Privacy Policy

Service Providers

We use Cloudflare to run Vektor and store account records and uploaded files in D1 and R2, Resend to deliver transactional email, and Cloudflare Workers AI to analyse extracted tender text. These providers process only the data needed to deliver those services under their respective data-protection terms.

Tender analysis may send text extracted from your uploaded tender to the AI provider. Do not upload information that you are not authorised to process.

What Personal Information We Collect

We collect only the minimum information needed to provide Vektor.

From you directly:

• Account details (name, email, hashed password)
• Company profile (company name, CIPC registration number, SARS Tax Clearance PIN, CIDB CRS numbers, B-BBEE Level, contact email & phone)
• Statutory documents you upload (tax clearance, CIDB certificate, B-BBEE affidavit, COIDA letter, etc.)
• Tender documents you upload for analysis
• EFT proof of payment (bank statement extracts, transfer receipts)
• If you sign up using a referral link, the referral code and the resulting reward audit trail

Automatically:

• IP address, browser type, and session duration (for security & abuse prevention)
• Pages visited within Vektor and features used (for product analytics)
• Timestamps of tender analyses, credit usage, and expiry-alert delivery

We do not collect racial, religious, health, sexual, or biometric data. We do not use tracking cookies from advertising networks.

Why We Collect It

• Providing the Service: parsing your tender documents, calculating B-BBEE points, storing your compliance vault, sending expiry reminders.
• Account & billing management: authenticating you, processing EFT payments, invoicing, and refunds.
• Communications: transactional emails (password reset, payment confirmation, expiry alerts).
• Legal compliance & fraud prevention: retaining payment records under the Tax Administration Act.

How Long We Keep It

• Active account data: as long as your account is active.
• Uploaded documents: until you delete them, or 30 days after account termination.
• Payment records: 5 years after each transaction (Tax Administration Act Section 29).
• Server logs: 90 days rolling.

Your Rights Under POPIA

You have the right to:

• Access the personal information we hold about you (Section 23).
• Correct inaccurate or outdated information (Section 24).
• Delete your account and associated data, subject to legal retention requirements (Section 24).
• Object to processing on reasonable grounds (Section 11(3)).
• Complain to the Information Regulator if we mishandle your data.

To exercise any right, email support@vektorhq.co.za with the subject line “POPIA Request”. We respond within 30 days.

Security

We protect your data with:

• Better Auth password hashing and database-backed session management
• HTTPS/TLS 1.3 encryption in transit
• At-rest encryption on documents in R2 storage
• HttpOnly, Secure, SameSite session cookies
• Multi-tenant data isolation — your data is scoped to your account only

If we ever suffer a breach affecting your personal information, we will notify you and the Information Regulator within 72 hours as required by Section 22 of POPIA.

Bargaining Council Compliance & Verification

When you use Vektor to check CIDB, bargaining council, or statutory compliance, you remain responsible for verifying facts at the official sources. For your convenience we link directly to:

• CIDB Registers of Contractors ↗ — confirm CIDB grade, class, and status.
• CIPC eSearch ↗ — verify company registration.
• CSD (MAAA) portal ↗
• SARS TCS portal ↗
• BCCEI · NBCEI · MEIBC — sectoral bargaining councils.

Contact Us

Information Officer & Data Protection queries:

EcoBuiltConnect (Pty) Ltd
Email: support@vektorhq.co.za
Web: www.vektorhq.co.za

You can also review our Terms of Service for how the Service is provided.