Privacy policy

Last updated: [date you publish this]

This policy explains what personal information ScripDock collects, why, who it is shared with and what your rights are under South Africa's Protection of Personal Information Act (POPIA).

1. Who we are

ScripDock is offered by [your full name], a sole proprietor trading as ScripDock, of [physical address], South Africa. Email: [email protected]. Our Information Officer is [your full name].

2. Two kinds of information, two roles

• Accounts. For the people who sign up to ScripDock (owners, admins and staff with a login), we decide how their account information is used, so we are the responsible party.
• Company records. The staff details, rosters, clock times, warnings, leave, contracts and documents a company puts into ScripDock belong to that company. The company is the responsible party for them; ScripDock processes them on the company's behalf, as its operator, only to provide the service. If you are an employee and have a question about your records, please ask your employer first; we will help them answer it.

3. What we collect

• Account details: your name, email address and password (stored only as a secure hash; we cannot read it).
• Company records that a company enters: names, contact details, ID or passport numbers, addresses, emergency contacts, departments, job titles, shifts, clock-in and clock-out times, leave, warnings, contracts and uploaded documents.
• Your company's subscription status and the number of active staff each month, which sets the plan.
• To give each person only one free trial, a record of who has used a trial (account and email address), kept even after a company is deleted.
• On your device, your sign-in session and display preferences (light or dark) are kept in the browser's storage. We use no advertising or tracking cookies and no analytics.
• When online payment is offered, payments are handled by our payment provider. We do not see or store full card numbers.

4. Why we use it

To provide and secure the service, to send the emails it needs (confirming your email, resetting your password, telling admins about join requests), to bill for subscriptions, to give support, and to meet legal obligations. We do not sell personal information and do not use it for advertising.

5. Who we share it with

Only with the service providers that run ScripDock, each for its own part:

• Supabase: database, sign-in and file storage.
• Cloudflare: hosting the website and protecting it.
• Resend: sending ScripDock's emails.
• Paystack: taking payments, once online payment is offered.

Some of these providers store or process information outside South Africa. We only send personal information across the border where POPIA allows it, such as where the provider is bound by data-protection terms that give it adequate protection. [Check each provider's data-processing terms and data location, then keep or adjust this paragraph.]

We may also disclose information when the law requires it.

6. How we protect it

• All traffic is encrypted (HTTPS).
• Each company's records are kept separate from every other company's, enforced by the database itself, and inside a company each role only sees what the company allows.
• Uploaded documents are stored privately and are only reachable through short-lived links for people allowed to see them.
• If a security breach affects your personal information, we will tell the affected company or person and the Information Regulator, as POPIA requires.

7. How long we keep it

• Company records stay while the company uses ScripDock. When its owner deletes the company, its records and documents are deleted straight away. Copies in backups are removed as the backups expire, within [number] days.
• Account details stay until the account is deleted. To ask for your account to be deleted, email us.
• The trial record (section 3) is kept so that a free trial cannot be claimed again.
• Billing records are kept as long as tax law requires.

8. Your rights

You may ask to see the personal information we hold about you, to have it corrected or deleted, and to object to how it is used. Email [email protected]. For records held by your employer, ask your employer, who can export, correct or delete them in ScripDock. If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

9. Changes

If we change this policy, we will update the date above and, for important changes, tell account owners by email or in the app.