Privacy notice

POPIA calls the party accountable for your information the responsible party. For everything described here, that is:

Only what the platform needs to work. Each item below exists because something would break without it.

When you create an account

• Your email address and a password. The password is handled by our authentication provider and is stored only as a hash — we never see it, and neither does anyone here.
• Your organisation's name and the country it trades in. The country sets the default market your questions are answered about, so that “what is pork shoulder doing?” has somewhere to be about without asking.

When you subscribe

• Your plan, its status, and the dates your trial or billing period runs to.
• References issued by our payment provider that identify your customer and subscription records with them, plus a token used for one purpose: cancelling or resuming your subscription when you ask us to.

What you do on the platform

• Prices and market information you submit, including who submitted them and when.
• Purchase records you upload for benchmarking against the market.
• The markets on your watchlist, your brief settings, and the questions you put to the AI analyst.

Technical

• A sign-in cookie, so you stay signed in between pages. It is strictly necessary — without it there is no way to know the platform is talking to you.
• Ordinary server logs kept by our hosting provider, which record requests and errors.

POPIA requires a lawful basis for every use. Ours are:

• To perform our contract with you. Your account, your plan, your briefs, your watchlists and your reports exist because you asked for them.
• Our legitimate interests. Keeping the platform secure, preventing abuse, and building market intelligence from contributed data — which is the product itself, and which clause 5 describes.
• Legal obligation. Keeping records we are required to keep, such as those relating to payments.

We do not process special personal information as POPIA defines it, and we do not process the personal information of children.

POPIA calls a party that processes on our behalf an operator. Each of these does one job, and each is bound to use your information only for that job.

We do not sell your personal information, and we do not share it for anyone else's marketing. We will disclose it where the law requires us to.

This one deserves to be said plainly, because it is how the platform works rather than a detail.

Prices and market information you contribute become part of the market picture every client sees. That is the bargain: the data is more useful to you because others contribute too. What other clients see is the aggregate — the median, the movement, the range — not your organisation's name against a number.

If you close your account, those contributions stay, but they stop being yours in any traceable sense. Clause 6 describes exactly what we do to them.

Our database is hosted in the European Union, and our application and AI providers process information outside South Africa.

POPIA section 72 allows this where the receiving party is bound by a law or binding agreement that upholds principles substantially similar to POPIA. Our providers are engaged under data processing terms to that effect, and the European Union is subject to data protection law the Information Regulator treats as comparable.

We keep your account information for as long as you have an account, and then for a 30-day grace period after you close it.

When you close your account

• Access and billing stop immediately. Nothing further is charged.
• For 30 days, nothing is destroyed, and an Administrator can undo the closure. We would rather a change of mind on day twelve was survivable.
• Only an Administrator of your organisation can close it. One person cannot end a company's account on everyone else's behalf.

After 30 days, permanently

• Every price you submitted is stamped with a fresh random key and stripped of its link to your organisation and to the person who submitted it. The key is generated at that moment and stored nowhere else, so submissions from the same former contributor remain groupable and nothing can map them back to who you were.
• Logins belonging only to your organisation are deleted. Someone who is also a member of another organisation keeps their login and simply loses this membership.
• The organisation record goes, and your memberships, watchlists, briefs and any pending plan change go with it.

This is irreversible. We cannot restore an account after the grace period has run, because by then there is nothing left to restore it from.

Under POPIA you may:

• Ask what personal information we hold about you, and get a copy of it.
• Have information that is wrong corrected, or information we no longer have a reason to keep deleted.
• Object to processing we carry out on the basis of legitimate interest.
• Withdraw consent where consent is what we relied on.
• Complain, either to us or directly to the Regulator.

Write to info@protein-platform.com. We will answer within a reasonable period and will tell you if we need to verify who you are first.

If we get it wrong

You can complain to the Information Regulator (South Africa). A POPIA complaint goes through the Regulator's online complaints portal at inforegulator.org.za, where you register a profile first; general questions go to enquiries@inforegulator.org.za, and they can be reached on 010 023 5200 or toll free on 0800 017 160. You do not have to come to us first, though we would rather you did — most things are faster to fix directly.

Access to data is enforced in the database itself, not only in the application: the rules about which organisation may read which rows are applied by the database on every query. Everything travels over an encrypted connection. Passwords are stored as hashes and are not recoverable by anyone, including us.

No system is beyond reach. If personal information is compromised in a way that creates a real risk to you, POPIA section 22 requires us to tell both you and the Regulator, and we will.

If we change how we handle your information, we will update this page and move the date at the top. Where a change materially affects you, we will tell you by email rather than relying on you noticing.

See also our Terms of Service and our PAIA manual.