Legal

Privacy policy

Effective 26 May 2026 · Last updated 10 November 2026

Who we are

Komply is a product of Auto Alpha Advisory (Pty) Ltd (registration number 2025/213512/07), trading as Komply. The responsible party for personal information collected via getkomply.co.za is Auto Alpha Advisory (Pty) Ltd.

Address: 96 New Church Street, Gardens, Cape Town, 8001
Telephone: 084 584 1849
Email: hello@getkomply.co.za

What we collect

Account data: work email, company name, your role within the workspace, and your sign-in and two-factor records, and the email address of anyone you invite. If you set up a calendar feed, we store a one-way scrambled copy (a hash) of its private link rather than the link itself; the link can appear in our hosts' request logs when your calendar fetches it.
Website scans: the public domain you ask us to scan, and the scan results that the audit engine produces against it. A result can include personal information that your own website shows.
FSCA module: the fit-and-proper data for your key individuals and representatives (full name, email address, last four digits of ID number, qualification + CPD records), and your compliance officer's name and email address. From the registers you keep in Komply, we also hold each complainant's name and the details of the complaint, the people or firms named in a conflict-of-interest disclosure, and your summaries of cyber incidents. To check a new hire against it, Komply can keep a copy of the FSCA's public register of debarred persons, with each person's full name and the last four digits of their ID number.
B-BBEE module: the workforce composition required to score the scorecard (race and gender breakdowns), processed under the lawful basis provided by the B-BBEE Act and Codes of Good Practice (POPIA s27(1)(b)), and the names of the people and companies in your ownership chain.
POPIA module: your Information Officer's name and email address.
SARS module: your VAT and payroll figures plus, optionally, Xero OAuth credentials encrypted at the application layer. For an EMP501, Komply keeps what its checks need from each IRP5: the employee's income tax and employee numbers, the certificate number, its amounts and source codes, and each check's result with an age band (under 65, 65 to 74, or 75 or older) worked out from the date of birth, which it doesn't keep. The return keeps no names, ID numbers, addresses or bank details. If you file the e@syFile export through the filing tray, the file itself, which holds them, stays in the tray until an EMP501 is saved from it, or for 90 days after you uploaded it, whichever comes first. With Xero connected, Komply also asks Xero for the contacts of the suppliers on each VAT period's purchases and uses only their VAT numbers, to check the VAT201's evidence. It keeps none of the contact details: only how many purchases lack a number and, for up to five of them, the purchase's number and the supplier's name.
Tender Readiness: the dates and reference numbers of your UIF declarations, returns of earnings and Employment Equity reports, and any receipt or acknowledgement you attach. An attached file can name your employees and their earnings; it is stored privately for your workspace and never shown on a buyer's share link.
The filing tray: any document you drop into it. A document can name people; how long it stays is set out under How long we keep it, below.
Billing data: handled by PayFast — we receive payment confirmations, never card numbers.
Hosting logs: our hosts, Vercel and Supabase, log each request to Komply, with its IP address and browser details, to run and secure the service. Each host sets how long it keeps these logs; Komply does not.
Model-call records: for each call Komply makes to an AI model, we record which feature made it, the model and the number of tokens used. We don't record the text sent. We keep these records for 12 months.
Website analytics: no tracking cookies. On our public marketing pages only (never inside the signed-in dashboard), we use a privacy-first, cookieless analytics tool — Umami, which we run ourselves on a DigitalOcean server in Amsterdam, at analytics.mattsvault.xyz — to measure aggregate page views and page performance. It sets no cookies, builds no cross-site profile, and does not run on authenticated pages.
Waitlist and share-link access logs: When you join our waitlist or someone views a share link you issued, we record the IP address, user-agent, and timestamp (and, for a waitlist sign-up, the page you came from and which free tool you used, which also tell us where sign-ups come from) to investigate abuse and to show you how often each link is opened. You see the count and the time of the latest view, but not the IP addresses. We keep these records for 12 months. Each waitlist, contact or pilot sign-up also sends us an email alert. Resend, our email provider, keeps that message for 30 days, and the copy in our mailbox stays until we delete it.
Partner referral codes: If you arrive through a Komply partner's link, your browser stores that partner's code (not a cookie, and nothing about you) for 90 days. It is shown to you, and you can clear it, in the referral field when you set up a workspace, and it is sent with any signup form you submit, so we can credit the partner. We keep it on your workspace record.

