Privacy Policy

This policy covers solfalabs.com — this website and nothing else. Any software Solfa Labs releases will carry its own privacy policy, published before anyone can install it. The only personal information this site collects is an email address you type in yourself.

Most privacy policies are long because the service behind them is complicated. This one is long because it is specific: rather than say "we may collect certain information", it names every field, every recipient, every retention period and every legal basis. There is far less to describe than the length suggests, and that is the point.

This site is operated by Solfa Labs, a software company incorporated in the Republic of South Africa and based in Bloemfontein, Free State. Throughout this document "we", "us" and "our" mean Solfa Labs; "you" means the person reading the site or joining the waitlist.

In the language of the Protection of Personal Information Act 4 of 2013 — POPIA — we are the responsible party. We decide what personal information is collected here and why, and we answer for it.

The pages you can read on solfalabs.com, the waitlist form, and any email you send us about either.

It does not cover anything you reach by leaving this site. If you follow a link away from solfalabs.com, whatever you find there is governed by that operator's policy, not ours. We have no ability to see what you do once you leave, and no interest in trying.

The site is a set of static pages. It is not an account system, a shop, a forum, or a service you log in to. There is nothing here to sign into and no password to lose.

POPIA sets out eight conditions for lawful processing. They are not a checklist we file away; each one has a concrete meaning here, and this is what each one means.

This is the complete inventory. There is no second list.

That is all of it. We do not ask for or receive your name, your telephone number, your postal address, your date of birth, your employer, your payment details, your location, or anything about your device beyond what your browser announces to every site it visits.

4.1 Special personal information

POPIA s 26 defines special personal information as religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour. We collect none of it and have no field capable of holding it. No processing on this site engages ss 27 to 33, and no authorisation under s 57 is required.

The waitlist is the only thing on this site that collects anything, so it deserves its own section rather than a line in a table.

5.1 What happens when you submit the form

1. Your browser sends your address and your consent to Kit, our email provider, directly. It does not pass through a Solfa Labs server on the way, because there is no server between you and Kit.
2. Kit sends you a single email containing a confirmation link.
3. Until you click that link you are not on the list. Your address sits unconfirmed, we do not email you again, and it is deleted automatically if you never confirm.
4. If you do click it, you are subscribed, and you will receive occasional email about the product's progress and its release.

This is double opt-in. It is slower than the alternative and it loses us some signups, and we use it anyway: it is the only method that makes it impossible to add someone who did not ask, whether by malice or by typo.

5.2 What we will send you

Infrequent email about this product — progress, an invitation to the beta when it opens, and notice of release. We will not send you unrelated offers, we will not email you about a different product, and we will not pass your address to anyone who will.

5.3 Leaving

Every message has an unsubscribe link. One click, effective immediately, no confirmation step and no attempt to talk you out of it. Unsubscribing removes you from the list rather than silencing you on it. You can also write to privacy@solfalabs.com and ask, and we will do it for you.

5.4 What the consent box means

It has to be ticked, it is never pre-ticked, and the form will not submit without it. Ticking it means you agree to receive the email described in §5.2 and that you accept this policy and the Terms of Use. It means nothing else. It is not a licence to contact you about anything we later find interesting, and it does not survive your withdrawal of it.

Stating an absence precisely is more useful than stating a presence vaguely, so:

• No cookies. Not one — not necessary, functional, analytical or otherwise. This is why you were not shown a cookie banner. A banner asking permission for nothing is theatre, and we would rather have nothing to ask about.
• No analytics. No Google Analytics, no Plausible, no Fathom, no self-hosted equivalent. We do not know how many people visit this site beyond what the server log shows, and we have decided we can live with that.
• No tracking pixels, tag managers or advertising scripts of any kind, from anyone.
• No session recording or heatmaps. Nothing watches your cursor.
• No third-party fonts, scripts, frames or embeds. Every asset is served from our own domain, so loading a page does not announce your visit to anyone else.
• No social media buttons. Those are tracking beacons that happen to look like logos.
• No fingerprinting — no canvas, font-enumeration or timing techniques used to identify a browser without storing anything on it.
• No accounts, no passwords, no logins.
• No selling, renting, trading or sharing of anything about you, to anyone, for money or for anything else of value. There is no circumstance in which this changes without this policy changing first.

