Privacy Notice

1. Who is responsible for your data

Mas Vuka (Pty) Ltd (registration number 2026/820444/07, registered office 1 Acacia Ln, Riverglen, Midrand, Gauteng, 2191), trading as Mas Vuka, is the operator of this platform and the responsible party (data controller) for the personal information described in this notice, under the Protection of Personal Information Act, 2013 (POPIA).

2. What we collect

• Account details: name, email address, sign-in credentials, profile photo, preferred language.
• Content you enter: payslip figures, case details, hearing and disciplinary records, documents you generate, community posts, advisor questions.
• Usage and device data: pages visited, feature usage, device identifiers and IP address.
• Support and enquiry messages you send us.

Payment card details are collected directly by Paddle (see below); we never see or store your card number.

3. Why we use it

• To create and run your account and provide the service (performance of our contract with you).
• For security, fraud prevention and abuse detection (legitimate interest).
• To improve the product and fix problems (legitimate interest).
• To respond to support requests and enquiries (legitimate interest).
• To send service notifications you have chosen to receive (consent, which you can withdraw in Settings).
• To meet legal obligations, such as tax and accounting records (legal obligation).

4. Who we share it with

• Service providers that host and operate the platform (cloud hosting, database and authentication infrastructure).
• AI providers that process advisor questions to generate answers.
• Paddle.com, our Merchant of Record, which processes all card payments, manages subscriptions, handles tax compliance and issues invoices. Paddle is the seller of record on your bank statement and processes your payment data under its own privacy terms.
• Professional advisers (legal, accounting) where needed.
• Authorities where the law requires it.

Some of these providers process data outside South Africa. Where they do, we rely on appropriate safeguards such as contractual protections consistent with POPIA.

5. How long we keep it

We keep your personal information for as long as your account is active. When you delete your account, we delete or anonymise your personal information within 30 days, except where the law requires us to keep records (for example tax invoices) for longer.

6. Your rights under POPIA

You have the right to:

• access the personal information we hold about you;
• ask us to correct or delete it;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• complain to the Information Regulator (South Africa) if you believe we have mishandled your information.

You can exercise most of these rights in Settings, or by contacting us. We respond within 30 days.

7. Security

We use appropriate technical and organisational measures to protect your information, including encryption in transit and at rest, row-level access controls so users can only reach their own records, and restricted access to production systems.

8. Cookies

We use essential cookies and storage to keep you signed in and remember your preferences (such as language and notification choices). We do not use advertising cookies.