Privacy policy

Who we are

Komply is a product of Auto Alpha Advisory (Pty) Ltd (registration number 2025/213512/07), trading as Komply. The responsible party for personal information collected via getkomply.co.za is Auto Alpha Advisory (Pty) Ltd, contactable at hello@getkomply.co.za.

What we collect

• Account data: work email, company name, your role within the workspace.
• Workspace data: the public domain you ask us to scan, and the scan results that the audit engine produces against it. For the FSCA module, the fit-and-proper data for your key individuals and representatives (full name, last four digits of ID number, qualification + CPD records). For the B-BBEE module, the workforce composition required to score the scorecard (race and gender breakdowns), processed under the lawful basis provided by the B-BBEE Act and Codes of Good Practice (POPIA s27(1)(b)). For the SARS module, your VAT and payroll figures plus, optionally, Xero OAuth credentials encrypted at the application layer. For an EMP501, Komply keeps what its checks need from each IRP5: the employee's income tax and employee numbers, the certificate number, its amounts and source codes, and each check's result with an age band (under 65, 65 to 74, or 75 or older) worked out from the date of birth, which it doesn't keep. The return keeps no names, ID numbers, addresses or bank details. If you file the e@syFile export through the filing tray, the file itself, which holds them, stays in the tray until an EMP501 is saved from it, or for 90 days after you uploaded it, whichever comes first. With Xero connected, Komply also asks Xero for the contacts of the suppliers on each VAT period's purchases and uses only their VAT numbers, to check the VAT201's evidence. It keeps none of the contact details: only how many purchases lack a number and, for up to five of them, the purchase's number and the supplier's name. For Tender Readiness, the dates and reference numbers of your UIF declarations, returns of earnings and Employment Equity reports, and any receipt or acknowledgement you attach. An attached file can name your employees and their earnings; it is stored privately for your workspace and never shown on a buyer's share link.
• Billing data: handled by PayFast — we receive payment confirmations, never card numbers.
• Operational logs: request identifier, tenant identifier, IP address and browser user-agent. We retain these for 12 months for abuse investigation and audit-trail continuity. No tracking cookies. On our public marketing pages only (never inside the signed-in dashboard), we use a privacy-first, cookieless analytics tool — Umami, self-hosted by Auto Alpha Advisory — to measure aggregate page views and page performance. It sets no cookies, builds no cross-site profile, and does not run on authenticated pages.
• Waitlist and share-link access logs: When you join our waitlist or someone views a share link you issued, we record the IP address, user-agent, and timestamp (and, for a waitlist sign-up, the page you came from and which free tool you used, which also tell us where sign-ups come from) to investigate abuse and to give you a view-audit trail. We keep these records for 12 months. Each waitlist, contact or pilot sign-up also sends us an email alert. Resend, our email provider, keeps that message for 30 days, and the copy in our mailbox stays until we delete it.
• Partner referral codes: If you arrive through a Komply partner's link, your browser stores that partner's code (not a cookie, and nothing about you) for 90 days. It is shown to you, and you can clear it, in the referral field when you set up a workspace, and it is sent with any signup form you submit, so we can credit the partner. We keep it on your workspace record.

How we use it

To operate your workspace, run scans against the domain you nominate, send transactional email (sign-in links, monthly digest), bill you for the subscription, and meet our legal obligations. We don't sell personal information or share it with advertising networks.

Our lawful basis. We process your account, workspace, billing, and operational data because it is necessary to perform the subscription contract with you (POPIA s11(1)(b)) and to meet legal obligations such as tax-record retention (s11(1)(c)). B-BBEE workforce-composition data is processed under the basis provided by the B-BBEE Act and Codes of Good Practice (s27(1)(b)). Certificate extraction runs when you upload a certificate for it, and policy tailoring when you generate a conflict-of-interest policy. Providing this information is voluntary, but it is required to operate your workspace — without it we cannot run the scans. We store the company registration number you provide. Komply can look up company-registry details (registration status, director roster) at CIPC from that number, but the lookup is not switched on yet, so nothing is sent to CIPC today.

When you generate a conflict-of-interest policy in the FSCA module, Komply may send the policy's template text to Anthropic in the United States to tailor the wording to your firm. Key individuals' and representatives' names are replaced with initials before it is sent; your registered name is sent as it is. A guard rejects any rewrite that changes a template sentence or adds a law, and you review and sign off the policy before it is used. The ICMP report and Ombud responses are built from your registers; no model writes them.

