Privacy Policy

HAVI TECH TRADING (Pty) Ltd ("we", "us", "our") operates HAVI™ Inventory Lite (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

By using the Service, you consent to the collection and use of your information as described in this Policy. If you do not agree, please do not use the Service.

We collect the following categories of personal information:

• Account information: Full name, company name, email address, phone number, company address, and VAT number provided during registration.
• Authentication data: Hashed passwords (we never store plain-text passwords), login timestamps, and session tokens.
• Business data: Inventory items, employee records, equipment bookings, and related operational data you enter into the Service.
• Usage and audit data: Actions performed within the Service (creates, updates, deletions) stored in the audit trail for security and compliance purposes.
• Billing information: Invoice records and payment status. Payment processing is handled by PayFast. We do not store card or banking details.
• Technical data: IP addresses, browser type, and system logs used for security monitoring and troubleshooting.

We use your personal information to:

• Provide, operate, and maintain the Service
• Process your subscription and billing via PayFast
• Send transactional emails such as email verification, password resets, and invoices
• Provide customer support when you contact us
• Monitor for security threats and fraudulent activity
• Comply with legal obligations applicable in South Africa
• Improve and develop the Service based on aggregated, anonymised usage patterns

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Under POPIA, we process your personal information on the following lawful grounds:

• Contract performance: Processing necessary to deliver the Service you have subscribed to.
• Legitimate interest: Security monitoring, fraud prevention, and service improvement.
• Consent: Where you have explicitly consented, such as accepting these terms at registration.
• Legal obligation: Where required by South African law.

Your data is stored on secure cloud infrastructure. We implement the following security measures:

• Encrypted data transmission using HTTPS/TLS
• Bcrypt password hashing — passwords are never stored in plain text
• JWT-based authentication with short-lived session tokens
• Automated AI-powered security monitoring with a complete audit trail
• Account lockout after repeated failed login attempts
• Role-based access control limiting data exposure

While we implement industry-standard safeguards, no electronic system is entirely secure. We encourage you to use a strong, unique password and report any suspicious activity immediately.

We retain your personal information for as long as your account is active or as required to provide the Service. Specifically:

• Account data: Retained for the duration of your subscription plus 90 days after cancellation.
• Audit logs: Retained for 12 months for security and compliance.
• Billing records: Retained for 5 years in accordance with South African tax requirements.

Upon account termination, you may request a full data export within 30 days. After this period, your data will be permanently deleted, subject to legal retention obligations.

The Service integrates with the following third parties. Each operates under their own privacy policy:

• PayFast: Payment processing. Subject to PayFast's Privacy Policy at payfast.co.za.
• Google Gemini AI: Optional AI assistant functionality. Queries are processed by Google's API.
• DeepSeek via OpenRouter: Optional AI assistant functionality. Queries are processed by OpenRouter's API.
• Replit: Cloud hosting infrastructure. Subject to Replit's Privacy Policy.

AI assistant conversations may be transmitted to the above AI providers to generate responses. Do not submit sensitive personal information through the AI assistant.

As a data subject under POPIA, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Objection: Object to the processing of your personal information in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Complaint: Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

To exercise any of these rights, contact us at support@havitech.co.za. We will respond within 30 days.

The Service uses browser local storage to maintain your authentication session. We do not use third-party advertising cookies or cross-site tracking technologies.

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

In terms of POPIA, HAVI TECH TRADING (Pty) Ltd's Information Officer is responsible for overseeing compliance with this Policy. For all privacy-related queries: