Privacy Policy

1. Introduction

VisionZeroAI (Pty) Ltd ("VisionZeroAI", "we", "us", or "our") operates Signal, a cybersecurity vulnerability intelligence platform available at app.visionzero.co.za, supported by the marketing website at visionzero.co.za.

This Privacy Policy describes what personal information we collect, how we use it, who we share it with, and what rights you have. We are committed to handling your information responsibly and in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).

By creating an account or using Signal, you agree to the practices described in this Privacy Policy.

2. What We Collect

We collect information you provide directly, information generated by your use of Signal, and limited technical information required to operate the platform.

Account Information

When you create a Signal account, we collect your email address, a hashed password (we never store plain-text passwords), your name if you choose to provide it, and your account preferences and settings.

Authentication & Session Data

Signal uses Supabase for authentication and database infrastructure. We collect and store session tokens, login timestamps, device and browser information associated with active sessions, and password reset requests. This data is used to secure your account and to allow you to manage active sessions from the Session Management dashboard. API keys issued through Signal are also managed as part of your account credentials.

Technology Stack Data

Signal's core function is to match vulnerabilities against your technology environment. To do this, we store the vendors and products you add to your technology stack, your environment names and configurations (e.g., Production, Staging, Development), environment lifecycle state, and stack configuration changes. This data is used exclusively to provide the vulnerability intelligence service.

Billing Information

Subscription payments are processed by PayFast, a South African payment processor. We do not store your card number, CVV, or bank account details. We do store your subscription plan and billing cycle, payment status and transaction references, and billing history for your account. All transactions are processed in South African Rand (ZAR).

Analytics

The Signal marketing website uses Plausible Analytics, a privacy-focused tool that does not use cookies, does not track individual users across sessions, and does not collect personal data. It provides aggregate, anonymised traffic statistics only. The Signal application does not currently use third-party analytics tools.

Usage Data

When you use Signal, we collect limited technical information to operate and improve the platform, including pages and features accessed, error logs, and API request counts for rate limiting. This usage data is linked to your account for service operation purposes and is not used for advertising or profiling.

3. Lawful Basis for Processing

Under POPIA (Section 11), personal information may only be processed on a lawful basis. Here is how that applies to Signal.

We process your account information, session data, technology stack data, and billing records because this processing is necessary to perform our contract with you — without it, we cannot provide the service. Billing records are also retained to meet our legal obligations under South African tax and financial regulations.

We process usage data, rate-limiting information, and security monitoring data on the basis of our legitimate interest in operating a secure and reliable platform. This includes preventing abuse, detecting fraud, and improving Signal's performance. We do not use this data for advertising or profiling.

We do not rely on consent as the primary basis for processing. Where we do rely on consent for a specific activity, we will ask for it explicitly, and you may withdraw it at any time by contacting us.

4. How We Use It

We use the information we collect to:

• Provide the service: Match vulnerabilities against your technology stack, generate your environment threat feed, and deliver prioritised intelligence.
• Manage your account: Create and maintain your account, authenticate your identity, and manage your sessions.
• Process billing: Handle payments, manage your subscription, and maintain billing records.
• Secure the platform: Detect and prevent unauthorised access, abuse, and fraud.
• Improve Signal: Understand how the platform is used in aggregate to improve features and performance.
• Communicate with you: Send transactional emails such as account confirmations, password resets, and billing notifications. We do not send unsolicited marketing emails. If we introduce marketing communications in the future, you will have the right to opt out at any time.
• Comply with the law: Meet our obligations under applicable South African law.

We do not use your data for advertising, profiling, or any purpose unrelated to operating Signal.

5. Who We Share It With

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances.

Service Providers

Signal uses a small number of trusted third-party providers to operate the platform. These providers act as operators under POPIA and are contractually required to protect your data. We use Supabase for authentication, database, and hosting infrastructure; PayFast for subscription billing and payment processing; and Plausible Analytics for anonymised, cookie-free website traffic statistics. No personal data is shared with Plausible. Links to each provider's privacy policy are available on request.

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of VisionZeroAI, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service.

Account and profile data is retained while your account is active and deleted within 30 days of account closure, unless retention is required by law. Technology stack and environment data is retained while your account is active — you can delete environments and stack entries at any time from within the platform. Billing records are retained for 5 years in accordance with South African tax and financial regulations. Session and authentication logs are retained for 90 days for security purposes, then deleted. Usage and rate-limiting data is retained for 90 days, then aggregated or deleted.

When you close your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These measures include encrypted data transmission using HTTPS/TLS, hashed password storage (plain-text passwords are never stored), row-level security policies on the database, and session management controls accessible from your account dashboard.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. If you become aware of any security concern related to your account, please contact us immediately at info@visionzero.co.za.

8. International Transfers

VisionZeroAI is a South African company. However, our infrastructure provider, Supabase, operates servers in the United States and/or European Union member states. Your data may be processed in these regions as part of delivering the service.

These transfers are necessary for the performance of our contract with you (POPIA Section 72(1)(b)). Supabase maintains data processing agreements and standard contractual protections for cross-border data transfers. Payment data processed by PayFast remains within South Africa, as PayFast is a South African entity.

9. Your Rights

Under the Protection of Personal Information Act 4 of 2013 (POPIA), you have meaningful rights over your personal data. You can request a copy of the information we hold about you, and you can update your account details directly within Signal or ask us to correct any inaccuracies. You can request deletion of your account and associated data at any time — some data may be retained where required by law. Where we rely on legitimate interest as the basis for processing, you can object to that processing. You also have the right to object to decisions made solely by automated means that significantly affect you (POPIA Section 71). Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, contact our Information Officer at info@visionzero.co.za. We will respond within a reasonable timeframe and in accordance with POPIA. You also have the right to lodge a complaint with the Information Regulator of South Africa at justice.gov.za/inforeg.

10. Contact & Information Officer

VisionZeroAI has designated an Information Officer as required by POPIA. The Information Officer is responsible for ensuring our compliance with POPIA and handling data subject requests.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email.

Your continued use of Signal after any changes constitutes acceptance of the updated policy. If you have questions about any changes, please contact us at info@visionzero.co.za.