments).

Trust badge: If you enable a ComplyMate badge, we store your company name, website URL, badge settings, and anonymised view analytics (hashed IP, referrer, user agent). Public verification pages display your business name, score, and grade.

Referral links: If you arrive via a shared link with UTM parameters (e.g. utm_source=referral), we may use those tags in aggregate analytics to understand how users find us. We do not sell personal information.

Website usage: We may collect standard analytics data such as pages visited, browser type, and approximate location to improve our service when analytics are enabled.

ComplyMate iOS app: If you use our iOS application, we process the same account and assessment data through an in-app browser (WebView). We may collect your IP address, browser user agent (including ComplyMate/iOS), device type, session timestamps, and security audit events (for example sign-in, sign-out, and account deletion). We do not collect precise location from the iOS app.

Logs and security: We retain short-lived server and security logs (for example authentication outcomes and rate-limit events) without storing passwords, payment card numbers, or full session tokens.

Cookies and authentication: When you sign in, we set secure, HttpOnly session cookies (via Supabase Auth) to keep you logged in. These cookies are scoped to ComplyMate domains, use SameSite=Lax, and are cleared when you sign out or delete your account.

We use personal information to:

• Provide the POPIA compliance assessment and reports
• Communicate with you about your account or purchases
• Send Monitor reminders and regulation updates you subscribed to
• Improve our website and services
• Comply with legal obligations under POPIA and other applicable law

We process personal information based on your consent, contractual necessity (when you purchase services), and our legitimate interest in operating and improving ComplyMate, always in accordance with POPIA.

We do not sell your personal information. We use trusted processors who handle data on our behalf under appropriate agreements, including:

• Supabase: authentication and database hosting
• Paystack: payment processing
• Brevo: transactional email delivery
• Vercel: website and API hosting
• Upstash: API rate limiting metadata (when configured)

Free assessment data in your browser is cleared when you close your tab or retake the assessment. Account and report data are retained while your account is active or as needed to provide the service.

When you delete your account, we remove personal identifiers and assessment records linked to your login. We may retain anonymised or minimum billing records (transaction references, amounts, dates) for tax, accounting, and dispute resolution for up to 5 years, as permitted by POPIA.

Our processors (Supabase, Vercel, Brevo, Paystack) may process data in the European Union, United States, or other regions according to their terms. We use contractual safeguards and processor agreements required by POPIA where personal information is transferred across borders.

You have the right to access, correct, delete, object to processing, and request portability of personal information where technically feasible. You may lodge a complaint with the Information Regulator of South Africa. To exercise your rights, email hello@complymate.co.za or info@complymate.co.za. We aim to respond within 30 days.

ComplyMate is intended for business users aged 18 and over. We do not knowingly collect personal information from children.

We implement appropriate technical and organisational measures to protect personal information. No method of transmission over the internet is 100% secure.

We may update this policy from time to time. Material changes will be posted on this page with an updated date.