Privacy Policy

1. Who We Are

Chuply (Pty) Ltd ("Chuply", "we", "our", "us") operates the Chuply Ops platform at ops.chuply.com. We are the responsible party as defined under the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Privacy Policy describes what personal information we collect, why we collect it, how we use and protect it, and what rights you have under POPIA.

2. Personal Information We Collect

2.1 Account information

• Full name and email address (required to create an account)
• Phone number (optional, used for contact and field personnel features)
• Company name, address, VAT number (for document generation and billing)
• Banking details (for invoice and payment features — stored in your account, not used by Chuply for charging you)

2.2 Operational data

• Data you input into the platform (customers, work cards, invoices, stock items, etc.) — this is your business data and remains yours
• Your clients' personal information that you upload (names, emails, phone numbers, addresses) — you are the responsible party for this data under POPIA

2.3 Technical data

• IP address and browser/device information (for security and troubleshooting)
• Session data and authentication tokens (to keep you logged in)
• Platform usage logs (to improve the Service and diagnose issues)

3. Why We Process Your Personal Information

We process your personal information on the following lawful bases under POPIA:

• Contractual necessity: to create and manage your account, deliver the Service you subscribed to, and process your subscription
• Legitimate interest: to provide technical support, improve the platform, detect fraud, and maintain security
• Legal obligation: to comply with South African tax and financial reporting requirements
• Consent: for optional communications such as product updates and newsletters (you can withdraw consent at any time)

4. Support Access and Internal Data Access

Authorised Chuply support staff may access your account information when necessary to provide technical support, investigate bugs, or fulfil legal obligations. This is covered by the contractual relationship established when you accepted our Terms of Service.

All access by Chuply staff is:

• Logged with a timestamp, staff member identity, and reason
• Limited to what is necessary for the specific support purpose
• Subject to our internal POPIA access controls and staff confidentiality obligations
• Governed by role-based permissions (not all Chuply staff can access personal data)

You may grant or revoke enhanced support access at any time from Settings → Privacy & Support Access. When enabled, our support team can access additional account details to resolve complex issues. When disabled, access is limited to basic operational data necessary to maintain the Service.

5. Sharing of Personal Information

We do not sell your personal information. We share it only with:

• Supabase (Ireland/USA): database and authentication infrastructure. Data is stored in Ireland (EU region). Subject to EU-ZA Standard Contractual Clauses.
• Vercel (USA): hosting and serverless compute. Your data transits Vercel servers to deliver the platform.
• Resend (USA): transactional email delivery (invitations, invoices, quotes). Only the email address and relevant content are shared.
• Law enforcement or regulators: where required by South African law or a valid court order.

All third-party processors are bound by data processing agreements. Where data is transferred outside South Africa, appropriate safeguards are in place as required by POPIA section 72.

6. Data Retention

We retain your personal information for as long as your account is active. Upon cancellation, your data is retained for 30 days (allowing reactivation or export) and then permanently deleted. Financial and tax-related records may be retained for up to 5 years as required by the South African Income Tax Act.

Access logs (POPIA audit trail) are retained for 12 months.

7. Security

We use industry-standard security measures including encrypted data storage, TLS in transit, row-level security, and role-based access controls. We cannot, however, guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA section 22.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information (subject to legal retention requirements)
• Object: object to processing of your personal information on grounds of legitimate interest
• Withdraw consent: withdraw any consent you have given at any time, without affecting the lawfulness of prior processing
• Lodge a complaint: complain to the Information Regulator of South Africa at www.justice.gov.za/inforeg if you believe your rights have been violated

To exercise any of these rights, email privacy@chuply.com. We will respond within 30 days.

9. Cookies

We use essential cookies to maintain your login session and platform functionality. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in.

10. Children

The Service is intended for business use by adults. We do not knowingly collect personal information from persons under 18. If you believe we have inadvertently collected such information, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email and in-app notice at least 14 days before taking effect. The current version is always available at ops.chuply.com/privacy.

12. Contact and Information Officer

Chuply (Pty) Ltd — Information Officer
Email: privacy@chuply.com
Support: support@chuply.com

Information Regulator of South Africa
www.justice.gov.za/inforeg
complaints.IR@justice.gov.za