Privacy Policy — Word Palette (DRAFT v2 — for attorney review)
⚠️ DRAFT — NOT LEGAL ADVICE. Company facts filled from the CIPC certificate (reg. 2025/307964/07). Items marked [ATTORNEY] need legal judgment; items marked [CONFIRM] need a founder fact-check. A South African attorney must review before this goes live.
Effective date: [set at publication] Responsible party (POPIA): AQUILANOCTUA (PTY) LTD, a private company registered in South Africa, registration number 2025/307964/07, registered office 23A Erica Road, George, Western Cape, 6529, trading as WordWorks Studio. Information Officer: Pieter du Plooy, hello@wordworksstudio.co.za. (POPIA default: the head of the private body. Registration with the Information Regulator — [ATTORNEY: confirm current registration requirement/portal step].)
1. Who we are and what this covers
This policy explains how AQUILANOCTUA (PTY) LTD t/a WordWorks Studio collects, uses and protects your personal information when you use Word Palette (the "Service"), in line with the Protection of Personal Information Act, 2013 (POPIA).
2. The personal information we collect
- Account data: email address and password (stored hashed by our authentication provider; we never see your password). [CONFIRM: no name field at signup.]
- Subscription and payment data: subscription status, plan and billing dates. Card payments are processed by Paystack; we never receive or store your card number. We hold a payment reference/token from Paystack to manage your subscription.
- Progress and reflection data: your journey progress, lesson state and any reflections/notes you enter — stored so you can resume across devices and power interruptions. Your reflections are private to your account.
- Technical data: IP address, device/browser information and similar, collected automatically for security and to operate the Service.
- Analytics: [CONFIRM tool once chosen — state name and whether anonymised.]
3. Why we process it, and our lawful basis
| Purpose | POPIA basis |
|---|---|
| Create and operate your account | Contract |
| Deliver the course; save progress and reflections | Contract |
| Take recurring subscription payments | Contract |
| Security, fraud prevention, service integrity | Legitimate interest |
| Service emails (receipts, payment notices, account/security notices) | Contract |
| Marketing emails, if introduced | Consent (opt-in, withdrawable) |
| Analytics / product improvement | [ATTORNEY: consent vs legitimate interest, per tool] |
4. Who we share it with (operators)
Contracted service providers processing on our behalf: Supabase (database, authentication, file storage), Vercel (hosting), Paystack (payments), YouTube/Google (video playback in privacy-enhanced mode), [CONFIRM analytics and email providers]. We do not sell personal information.
5. Cross-border transfers
[CONFIRM hosting regions for Supabase and Vercel — likely outside South Africa.] Where operators process data outside South Africa, we rely on [ATTORNEY: section 72 basis — operator bound by adequate protection / contract clauses / consent].
6. Retention
We keep personal information only as long as needed for the purposes above or as law requires: account and progress data for the life of your account [CONFIRM +grace period after deletion request]; billing records for [ATTORNEY: statutory period, typically 5 years under SA tax/financial legislation]. You may request deletion at any time, subject to legal retention duties.
7. Your POPIA rights
Access, correction, deletion, objection, withdrawal of consent, and complaint. Contact the Information Officer at hello@wordworksstudio.co.za. You may also complain to the Information Regulator (South Africa) — [ATTORNEY: insert current Regulator contact details at publication].
8. Security
TLS encryption in transit; row-level security on the database; hashed passwords; paid content delivered only via short-lived signed URLs to authenticated subscribers; least-privilege service access. No system is perfectly secure; we maintain reasonable, appropriate safeguards as POPIA requires and will notify affected users and the Regulator of a compromise as section 22 requires.
9. Cookies
Essential cookies only for authentication/session. [CONFIRM analytics cookies once the tool is chosen; update this section and any consent mechanism accordingly.]
10. Children
The Service is intended for adults (18+). We do not knowingly process children's personal information without a competent person's consent.
11. Changes
We'll post updates here with a new effective date and notify you of material changes by email or in-app.
12. Contact
AQUILANOCTUA (PTY) LTD t/a WordWorks Studio, 23A Erica Road, George, Western Cape, 6529. Information Officer: Pieter du Plooy — hello@wordworksstudio.co.za.