1. What This Page Is
POPIA sections 20 and 21 require that any person processing personal information on behalf of a responsible party (an operator) do so only with the responsible party’s knowledge or authorisation, treat the information as confidential, and maintain security measures as required by section 19. There must be a written contract between the responsible party and each operator.
This page discloses every operator Tapnet Solutions currently engages to process personal information on our behalf. If we add or change an operator, we update this page.
2. Current Operators
| Operator | Role | Data processed | Location | Agreement | Certifications |
|---|---|---|---|---|---|
| Supabase Inc. | Database (PostgreSQL), authentication (Supabase Auth), real-time sync, storage | All account data, trade entries, psychological data, consent records, session cookies, technical logs | Ireland (EU) | Supabase Data Processing Addendum - GDPR/POPIA-equivalent standard contractual clauses | SOC 2 Type 2 |
| Vercel Inc. | Web hosting, global edge network, static asset delivery, serverless function execution | HTTP requests, IP addresses, static assets, server logs | United States (primary) with global edge caching | Vercel Data Processing Addendum - GDPR/POPIA-equivalent standard contractual clauses | SOC 2 Type 2, ISO 27001 |
| PayFast (a Network International company) | Payment gateway — hosts the card form and processes subscription payments. PayFast hosts the entire card capture (SAQ-A); TradeJournal never sees or stores card data. | Buyer name and email address passed to PayFast at checkout, the payment amount, PayFast payment / subscription identifiers, and IP address. No card data is stored by TradeJournal. | South Africa | PayFast merchant agreement and payment terms | PCI-DSS Level 1 service provider |
During checkout the buyer's browser is redirected to PayFast's hosted payment pages at sandbox.payfast.co.za (testing) and www.payfast.co.za (live). These hosts are permitted in our Content-Security-Policy form-action directive solely for this redirect.
3. Public APIs (Not Operators)
The application also fetches data from public, anonymous third-party endpoints. These are not POPIA operators because no personal information is processed on our behalf — the request carries no authentication, no account identifier, and no user data. We list them here for full transparency.
| Endpoint | Purpose | Data sent | Provider |
|---|---|---|---|
| api.frankfurter.dev | Live foreign-exchange reference rates (ECB-sourced) for the pip-value, position-size, margin and profit/loss calculator pages | No personal data. The user’s browser contacts the endpoint directly; the provider sees only the visitor’s IP address, as it would for any public website. | Frankfurter (open-source, ECB-sourced); see frankfurter.dev |
4. Services Not Currently Used
The following categories of operator are not currently in use by TradeJournal:
- Email service provider - we do not send bulk transactional or marketing email from the application.
- Analytics or product telemetry (e.g. Google Analytics, PostHog, Mixpanel, Hotjar).
- Error tracking (e.g. Sentry, Rollbar, Bugsnag).
- AI/ML inference providers.
- Customer-support ticketing platforms.
When any of these are added, we will update this page and, where required, request fresh consent.
5. POPIA Section 21 Compliance Checklist
The following controls are built into each operator agreement and we review them annually:
| Control | Status |
|---|---|
| Written agreement in place | Yes - Supabase DPA, Vercel DPA and PayFast merchant agreement |
| Processing only on documented instructions | Yes |
| Confidentiality obligations on operator personnel | Yes |
| Appropriate technical and organisational security measures (s19) | Yes - SOC 2 / ISO 27001 |
| Sub-processor disclosure and approval | Yes - operator-maintained lists |
| Breach notification to responsible party without undue delay | Yes |
| Return or deletion of personal information on termination | Yes |
| Adequate protection for cross-border transfers | Yes - standard contractual clauses |
| Assistance with data-subject rights and regulator enquiries | Yes |
6. Cross-Border Transfers
Two of these operators (Supabase and Vercel) are located outside South Africa; PayFast is South African and involves no cross-border transfer. For the cross-border operators we rely on POPIA s72(1)(a) (a binding written agreement with substantially similar protection), s72(1)(b) (your consent, given when you accept our Privacy Policy) and s72(1)(c) (performance of the contract between you and Tapnet Solutions).
7. Questions
If you have a question about an operator or want to see the text of an operator agreement, contact privacy@tradejournal.co.za.