Legal

Privacy Policy

Effective date: 24 August 2026 · Version 1.0-draft · Status: draft, pending legal review · Governed by the Protection of Personal Information Act (POPIA), South Africa

This Policy also covers this marketing website (avidara.co.za), in addition to the Avidara platform (app.avidara.co.za) described below.

1. Who we are

Avidara (Pty) Ltd (registration number 2026/260157/07, registered address 6 The Homesteads, Vergesig, Durbanville, Cape Town, Western Cape, 7500, South Africa) ("Avidara", "we") operates the Avidara regulatory compliance review platform at app.avidara.co.za. This Privacy Policy explains what personal information we collect, why, and your rights over it. It applies to everyone who registers for or uses the Service, and forms part of our Terms of Service.

2. Information we collect

2.1 Account information - name, work email, organisation/company name, and password (stored hashed by AWS Cognito, never in plain text). 2.2 Documents you upload - the primary and reference documents you submit for review, and any supporting files. These may contain personal information if you choose to include it (for example, a named contact on a label or a study document). 2.3 Billing information - processed by our payment processor, Paystack. We receive and retain transaction records (amount, date, status) but do not store your full card number. 2.4 Usage and log data - IP address, browser/device information, pages visited, and API usage, collected for security, rate limiting, and abuse prevention. 2.5 Contact form and chat messages on this marketing website (avidara.co.za) - if you submit our contact form, we collect your name, email, company, phone number, subject, and message, and send it directly to our team to respond to your enquiry. If you use the chat assistant on this website, we retain your messages and a hashed (non-reversible) form of your IP address to maintain conversation history and improve our responses.

3. How we use it

• To provide the Service - running reviews, storing your review history, generating reports; • To operate your account - authentication, billing, support, and service communications (e.g. a review-complete notification, which you can opt out of in Settings); • To maintain security - rate limiting, fraud/abuse detection, and access control; • Where you have not opted out, to improve our review checklists using anonymised finding metadata (service type and finding category - never your document text or identity) stored for this purpose for up to 1 year. We do not sell your personal information, and we do not use your uploaded document content to train any AI model.

4. Legal basis for processing

We process your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) on the basis of: performance of a contract (providing the Service you signed up for), your consent (e.g. optional email notifications), and our legitimate interests (security, fraud prevention, and service improvement), balanced against your rights.

5. Who we share it with

5.1 We share personal information only with the sub-processors below, each engaged solely to help provide the Service or operate this website, under contractual data-protection obligations: Platform (app.avidara.co.za): • Amazon Web Services (AWS) - cloud infrastructure: compute, storage, database, authentication, AI inference - eu-west-1 (Ireland); WAF metadata in us-east-1 • PDFShift - HTML-to-PDF report rendering (report findings only, not document text) - EU • AWS SES - transactional email: review-complete notifications, account emails - eu-west-1 (Ireland) • Paystack - payment processing - South Africa This website (avidara.co.za): • Resend - delivers contact form submissions and new-chat alerts to our team by email • Upstash - short-lived IP-based rate limiting for the contact form, and storage of chat conversation history (see clause 7) 5.2 We do not sell or rent personal information to third parties, and we disclose it beyond this list only where required by law or with your consent.

6. Where your data is processed

Your data is processed and stored in AWS's eu-west-1 (Ireland) region. We chose this region specifically for EU data residency and because it does not leave AWS's infrastructure. Where data is transferred outside South Africa (e.g. to our EU infrastructure), we rely on the adequacy and contractual safeguards required under POPIA.

7. How long we keep it

• Uploaded documents - auto-deleted 90 days after upload, or sooner on request • Review records (findings only, not document text) - kept for your Review History until you request deletion or close your account • Account data - until account deletion • Billing records - 5 years (financial record-keeping obligations) • Chat conversations on this website - retained for up to 180 days • Contact form rate-limiting data - a short-lived IP-based counter, cleared automatically within hours Backups may retain deleted data for up to 35 days as a technical maximum. If you request deletion, we process it within 30 days and confirm in writing.

8. How we protect it

Technical and organisational measures include: encryption at rest (AES-256 / AWS-managed KMS) and in transit (TLS 1.2+); authentication via AWS Cognito with optional MFA; hashed API keys, never stored or shown after creation; least-privilege AWS IAM roles with no long-lived credentials; a Web Application Firewall and rate limiting in front of the platform; and isolated, serverless compute (no shared server access between customers).

9. Your rights

Under POPIA, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion; object to processing based on legitimate interest; and lodge a complaint with the Information Regulator of South Africa. To exercise any of these rights, contact our Information Officer at hello@avidara.co.za.

10. Cookies

We use a session cookie on the Avidara platform (app.avidara.co.za) strictly to keep you signed in. This marketing website (avidara.co.za) does not set cookies of its own; page-view analytics here are collected without cookies. We do not use third-party advertising or tracking cookies on either site.

11. Children

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or an in-app notice before they take effect.

13. Contact

Questions or requests: hello@avidara.co.za