Scrapflow Privacy Notice

1. Responsible party vs operator

Scrapflow is operated by DS Technologie, 27 Dinghy Road. Privacy and POPIA enquiries may be sent to dsdigitalia@gmail.com.

• Workspace & account administration: DS Technologie is the responsible party for workspace owner/staff login accounts, security logs, legal acceptances and billing records.
• Yard trading records: Each scrap yard is the responsible party for personal information it records about its suppliers, customers, drivers and transactions; DS Technologie acts as operator under POPIA section 20–21 solely to host and run the workspace for that yard.

2. Information we process and why

• Account & authentication data: Name, email, optional phone, bcrypt password hash (cost 12), AES-256-GCM encrypted TOTP secret, hashed recovery codes, session hashes, sign-in IP/user agent, and Terms/Privacy acceptance timestamps to secure and administer your workspace.
• Yard operational data (as operator for the yard): Suppliers, customers, materials, weighbridge tickets, purchases, sales, controlled-metals seller declarations, optional ticket photos, WhatsApp consent records and audit logs entered by authorised yard staff.
• Transactional emails: Verification links, password resets, staff invitations and customer-requested ticket receipts delivered via Resend. No advertising or marketing trackers are used.
• What we do not collect: We store no payment card numbers or CVVs, set no advertising or third-party analytics cookies (only an essential HTTP-only session cookie), and perform no AI training on your business records.

3. Infrastructure & cross-border hosting

To run Scrapflow reliably, data is processed by vetted infrastructure sub-processors under encrypted transport (TLS): Vercel (application hosting and private Blob storage when enabled), Supabase (PostgreSQL database and automated backups, EU West Ireland), and Resend (transactional email delivery). Data is therefore stored and processed outside South Africa in jurisdictions with contractual and technical safeguards aligned with POPIA section 72.

4. Security safeguards

Every workspace query is tenant-isolated by organisation ID on the server. Passwords are stored only as bcrypt hashes; two-factor authentication is enforced across roles; sensitive integration and MFA secrets are encrypted at rest; ticket photo URLs are short-lived signed capability URLs; and account-sensitive actions require fresh step-up verification.

5. Retention & your POPIA rights

Workspace records are retained while your subscription is active and remain accessible in read-only mode when a trial or billing period expires so you can export statutory and accounting records. Workspace owners may request workspace deletion or exercise POPIA access, correction and objection rights by contacting dsdigitalia@gmail.com. Suppliers or customers of an individual scrap yard should direct requests about yard tickets to that yard first. You also have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za / complaints@inforegulator.org.za.