Privacy Policy

Who is responsible

For your account, billing and our website, The Growth System is the responsible party. Our Information Officer is [FILL IN: Information Officer's name], who you can reach at [FILL IN: Information Officer's email address] or support@thegrowthsystem.co.za. Our address is [FILL IN: physical business address].

For the ideas, comments, files and other content in a workspace, the organisation that runs the workspace decides what is collected and why, and is the responsible party for that content. The Growth System processes it on the organisation's behalf, as its operator. Requests about workspace content usually go to your workspace administrator first; we will help them respond.

What we collect

When you create an account: your name, email address and a password. The password is stored only as a secure hash by our login provider; we never see it.

To use a workspace: the workspace name, a username, your role, and which workspace you are using. If you are invited, the inviter gives us your email address.

Optional profile details, only if you add them: job title, department, expertise, qualification, a short bio, things you enjoy, a fun fact, skill and personality tags, and a profile photo. These help colleagues find the right people for an idea. You can leave them blank or remove them at any time.

What you create: ideas, comments, evaluations, decisions, chat messages, tasks, files and documents you upload, and similar workspace records. If you submit an idea anonymously, your name is hidden from colleagues, but the idea stays privately linked to your account so the workspace can follow up with you.

If you ask for a demo: your name, work email and, if you choose, your company and a message.

If you give feedback through a public feedback link: your message and, only if you choose, a title, your name and your email. We only keep your email if you tick the box agreeing to be contacted.

Payments: card details go straight to Paystack, our payment provider, and never reach us. We receive your email address, the plan you chose and Paystack's reference codes for your customer record and subscription.

Security and running the service: a scrambled (hashed) version of your IP address, used only to stop too many attempts in a short time; a log of key actions in a workspace (for example who moved an idea or changed a role); counts of AI feature use; which colleagues are online right now; and, when something breaks, the error message and the page address where it happened.

Measurements, only if you allow them: anonymous counts of page visits and page speed (see the Cookie Policy). We do not collect your device fingerprint, precise location, or advertising identifiers, and we do not use advertising or tracking pixels.

Why we use it, and on what basis

To provide the service you signed up for (POPIA section 11(1)(b)): your account, your workspaces, notifications, reports and billing.

To keep the service secure and working (our legitimate interest, section 11(1)(f)): limiting repeated attempts, keeping workspaces separate, fixing errors, and keeping an audit trail of key actions.

With your consent (section 11(1)(a)): page-visit and speed measurements, a partner referral cookie, and contacting you about feedback you gave. You can withdraw consent at any time; this does not affect what was done before.

To meet legal duties (section 11(1)(c)): for example keeping payment records for tax.

Your name and email are needed to create an account. Everything marked optional above is up to you; leaving it out only means that feature won't work for you.

We do not sell personal information. We do not send marketing emails. At the moment the only emails the service sends are workspace invitations someone asks us to send, plus account emails from our login provider (such as confirming your address or resetting your password).

Who we share it with

People in your workspace see what the workspace is set up to show them, such as your name, role, profile and the content you add.

Service providers that process information for us, under contract:

Supabase: database, login and file storage. Our database and files are hosted in Ireland (European Union).

Vercel: hosts the application. Our server functions run in the United States, and pages are delivered through Vercel's global network. With your consent, Vercel also provides the page-visit and speed measurements.

Paystack: takes payments.

Resend: delivers email, when email is switched on for the service.

AI features: at the moment they run on built-in rules on our own servers and send nothing to an outside AI company. If we connect an AI provider, we will name it here and describe what it receives before it is switched on (see the AI Data-Use Policy).

Tools your workspace connects: if your administrator connects Slack, Microsoft Teams, Discord or another webhook, short messages about ideas are sent there. Your organisation chooses and controls these.

Voice typing: if you use the microphone button, the app first asks your browser to recognise speech on your device. If the browser can't, it may send the audio to its own speech service (for example Google, in Chrome), and the app says so on the button.

We may also disclose information if the law requires it, or to protect people's safety or our legal rights.

Information that leaves South Africa

Because our providers are based or host outside South Africa (see above), your information is transferred to and stored in other countries, including Ireland and the United States. POPIA section 72 allows this where the recipient is bound by law, binding rules or an agreement that gives protection substantially similar to POPIA. We only use providers whose terms commit them to protect personal information in this way.

How long we keep it

Account and profile information: for as long as you have an account.

Workspace content: for as long as the workspace exists. When a workspace administrator deletes the workspace, its records and uploaded files are deleted with it. Copies in our providers' backups are overwritten in their normal backup cycle. Payment records are kept as described below, and feedback you send us about BrainVault itself is kept until we have dealt with it.

Payment records: for at least five years, as tax law requires.

Demo requests and public feedback: until they are no longer needed to respond to you, or until you ask us to delete them.

Security records (hashed IP limits, error reports): only as long as needed to protect the service.

How we protect it

Traffic is encrypted (HTTPS) and our providers encrypt stored data. Each workspace's data is separated in the database so one organisation cannot read another's. Access inside a workspace follows the roles your administrator sets, and is checked on our servers, not just hidden on screen. If we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as POPIA section 22 requires.

Profile photos are stored so that anyone with the photo's link can open it, which is how they show up quickly across the app. Don't use a photo you wouldn't want seen outside your workspace.

Your rights

You can ask us whether we hold personal information about you and for a copy of it; ask us to correct or delete information that is wrong, out of date, excessive or unlawfully held; object to processing based on our legitimate interests; and withdraw any consent you gave.

To make a request, email [FILL IN: Information Officer's email address] or support@thegrowthsystem.co.za. We may need to confirm who you are first. Requests about workspace content may be passed to the organisation that runs the workspace.

If you're not happy with how we handled your information, you can complain to the Information Regulator: www.inforegulator.org.za, enquiries@inforegulator.org.za, 0800 017 160.

Children

BrainVault is a workplace tool for adults. It is not meant for anyone under 18, and we don't knowingly collect information about children.

Changes to this policy

If we change how we use personal information, we will update this page and its date, and tell account holders about important changes before they take effect.