Privacy Policy

1. Responsible Party (POPIA)

The responsible party for processing your personal information is TeamThink Solutions (Pty) Ltd, trading as Devv Technology, a company registered in the Republic of South Africa. Our Information Officer can be contacted at privacy@devv.co.za.

2. Scope

This Privacy Policy applies to all products operated by Devv Technology, including WeBook, Stagr, Ebook Reader, WeLink, QR-Orders, Devv CRM, and the central Devv Hub platform at devv.co.za. Where a specific product maintains supplementary privacy documentation, that document supplements (and does not replace) this policy.

3. Personal Information We Collect

We collect personal information that you provide directly and information generated by your use of our services:

• Identity data: Full name, email address, phone number, profile photo.
• Account data: Login credentials (stored as one-way hashes), organisation name, role, access level.
• Billing data: Paystack customer code, subscription plan code, transaction reference numbers. We do not store full card numbers or banking credentials.
• Usage data: Pages visited, features used, timestamps, IP address, browser user-agent.
• Referral data: Referral codes generated or used at registration.
• Communications: Support messages, feedback, and broadcast opt-in preferences.

4. Lawful Basis for Processing

We process your personal information on the following grounds under POPIA:

• Contract performance: Processing necessary to deliver the service you signed up for.
• Legal obligation: Compliance with South African tax, consumer protection, and financial regulations.
• Legitimate interests: Platform security, fraud prevention, and abuse detection.
• Consent: Marketing communications (you may withdraw at any time).

5. How We Use Your Information

• To create and manage your Devv account and Universal Devv ID.
• To process payments and manage subscriptions via Paystack.
• To provide customer support and respond to queries.
• To send transactional emails (invoices, account notifications, password resets).
• To send marketing communications where you have opted in.
• To improve platform security, detect fraud, and enforce our Terms of Service.
• To generate aggregated, anonymised analytics to improve our products.

6. Data Sharing & Third Parties

We do not sell your personal information. We share data only with trusted processors necessary to deliver our services:

• Supabase (EU/US): Database and authentication infrastructure. Data is encrypted at rest and in transit.
• Paystack (Nigeria/ZA): Payment processing. Subject to PCI-DSS Level 1 compliance.
• Vercel (US): Hosting and serverless compute. No persistent personal data stored.
• Resend / Email Provider: Transactional email delivery only.

All processors are contractually bound to use your data only as directed by Devv Technology and in compliance with applicable privacy law.

7. Cross-Border Transfers

Some processors (Supabase, Vercel) may store or process data outside South Africa. Where this occurs, we take reasonable steps to ensure adequate protection is in place, including binding contractual obligations aligned with POPIA Section 72.

8. Data Retention

We retain your personal information for as long as your account is active or as required for legal and business purposes. Account data is deleted within 90 days of a confirmed account closure request. Billing records are retained for 5 years as required by South African tax law.

9. Your Rights (POPIA)

Under POPIA, you have the right to:

• Request access to your personal information we hold.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention obligations).
• Object to processing for direct marketing purposes at any time.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any right, email privacy@devv.co.za with the subject line "Privacy Request". We will respond within 30 days.

10. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, row-level security on all database tables, and role-based access control for internal staff. However, no system is 100% secure. If you believe your account has been compromised, contact security@devv.co.za immediately.

11. Children's Privacy

Our services are not directed to persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at privacy@devv.co.za.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered users at least 14 days before they take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

13. Contact

TeamThink Solutions (Pty) Ltd t/a Devv Technology
Email: privacy@devv.co.za
Information Regulator (SA): inforegulator.org.za