Privacy Policy

This Privacy Policy explains how Tapnet Solutions (Pty) Ltd (“Tapnet Solutions”, “we”, “us”, “our”), a company registered in the Republic of South Africa (registration number 2023/135522/07) and the operator of the TradeJournal service at tradejournal.co.za, processes your personal information.

Tapnet Solutions is the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”). Our Information Officer is Wynand de Beer, reachable at privacy@tradejournal.co.za.

The categories of personal information we process are set out below.

POPIA requires us to process personal information only for a specific, explicitly defined and lawful purpose, and only on a lawful basis listed in section 11. The table below maps each activity to its purpose and legal basis.

We do not use your trade entries, psychological data, or any other personal information to train artificial-intelligence models, and we never sell your personal information.

POPIA section 1 defines health information - including information about a person’s physical and mental health - as special personal information. Processing special personal information is generally prohibited by section 26 unless a section 27 exception applies. We rely on section 27(1)(a): your explicit consent.

POPIA calls third parties that process personal information on our behalf operators. Section 20 requires us to have a written agreement with every operator. The table below lists every operator currently in use. A full list is maintained on our Operator Agreements page.

We do not sell, rent or share your personal information with any third party for their own marketing or profiling purposes.

Your personal information is stored outside the Republic of South Africa. Specifically:

• Primary storage is in Ireland (European Union) with Supabase Inc.
• Web traffic is served through Vercel’s United States origin with global edge caching. Request metadata (including your IP address) transits the edge network.

Under POPIA section 72 we rely on the following combination of lawful grounds:

• s72(1)(a) - the recipient is subject to a binding written agreement (the Supabase and Vercel Data Processing Agreements) that upholds principles of reasonable protection substantially similar to POPIA’s eight conditions for lawful processing and provides enforceable rights and effective legal remedies for data subjects.
• s72(1)(b) - your informed consent, given when you accept this Privacy Policy.
• s72(1)(c) - the transfer is necessary for the performance of the contract between you and Tapnet Solutions.

Both Supabase and Vercel are subject to the General Data Protection Regulation (GDPR) and/or equivalent US frameworks, which the Information Regulator has publicly acknowledged as upholding comparable data-protection principles.

We retain your personal information only for as long as necessary for the purposes set out in Section 3. The detailed schedule is published on our Data Retention Policy page. A summary:

On account deletion, personal information is removed from our live database within 30 days. Residual copies may persist in Supabase’s encrypted infrastructure backups for up to a further 30 days before they are automatically overwritten.

You have the following rights in relation to your personal information. To exercise any of them, email privacy@tradejournal.co.za. We will respond within 30 days.

• Access (s23) - confirmation that we hold your data, and a copy of it. You can download a JSON export from Settings → Data → Export All Data at any time.
• Correction (s24) - have inaccurate or incomplete information corrected. Most fields are editable directly in Settings.
• Deletion (s24) - have your personal information destroyed or deleted. Available in Settings → Account → Delete Account, or for psychological data only in Settings → Privacy.
• Objection (s11(3)) - object to processing based on legitimate interests or for direct marketing.
• Withdraw consent (s11(2)(b)) - withdraw any consent you previously gave. Withdrawal is as easy as granting consent.
• Lodge a complaint (s74) - complain to the Information Regulator (details below).
• PAIA access request - formal record access under the Promotion of Access to Information Act 2 of 2000. See our PAIA Manual.

We apply appropriate, reasonable technical and organisational measures. Full detail is on our Security page. Summary:

• All connections are encrypted in transit with TLS (HTTPS, HSTS).
• Passwords are hashed by Supabase Auth using bcrypt. We never see your plaintext password.
• Data at rest is encrypted with AES-256 by Supabase.
• Row-level security ensures no user can read or write another user’s data.
• Strict Content Security Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff.
• Authentication rate limiting to defend against credential stuffing.
• Supabase is SOC 2 Type 2 certified; Vercel is SOC 2 Type 2 and ISO 27001 certified.

TradeJournal uses only strictly necessary cookies at this time:

• sb-* - Supabase session tokens (HttpOnly, Secure, SameSite=Lax). Without these you cannot stay signed in. They are exempt from opt-in consent because they are essential for the service you explicitly requested.
• theme / preference cookies - local-storage entries used to remember your theme and minor UI preferences.

If we later add non-essential cookies (for example analytics, product telemetry or advertising pixels), we will introduce a granular cookie-consent banner first and no such cookies will be set before you opt in.

TradeJournal is intended only for users who are 18 years or older. You confirm your age at signup. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without the competent consent of a parent or guardian, we will delete that information immediately.

We will only send you direct marketing (product announcements, promotional content) if you opt in. You can withdraw consent at any time by clicking the unsubscribe link in any marketing email, by toggling preferences in Settings → Notifications, or by emailing privacy@tradejournal.co.za. Service, security and billing emails are not marketing and are not subject to opt-out while you hold an active account.

If a security compromise occurs that has led to, or may reasonably lead to, the unauthorised acquisition of your personal information, we will notify the Information Regulator as soon as reasonably possible (our target is 72 hours from discovery) and notify you directly with a description of the incident, the categories of data affected, the steps you can take, and the steps we have taken. Full procedure is on our Breach Response page.

You have the right to lodge a complaint with the Information Regulator if you believe we have not handled your personal information lawfully:

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Enquiries: enquiries@inforegulator.org.za
• Complaints: complaints.IR@justice.gov.za
• Web: inforegulator.org.za

We ask that you contact us first so that we can try to resolve your concern directly.

We may update this Privacy Policy from time to time. Material changes will be communicated to you by email and by a blocking in-app notice the next time you sign in, and you will be asked to re-consent. The version number at the top of this page indicates the current version. We keep an internal log of all prior versions for audit purposes.

For any privacy-related question or request, please contact our Information Officer:

• Information Officer: Wynand de Beer
• Email: privacy@tradejournal.co.za
• Alternative email: wynand@tapnet.co.za
• Phone: +27 79 174 8357
• Postal address: 594 Bombani Street, Elarduspark, Gauteng, 0181, South Africa
• Target response SLA: 30 days from receipt of your request