How we use it

To operate your workspace, run scans against the domain you nominate, send transactional email (sign-in links, monthly digest), bill you for the subscription, and meet our legal obligations. We don't sell personal information or share it with advertising networks.

Our lawful basis. We process your account, workspace, billing, and operational data because it is necessary to perform the subscription contract with you (POPIA s11(1)(b)) and to meet legal obligations such as tax-record retention (s11(1)(c)). B-BBEE workforce-composition data is processed under the basis provided by the B-BBEE Act and Codes of Good Practice (s27(1)(b)). Certificate extraction runs when you upload a certificate for it, and policy tailoring when you generate a conflict-of-interest policy. Providing this information is voluntary, but it is required to operate your workspace — without it we cannot run the scans. We store the company registration number you provide. Komply can look up company-registry details (registration status, director roster) at CIPC from that number, but the lookup is not switched on yet, so nothing is sent to CIPC today.

When you generate a conflict-of-interest policy in the FSCA module, Komply may send parts of the policy's template text to Anthropic (see Who receives it, below) to tailor the wording to your firm, with your FSP's registered name, FSP number and main category, and how many conflict-of-interest disclosures you have recorded, by status and by type. Key individuals' and representatives' names are replaced with initials before it is sent; your registered name is sent as it is. A guard rejects any rewrite that changes a template sentence or adds a law, and you review and sign off the policy before it is used. The ICMP report and Ombud responses are built from your registers; no model writes them.

Where you upload a B-BBEE certificate for automated field extraction, or file a document that Komply recognises as your B-BBEE certificate or affidavit, or that you tell Komply is one, the document is sent to Anthropic for processing (see Who receives it, below). Komply checks a filed document on its own servers before anything is sent. The document is your own data and is transmitted unredacted because the document content is required for extraction. No fields are applied to your scorecard without your per-field confirmation.

Where you file a document and tell Komply it is your FSP licence, the file is sent as filed to Anthropic (see Who receives it, below), to read your FSP number, FSP name, category, products and licence date. Komply keeps those values only when the licence names your workspace, and none is saved until you check it in your FSCA set-up or FSP profile and save.

Direct marketing

The monthly compliance digest we send to subscribers is transactional — it reports on your own workspace and the scans you asked us to run, as part of the service you signed up for, not direct marketing. We don't sell or rent your contact details. If we ever send genuine marketing email (product news or offers), it will be on an opt-in basis and every such message will carry a one-click unsubscribe, in line with POPIA s69. You can opt out of non-essential email at any time via the unsubscribe link or by emailing io@getkomply.co.za.

Who receives it, and where

Application data is stored in Supabase Postgres (eu-west-1, Ireland) with tenant-scoped access controls enforced at the application layer plus Row-Level Security policies as defense in depth. Scan results are mirrored in Komply's database so the dashboard doesn't depend on the audit engine for read traffic.

These services receive personal information from Komply. The Data Processing Agreement has the same list, with our basis for sending information outside South Africa.