A "Do Not Track" header or a Global Privacy Control signal has nothing to act on here. We honour both by having nothing for them to switch off.

Two organisations, both acting on our instructions under written terms, both named.

Beyond those two, personal information leaves us only if we are legally compelled — a valid court order or a lawful demand from a competent authority. We would tell you before complying unless we were legally barred from doing so. We have never received such a demand.

If Solfa Labs is ever sold or merges with another company, the waitlist may transfer to the acquirer. You would be told before it happened and given the chance to leave first, and the acquirer would be bound by this policy until you had that chance.

Kit is in the United States, so your address leaves the Republic. POPIA s 72 prohibits that unless one of five grounds applies, and we rely on two of them together.

• Section 72(1)(b) — a binding written agreement with Kit that imposes conditions substantially similar to POPIA's, including a term restricting onward transfers. This is the primary ground.
• Section 72(1)(a) — you consent to the transfer. The form tells you before you submit, and this section tells you in full.

Because no special personal information and no child's information is involved, the prior authorisation the Regulator requires under s 57(1)(d) for certain transfers does not arise.

We are honest about the residual point: an email address held in the United States is subject to United States law, including lawful access by its authorities. That is true of every mailing list run on an American provider, which is most of them. The mitigation available to us is to hold as little as possible for as short a time as possible, which is what §4 and §9 describe.

POPIA s 14 forbids keeping personal information longer than necessary for the purpose. Concretely:

POPIA s 19 requires appropriate, reasonable technical and organisational measures against loss, damage and unauthorised access. What we actually do:

• Transport. Every network request this site makes uses HTTPS with TLS 1.2 or better. There is no cleartext endpoint.
• Storage at rest. Files are served from an encrypted store, and Kit encrypts subscriber data at rest.
• The form posts directly to Kit over HTTPS. Your address is never written to a Solfa Labs server, so there is no database of ours to breach.
• There is no database, no admin panel and no login anywhere on this site. Most website breaches are a compromised administrative account or an injection into a data store. Neither exists here.
• Administrative access is restricted to named, authorised personnel and protected by multi-factor authentication.
• The site is static. No server-side code runs when you visit, so there is no application logic to exploit.
• Minimisation is the main control. The strongest security measure on this site is how little it collects. Information we never hold cannot be stolen from us.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If you find a vulnerability, write to privacy@solfalabs.com. We will acknowledge within 72 hours, we will not threaten you, and we will credit you if you would like the credit.

POPIA s 22 requires notification to the Information Regulator and to every affected person as soon as reasonably possible after we become aware of a security compromise. South Africa sets no materiality threshold — every compromise is reportable, however small, and there is no level at which we get to decide it does not matter.

Our commitment, which is stricter than the Act:

• We notify the Information Regulator within 72 hours of becoming aware, on the Regulator's prescribed section 22 form.
• We notify everyone affected within 72 hours, by email, in plain language: what happened, what information was involved, what we have done, and what you should do.
• We do not wait for certainty before telling you. "We are still investigating" is more useful to you than silence.
• We publish a public account within 30 days, unless doing so would help an attacker still at work — in which case we publish as soon as it would not.

Under POPIA you have the following rights in relation to what this site holds. We extend all of them to everyone, wherever you live.

Email privacy@solfalabs.com and say what you want. That is the entire procedure.

POPIA s 69 permits electronic direct marketing only with consent, or to an existing customer about similar products, and it allows a company to approach someone who has not consented once only to ask for that consent. We do not make even that single approach: if you have not asked to hear from us, you will not.

