Privacy policy

Who we are

Komply is a product of Auto Alpha Advisory, registered in South Africa. The responsible party for personal information collected via getkomply.co.za is Auto Alpha Advisory, contactable at hello@getkomply.co.za.

What we collect

• Account data: work email, company name, your role within the workspace.
• Workspace data: the public domain you ask us to scan, and the scan results that the audit engine produces against it. For the FSCA module, the fit-and-proper data for your key individuals and representatives (full name, last four digits of ID number, qualification + CPD records). For the B-BBEE module, the workforce composition required to score the scorecard (race and gender breakdowns), processed under the lawful basis provided by the B-BBEE Act and Codes of Good Practice (POPIA s27(1)(b)). For the SARS module, your VAT and payroll figures plus, optionally, Xero OAuth credentials encrypted at the application layer.
• Billing data: handled by PayFast — we receive payment confirmations, never card numbers.
• Operational logs: request identifier, tenant identifier, IP address, browser user-agent, and (for billing events) payment status and amount. We retain these for 12 months for abuse investigation and audit-trail continuity. No tracking cookies. On our public marketing pages only (never inside the signed-in dashboard), we use a privacy-first, cookieless analytics tool — Umami, self-hosted by Auto Alpha Advisory — to measure aggregate page views and page performance. It sets no cookies, builds no cross-site profile, and does not run on authenticated pages.
• Waitlist and share-link access logs: When you join our waitlist or someone views a share link you issued, we record the IP address, user-agent, and timestamp to investigate abuse and to give you a view-audit trail. Retention 12 months.

How we use it

To operate your workspace, run scans against the domain you nominate, send transactional email (sign-in links, monthly digest), bill you for the subscription, and meet our legal obligations. We don't sell personal information or share it with advertising networks.

Our lawful basis. We process your account, workspace, billing, and operational data because it is necessary to perform the subscription contract with you (POPIA s11(1)(b)) and to meet legal obligations such as tax-record retention (s11(1)(c)). B-BBEE workforce-composition data is processed under the basis provided by the B-BBEE Act and Codes of Good Practice (s27(1)(b)). LLM-assisted drafting and certificate extraction run only where you opt in (s11(1)(a) consent). Providing this information is voluntary, but it is required to operate your workspace — without it we cannot run the scans. Company-registry details (registration status, director roster) are sourced from CIPC at onboarding using the registration number you provide.

Where you opt in to LLM-assisted drafting (currently used inside the FSCA module for ICMP report and Ombud-response narrative generation), we send a redacted version of the structured data to Anthropic in the United States. Names of individuals are replaced with initials and personal identifiers (ID numbers, contact details) are stripped before transmission. The drafted text is returned for your review and sign-off before any submission.

Where you upload a B-BBEE certificate for automated field extraction, the uploaded document is sent to Anthropic in the United States for processing. The document is your own data and is transmitted unredacted because the document content is required for extraction. No fields are applied to your scorecard without your per-field confirmation.

Direct marketing

The monthly compliance digest we send to subscribers is transactional — it reports on your own workspace and the scans you asked us to run, as part of the service you signed up for, not direct marketing. We don't sell or rent your contact details. If we ever send genuine marketing email (product news or offers), it will be on an opt-in basis and every such message will carry a one-click unsubscribe, in line with POPIA s69. You can opt out of non-essential email at any time via the unsubscribe link or by emailing io@getkomply.co.za.

Where it lives

Application data is stored in Supabase Postgres (eu-west-1, Ireland) with tenant-scoped access controls enforced at the application layer plus Row-Level Security policies as defense in depth. Scan results are mirrored in Komply's database so the dashboard doesn't depend on the audit engine for read traffic. Transactional email is sent via Resend. Billing is handled by PayFast (Pty) Ltd in South Africa. LLM processing is handled by Anthropic in the United States under contractual safeguards and the zero-data-retention tier — redacted prompts for FSCA narrative drafting and uploaded B-BBEE certificate content for field extraction. See the Data Processing Agreement for the full sub-processor list and our cross-border-transfer basis.

Information Officer

POPIA s55 requires every responsible party to designate an Information Officer. Komply's Information Officer is Matt Owen, contactable at io@getkomply.co.za. Registration with the Information Regulator is pending; the registration number will appear here once issued.

How long we keep it

Account data: for the lifetime of the subscription plus 12 months after cancellation, then deleted on request or as part of our monthly retention sweep — including your sign-in account and profile once your workspace has been removed. Scan data: for the lifetime of the subscription. Billing records: 5 years per SA tax retention rules.

Data breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, POPIA s22 requires us to notify both the Information Regulator and you as the affected data subject as soon as reasonably possible after we become aware of the compromise. Our notification will describe, to the extent known, the nature of the compromise, the information involved, the likely consequences, and the measures we have taken or propose to take to address it and to help you protect yourself. We may delay notifying you only if a law-enforcement authority or the Regulator informs us that notification would impede a criminal investigation. We maintain an internal incident-response process so a compromise is contained, assessed, and reported without undue delay.

Your rights

POPIA gives you the following rights over your personal information:

• To be notified (s18) — that we are collecting your information, and the source where it is collected other than from you.
• Of access (s23) — to ask what personal information we hold about you and to request a copy.
• To correction or deletion (s24) — to have inaccurate, irrelevant, excessive, or outdated information corrected or deleted, and to have information we no longer have authority to retain destroyed.
• To object (s11(3)) — to object, on reasonable grounds, to the processing of your information.
• To object to electronic direct marketing (s69) — to withdraw consent to marketing email at any time via the unsubscribe link in every message or by emailing our Information Officer.
• Not to be subject to a decision based solely on automated processing (s71) that has legal or similarly significant effects for you. Komply's compliance scoring is decision-support for you and your advisers — it is not a solely-automated decision of this kind.
• To complain (s74) — to lodge a complaint with the Information Regulator.

To exercise any of these, email our Information Officer at io@getkomply.co.za; we acknowledge requests within 3 business days and respond in full within 30 days. You can lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Updates

We'll surface material changes in-app and via email at least 14 days before they take effect. The version date at the top of this page reflects the most recent change.