Privacy Policy (POPIA)

Legal entity: AFRILENS INTELLIGENCE (reg. no. 2025/473823/07)
Registered address: 21 Woodlands Office Park, Woodmead
Contact: [email protected]
Last updated: [DATE – confirm]

This policy explains how AfriLens Intelligence (“AfriLens”, “we”) processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). We are the responsible party.

1. Information we collect

At checkout and for subscriptions

Name, email address, billing country and, where provided, company name.
Order and subscription details: products bought, licence type, subscription start and renewal dates, currency, amount, transaction reference.
Card and payment data are entered directly with our payment provider [payment provider – Payfast or Gumroad, confirm; see CHECKOUT.md]. We do not receive or store full card numbers.

Rapid Scan orders (when ordering opens)

Work email, company (for the invoice), the scope you describe and any public documents you upload, and your acceptance of the Terms.

Corrections

The correction you report and, if you give it, your email address so we can send a report credit.

Briefing, executive summary and “Notify me” sign-ups

Email address, optional company, the sectors you choose, the page and form where you signed up, campaign parameters in the link you followed (utm), the title you asked about, and your consent record (date, time, wording version). Sign-ups are confirmed by double opt-in; unconfirmed sign-ups are deleted after 7 days.
A first-party cookie (al_sub) set after you confirm, so we stop showing you sign-up prompts, and a local-storage note when you close a prompt.

Automatically

Technical data such as IP address, browser type and request logs processed by our hosting and security provider (Cloudflare). We store your currency preference in your browser's local storage. [Analytics: none at present – confirm before publishing.]

2. Purposes and lawful basis

To process orders and subscriptions, deliver download links, issue invoices and enforce licences (performance of a contract).
To check the scope of and deliver Rapid Scan orders, and to handle corrections you report (your request / performance of a contract).
To keep tax and accounting records (legal obligation).
To secure the site and prevent spam and fraud (legitimate interest).
Direct marketing by email (free briefs, newsletter, offers) only with your opt-in consent, or to existing customers about similar products as section 69 of POPIA allows. Every message has an unsubscribe link and you can withdraw consent at any time. Consent is never a condition of buying.

3. Operators (processors)

We share personal information only with the third-party operators below, and only as needed for the purposes in section 2:

Gumroad: payments and digital delivery of reports. [Gumroad may act as merchant of record and process buyer data under its own terms – confirm.]
Payfast (planned): payment processing for South African buyers.
Cloudflare: website hosting, security, file storage (R2) for download links, .
Resend: transactional email delivery, including download emails.
Kit: briefing list, double opt-in, email preferences and one-click unsubscribe.
Cloud and software processors, including AI tools: services we use to gather, organise and prepare research. We do not send customer personal information to these providers except where needed for a Rapid Scan order you place [confirm].

4. Cross-border transfers (POPIA section 72)

Some of these operators, or their servers, may be located outside South Africa (for example in the United States or the European Union). We transfer personal information to a third party outside South Africa only where:

the recipient is subject to a law, binding corporate rules or a binding agreement that provides a level of protection substantially similar to POPIA, including principles for further transfers; or
you consent to the transfer; or
the transfer is necessary to perform a contract with you, or to take steps you requested before entering into one.

Safeguards. We choose operators that publish data protection terms (such as data processing agreements or standard contractual clauses), use encryption in transit, limit the personal information shared to what each service needs, and review operators' terms before use. [Confirm each operator's processing locations and agreements.]

5. Retention

Order, subscription, deposit and invoice records: at least 5 years, as tax law requires [confirm period].
Unconfirmed sign-ups: deleted after 7 days.
Marketing list: until you unsubscribe; we keep a minimal suppression record so we do not email you again.
Server and security logs: [per Cloudflare default – confirm].

After that we delete, destroy or de-identify the data.

6. Security

We apply reasonable technical and organisational measures, including encrypted transport (HTTPS), access controls, signed time-limited download links, and confidential processing of documents supplied with an order, used only for that order.

7. Your rights

You may ask to access, correct or delete your personal information; object to processing; withdraw consent; and opt out of direct marketing. Email [email protected]. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.

8. Information Officer

Information Officer, [email protected].

9. Changes

We will post updates on this page with a new “last updated” date.