Privacy policy

This policy explains what personal information Kasynga collects, why, who it is shared with and the rights you have over it under the Protection of Personal Information Act 4 of 2013 (POPIA).

Who we are

Kasynga is operated by Numstack Pty Ltd, 173 Oxford Rd, Rosebank, Johannesburg, 2196, South Africa. For this policy we are the responsible party for the personal information described below.

Our Information Officer is Elvis Magagula, our CEO. Write to hello@kasynga.com about this policy or anything else.

Two roles, depending on the information

• Information about you. Your email when you request early access, your account and how you use our public pages. Here we are the responsible party.
• Information you put into Kasynga. The people, reviews, check-ins, courses and other records you keep in your workspaces. Here your organisation is the responsible party and we are its operator. We process those records only to run the service for you, and we keep them confidential and secure as POPIA requires of an operator.

What we collect

• Early access. Your email address, and which page or template you asked from.
• Your account. Your name and email address, and your password, which we store only as a one-way hash. If you sign in with Google, we receive your name and email address from Google.
• Your content. Whatever you and your team enter into your workspaces, including information about the people on your team.
• Use of our public pages. Pages visited, buttons and links clicked, your browser and device type, and an approximate location, through Google Analytics. We never record what you type.
• Security records. Your IP address, browser and a device cookie, used to keep accounts safe and to spot misuse.
• Messages. When Kasynga sends email or Slack messages for your team, the address or Slack account it sends to and what it sends.

Why we use it, and on what basis

• To run the service you signed up for: your account, your workspaces, the automations and agents you set up. This is necessary to perform our agreement with you.
• To keep you updated on early access and development progress. With your consent, given when you request early access. You can withdraw it at any time.
• To keep Kasynga secure and to improve it, including our public pages. This is in our legitimate interest, and we keep it to what that requires.
• To meet our legal obligations.

We do not sell personal information, and we do not use it for anyone else's marketing.

Special personal information and children

We do not ask for special personal information, such as health, religion or biometric details. Kasynga is for people aged 18 and over. If your organisation records information about its people in Kasynga, it is responsible for having a lawful basis to do so and for telling those people.

Who we share it with

We share personal information only with the operators that help us run Kasynga, under agreements that require them to keep it confidential and secure.

Operator	What for	Where
Fly.io	Hosting the app and its database	Johannesburg, South Africa (a United States company)
Resend	Sending email	United States
Anthropic	AI features, when you use them	United States
Google	Sign in with Google, Google Analytics on our public pages, and web fonts	United States
Slack	Delivering messages, only if your team connects it	United States

We may also disclose information where the law requires it.

Information sent outside South Africa

Some of our operators process information in the United States. We send it only where POPIA section 72 allows it, under binding agreements that give it protection substantially similar to POPIA's, or where the transfer is necessary to provide the service you asked for.

How long we keep it

• Your early access email until you ask us to remove it, or 24 months after our last contact, whichever comes first.
• Your account and content for as long as your account is open. When you ask us to close it, we delete both within 90 days, except where the law requires us to keep something longer.
• Google Analytics records for up to 14 months.
• Security records for up to 12 months.

How we protect it

We encrypt information in transit, store passwords only as one-way hashes, limit who on our team can reach personal information, and keep the database on a private network. If we have reason to believe your personal information has been accessed without authority, we will tell you and the Information Regulator as POPIA section 22 requires.

Cookies

Cookie	What it does	How long
sym	Keeps you signed in	Until you sign out, or it expires
symd	Recognises your browser, for account security	Long lived
gstate, gsaid	Complete a Google sign-in safely	Ten minutes or less
_ga and _ga_*	Google Analytics, on our public pages only	Up to two years

The signed-in app does not load Google Analytics. You can block or delete cookies in your browser settings, though signing in needs the first three.

Your rights

Under POPIA you may ask us

• whether we hold personal information about you, and for a copy of it;
• to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• to stop processing it, where you object on reasonable grounds;
• to stop sending you updates, at any time, through the link in any email or by writing to us.

Write to our Information Officer to use any of these rights. We will answer within a reasonable time, and we may ask you to confirm who you are first. If your request concerns information your organisation keeps in Kasynga, we will pass it to them, since they decide what happens to it. Our manual under the Promotion of Access to Information Act 2 of 2000 is available on request.

Complaints

If you are unhappy with how we handle your personal information, tell us first and we will try to put it right. You also have the right to complain to the Information Regulator (South Africa), at inforegulator.org.za.

Changes to this policy

When we change this policy we will update the date at the top, and tell account holders by email about any change that matters.