Supabase: our database, sign-in and file storage, in Ireland.
Vercel: hosts Komply. Our server functions run in Frankfurt, Germany, and a visitor's request first reaches Vercel's network at the point nearest them. Vercel is a US company with its main processing facilities in the United States, and it may process Komply's data wherever it or its subprocessors operate.
DigitalOcean: runs the server in Amsterdam, the Netherlands, that hosts our website-scanning engine and our analytics. DigitalOcean is a US company.
Resend: sends Komply's email, from the United States.
Google Workspace: Email you send to hello@ or io@getkomply.co.za is delivered to our Google Workspace mailbox. Google may process it in any country where Google or its subprocessors have facilities.
Anthropic: a US AI company. It reads the B-BBEE certificates and FSP licences described above, which Komply sends whole, and tailors the wording of a conflict-of-interest policy, with key individuals' and representatives' names cut to initials. Anthropic stores what Komply sends in the United States. Komply does not limit where Anthropic's model runs, so the model may process it in other countries. Anthropic deletes what Komply sends within 30 days, unless the law requires it to keep it longer or it flags a request as breaking its usage policy, when it may keep the request for up to 2 years and the safety classification scores for it for up to 7 years. Where its contract with Komply allows, it may also anonymise the data and keep it longer, for research or statistics. Komply has no zero-data-retention agreement with Anthropic.
PayFast: billing, in South Africa.
Sentry: not in use yet; it receives nothing before 24 November 2026. It will then receive Komply's error reports, which describe what failed and can include details of the page or request. Komply will remove the personal information it can identify before sending a report, and will set Sentry not to store IP addresses; Sentry still works out an approximate location from the internet address a report comes from. Sentry stores the reports in Frankfurt, Germany, and Sentry, a US company, can access them.
CIPC: Komply can look up company-registry details there, but the lookup is not switched on, so nothing is sent to CIPC today.

Information Officer

Komply's Information Officer is Matt Owen, registered with the Information Regulator on 30 September 2026 as the Information Officer of Auto Alpha Advisory (Pty) Ltd. The Information Officer's registered email address is hello@autoalphaadvisory.co.za; you can also write to io@getkomply.co.za, which reaches the same person.

How long we keep it

Account data: for the lifetime of the subscription plus 12 months after you close your workspace, then deleted on request or as part of our monthly retention sweep — including your sign-in account and profile once your workspace has been removed. Files you uploaded (B-BBEE certificates and employer-record receipts) are deleted on request, because automatic deletion of stored files is not yet switched on. Scan data: for the lifetime of the subscription. Billing records, including each payment's status and amount: 5 years per SA tax retention rules.

Documents waiting in the filing tray are deleted 90 days after upload unless Komply has filed them.

We keep an invitation's email address until 90 days after it is revoked or expires, then delete it in our next monthly retention sweep.

Data breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, POPIA s22 requires us to notify both the Information Regulator and you as the affected data subject as soon as reasonably possible after we become aware of the compromise. Our notification will describe, to the extent known, the nature of the compromise, the information involved, the likely consequences, and the measures we have taken or propose to take to address it and to help you protect yourself. We may delay notifying you only if a law-enforcement authority or the Regulator informs us that notification would impede a criminal investigation. We maintain an internal incident-response process so a compromise is contained, assessed, and reported without undue delay.

Your rights

POPIA gives you the following rights over your personal information:

To be notified (s18) — that we are collecting your information, and the source where it is collected other than from you.
Of access (s23) — to ask what personal information we hold about you and to request a copy.
To correction or deletion (s24) — to have inaccurate, irrelevant, excessive, or outdated information corrected or deleted, and to have information we no longer have authority to retain destroyed.
To object (s11(3)) — to object, on reasonable grounds, to the processing of your information.
To object to electronic direct marketing (s69) — to withdraw consent to marketing email at any time via the unsubscribe link in every message or by emailing our Information Officer.
Not to be subject to a decision based solely on automated processing (s71) that has legal or similarly significant effects for you. Komply's compliance scoring is decision-support for you and your advisers — it is not a solely-automated decision of this kind.
To complain (s74) — to lodge a complaint with the Information Regulator.

To exercise any of these, email our Information Officer at io@getkomply.co.za; we acknowledge requests within 3 business days and respond in full within 30 days.

You can complain to the Information Regulator of South Africa. It asks for complaints on its Form 5, sent to the POPIA complaints address below.

POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Phone: 010 023 5200
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Website: inforegulator.org.za

Updates

Before we change how we use your personal information, or add or replace a service that receives it, we publish the change on this page at least 14 days before it takes effect, and email each workspace owner once Komply has paying customers. The date at the top of this page is the date of its latest change.