Section 45 of the Electronic Communications and Transactions Act 25 of 2002 additionally requires that any unsolicited commercial communication identify its sender and offer a way to opt out. Ours identifies us and carries an unsubscribe link in every message, although nothing we send is unsolicited in the first place.

The Consumer Protection Act 68 of 2008 gives you the right to refuse direct marketing and to register a pre-emptive block. We honour any such block.

The waitlist is for people aged 18 or over.

POPIA treats anyone under 18 as a child, and s 34 prohibits processing a child's personal information unless a narrow exception in s 35 applies — which for a marketing mailing list would require the verified prior consent of a competent person. We have set the floor at 18 rather than build a consent-verification process around a mailing list, which is the proportionate answer for a service that collects one email address.

If you are under 18, please do not join the waitlist. If we learn that an address belongs to someone under 18, we delete it and tell the person why. If you are a parent or guardian and believe your child has subscribed, write to privacy@solfalabs.com and we will remove it within 7 days.

This policy is written to South African law, because that is where we are and that is the law that governs us.

The internet does not respect that boundary. If you live elsewhere, your own country's data protection law may give you rights in addition to the ones described here — the General Data Protection Regulation in the European Union, the UK GDPR, state privacy statutes in the United States, and others. We have not written a separate section for each, because a policy that lists statutes it does not actually operate to is worse than one that says plainly what it will do.

What we commit to, and do:

• We honour the rights in §12 — access, a copy, correction, deletion, objection and withdrawal of consent — for every person who asks, regardless of where they live and regardless of whether any law requires it of us.
• We apply one standard rather than sorting people by residence. Doing otherwise would mean determining where you live in order to decide how much privacy to give you, which is a worse intrusion than the one it would be solving.
• If you believe a right under your own law has not been met, write to privacy@solfalabs.com and say which right and which law. We will engage with it properly rather than sending you a form letter.

• Material changes — a new category of information, a new recipient, a new purpose, or the removal of anything promised in §6 — are announced by email to everyone on the list at least 30 days before they take effect. That is time to read them and to leave if you disagree.
• Corrections and clarifications take effect when published.
• Superseded versions are archived and provided on request, so you can always establish what you actually agreed to and when.
• Staying subscribed after a change takes effect means the new version applies to you. Silence is never treated as agreement to a material change you were not told about.

Please write to privacy@solfalabs.com first. Most complaints are a misunderstanding that can be fixed the same day, and we would rather fix it than read about it from a regulator.

You are not obliged to. You may complain directly to the Information Regulator at any time.

Personal information

Information relating to an identifiable living person — and, uniquely under POPIA, to an identifiable existing juristic person such as a company. Broader than "sensitive": an email address is personal information, and so is an IP address in most circumstances.

Special personal information

The categories listed in POPIA s 26, which attract stricter rules. Enumerated in §4.1. We hold none of it.

Responsible party

The person or body that determines the purpose and means of processing. Solfa Labs, for this site.

Operator

Someone who processes personal information on behalf of a responsible party, under its authority and for no purpose of their own. Kit and our hosting provider.

Data subject

The person the information is about. You.

Processing

Anything at all done with personal information — collecting, storing, using, transmitting, altering, erasing. Merely holding something and doing nothing with it is still processing.

Consent

A voluntary, specific and informed expression of will. A pre-ticked box is not consent. Nor is permission buried in a document nobody was shown.

Double opt-in

Requiring a person to confirm by clicking a link in an email before they are added to a list, proving that the address was submitted by the person who controls it. What §5 describes.

Security compromise

POPIA's term for what is elsewhere called a data breach: unauthorised access to, or acquisition of, personal information. §11 sets out what we do about one.

Information Officer

The person accountable under POPIA for a body's compliance. Under s 55 the head of a private body holds the role automatically. Ours is contactable at the address in §1.

For anyone checking this document against the Act rather than reading it.