Where you upload a B-BBEE certificate for automated field extraction, or file a document that Komply recognises as your B-BBEE certificate or affidavit, or that you tell Komply is one, the document is sent to Anthropic in the United States for processing. Komply checks a filed document on its own servers before anything is sent. The document is your own data and is transmitted unredacted because the document content is required for extraction. No fields are applied to your scorecard without your per-field confirmation.

Direct marketing

The monthly compliance digest we send to subscribers is transactional — it reports on your own workspace and the scans you asked us to run, as part of the service you signed up for, not direct marketing. We don't sell or rent your contact details. If we ever send genuine marketing email (product news or offers), it will be on an opt-in basis and every such message will carry a one-click unsubscribe, in line with POPIA s69. You can opt out of non-essential email at any time via the unsubscribe link or by emailing io@getkomply.co.za.

Where it lives

Application data is stored in Supabase Postgres (eu-west-1, Ireland) with tenant-scoped access controls enforced at the application layer plus Row-Level Security policies as defense in depth. Scan results are mirrored in Komply's database so the dashboard doesn't depend on the audit engine for read traffic. Transactional email is sent via Resend. Email you send to hello@ or io@getkomply.co.za is forwarded by ImprovMX to our Google Workspace mailbox. Billing is handled by PayFast (Pty) Ltd in South Africa. LLM processing is handled by Anthropic in the United States under contractual safeguards and the zero-data-retention tier — conflict-of-interest policy text, with key individuals' and representatives' names cut to initials, for tailoring, and uploaded B-BBEE certificate content for field extraction. See the Data Processing Agreement for the full sub-processor list and our cross-border-transfer basis.

Information Officer

Komply's Information Officer is Matt Owen, registered with the Information Regulator on 30 September 2026 as the Information Officer of Auto Alpha Advisory (Pty) Ltd. The Information Officer's registered email address is hello@autoalphaadvisory.co.za; you can also write to io@getkomply.co.za, which reaches the same person.

How long we keep it

Account data: for the lifetime of the subscription plus 12 months after you close your workspace, then deleted on request or as part of our monthly retention sweep — including your sign-in account and profile once your workspace has been removed. Files you uploaded (B-BBEE certificates and employer-record receipts) are deleted on request, because automatic deletion of stored files is not yet switched on. Scan data: for the lifetime of the subscription. Billing records, including each payment's status and amount: 5 years per SA tax retention rules.

Documents waiting in the filing tray are deleted 90 days after upload unless Komply has filed them.

We keep an invitation's email address until 90 days after it is revoked or expires, then delete it in our next monthly retention sweep.

Data breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, POPIA s22 requires us to notify both the Information Regulator and you as the affected data subject as soon as reasonably possible after we become aware of the compromise. Our notification will describe, to the extent known, the nature of the compromise, the information involved, the likely consequences, and the measures we have taken or propose to take to address it and to help you protect yourself. We may delay notifying you only if a law-enforcement authority or the Regulator informs us that notification would impede a criminal investigation. We maintain an internal incident-response process so a compromise is contained, assessed, and reported without undue delay.

Your rights

POPIA gives you the following rights over your personal information:

• To be notified (s18) — that we are collecting your information, and the source where it is collected other than from you.
• Of access (s23) — to ask what personal information we hold about you and to request a copy.
• To correction or deletion (s24) — to have inaccurate, irrelevant, excessive, or outdated information corrected or deleted, and to have information we no longer have authority to retain destroyed.
• To object (s11(3)) — to object, on reasonable grounds, to the processing of your information.
• To object to electronic direct marketing (s69) — to withdraw consent to marketing email at any time via the unsubscribe link in every message or by emailing our Information Officer.
• Not to be subject to a decision based solely on automated processing (s71) that has legal or similarly significant effects for you. Komply's compliance scoring is decision-support for you and your advisers — it is not a solely-automated decision of this kind.
• To complain (s74) — to lodge a complaint with the Information Regulator.

To exercise any of these, email our Information Officer at io@getkomply.co.za; we acknowledge requests within 3 business days and respond in full within 30 days. You can lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Updates

We'll surface material changes in-app and via email at least 14 days before they take effect. The version date at the top of this page reflects the most recent change.