Privacy Policy

1. Information We Collect

Account Information: Name, email address, phone number, company name, billing address, and payment details provided during registration and subscription management.

Usage Data: Log data, feature usage analytics, session duration, IP address, browser type, and device information. This data is collected to improve the Platform and troubleshoot issues.

Business Data: All data you enter into Ceribro™ modules, including employee records, financial transactions, customer information, and project data. You retain full ownership of this data.

Cookies: We use essential cookies for authentication and session management, and optional analytics cookies to understand usage patterns. See our Cookie Policy for details.

2. How We Use Your Information

• To provide, maintain, and improve the Platform
• To process payments and manage your subscription
• To send transactional communications (billing, security alerts, service updates)
• To provide customer support and respond to enquiries
• To analyse usage patterns and improve user experience (anonymised)
• To comply with legal obligations and enforce our terms

3. Data Sharing

We do not sell your personal data. We share data only with: (a) service providers who process data on our behalf under strict contractual obligations (e.g. payment processors, hosting providers); (b) law enforcement when required by valid legal process; (c) during a business transfer such as a merger or acquisition, with advance notice to you.

4. Data Security

We implement industry-standard security measures including: AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access control, multi-factor authentication, regular penetration testing, SOC 2 Type II certified infrastructure, and ISO 27001 aligned processes.

5. Data Retention

We retain your account data for the duration of your subscription plus 30 days. After cancellation, all data is permanently deleted within 30 days unless a longer retention period is required by law. You may request data export at any time.

6. Your Rights

Under POPIA, GDPR, and applicable privacy laws, you have the right to:

• Access: Request a copy of your personal data at any time
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data (processed within 30 days)
• Portability: Export your data in machine-readable format (CSV, JSON, PDF)
• Objection: Object to processing of your data for marketing purposes
• Withdrawal: Withdraw consent for non-essential processing at any time

7. International Transfers

Your data may be processed in data centres located in South Africa, the European Union, or the United States. All transfers are protected by appropriate safeguards including Standard Contractual Clauses and adequacy decisions.

8. Children's Privacy

Ceribro™ is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.

9. Data Protection Officer

For privacy-related enquiries, contact our DPO at privacy@ceribro.io. You also have the right to lodge a complaint with the Information Regulator of South Africa or the relevant supervisory authority in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on the Platform at least 30 days before they take effect.