Privacy Policy

1. Who We Are

Canvass is operated by Codexist Labs, registered in the Republic of South Africa. For the purposes of POPIA, we are the Responsible Party in respect of your personal information.

2. What We Collect

2.1 Information you provide

• Account information: Name and email when you register.
• Payment information: Billing details processed by PayFast or Paystack. We do not store card numbers.
• Communications: Messages you send to our support team.

2.2 Usage data

• Search queries (location, industry, city inputs)
• Generated content (websites and pitch materials from your sessions)
• Usage counts (searches and generations for plan limit enforcement)
• Session data (IP address, browser type, timestamps)

2.3 Third-party business data

When you search, Canvass retrieves publicly available business information from the Google Places API. This relates to businesses, not individuals, and is not stored beyond your active session unless you explicitly save a lead.

3. Why We Process Your Information

4. How Long We Keep Your Information

• Account data: Duration of account + 12 months after closure.
• Payment records: 5 years (SA financial recordkeeping requirements).
• Usage and session logs: 90 days, then deleted or anonymised.
• Support communications: 2 years from last communication.

5. Who We Share Your Information With

We do not sell your personal information. We share only with trusted providers:

6. Your Rights Under POPIA

• Right of Access — Request a copy of your personal information.
• Right to Correction — Request correction of inaccurate data.
• Right to Deletion — Request deletion, subject to legal requirements.
• Right to Object — Object to processing based on legitimate interest.
• Right to Withdraw Consent — Withdraw consent at any time.
• Right to Complain — Lodge a complaint at inforegulator.org.za.

To exercise these rights, contact us at privacy@canvass.co.za. We will respond within 30 days.

7. Security

We implement appropriate technical and organisational measures including encrypted transmission via HTTPS/TLS, secure authentication via Clerk, database access controls, and regular security reviews. In the event of a data breach affecting your rights, we will notify you and the Information Regulator within 72 hours.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email with at least 14 days notice. Continued use after the effective date constitutes acceptance.

9. Contact

If unsatisfied with our response: inforegulator.org.za · inforeg@justice.gov.za · 010 023 5207