Your privacy matters.

Account information: when you create an account we collect your name and email address, and, only if you choose to provide it, your South African ID number, which is used solely to pre-fill workflows and is never sold or shared for marketing.

Workflow information: when you complete or submit a workflow, we collect the information you enter and route it to the relevant organisation, keeping a copy in your submission history. Depending on the workflow this can include employment, financial (such as banking and tax details), recruitment and rostering information.

Special personal information: where a workflow requires it, and always on behalf of the organisation operating it, this may include special personal information, such as health or medical-aid details, race for employment-equity purposes, or background-check results, collected with the consent captured in that form.

Technical information: we keep only the minimal technical logs needed to run and secure the service (for example request and error logs via our hosting provider). We do NOT run third-party advertising or cross-site tracking, and we do not build advertising profiles of you.

To provide the service: operating your account, pre-filling and processing workflows, delivering submissions to the relevant organisation, and providing support, necessary to perform our agreement with you and for the legitimate interests of the organisations using the platform.

Workflow submission data is processed on behalf of, and under the authority of, the organisation whose workflow you completed. That organisation is the responsible party and determines how it uses that data.

To comply with the law, keep the platform secure, prevent fraud and abuse, and enforce our terms.

We never sell your personal information.

We share workflow submission data with the specific organisation whose workflow you completed. This is the purpose of the workflow and is disclosed to you at submission.

We use a small number of trusted service providers (operators) to run the platform, each bound by a data-processing arrangement and permitted to use your data only to provide their service to us: Clerk (sign-in and authentication), Convex (database, file storage and application backend), Resend (transactional email), Twilio (SMS and WhatsApp notifications), Polar (subscription billing), and Vercel (hosting).

Some of these service providers store or process information on infrastructure outside South Africa. Where personal information is transferred across borders, we do so on the bases permitted by POPIA (section 72): for example where the recipient is subject to laws or binding arrangements providing comparable protection, or where the transfer is necessary to perform our agreement with you.

We keep personal information only for as long as it is needed for the purpose it was collected, or as required by law. Our intended retention period for workflow submission records is 24 months.

To be straight with you about how that works today: automated deletion is not yet switched on. Several of the record types on this platform carry minimum retention periods under South African employment, tax and company law, and we are confirming those per record type before anything deletes on a schedule. Until that is in force, records are kept, and we delete or de-identify on request, subject to any period the law requires us to keep them and to the instructions of the organisation that owns the record.

Information is encrypted in transit using modern TLS, and is stored at rest on the infrastructure of our backend provider, Convex, which maintains SOC 2 Type II compliance. Access is controlled by role-based permissions, and integrations to and from the platform are signature-verified.

Authentication is handled by Clerk and Zelpano never stores your password. We continue to strengthen our safeguards, including additional protection for sensitive identifiers.

You have the right to ask what personal information we hold about you, to obtain a copy, to correct or delete it, to object to certain processing, and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact our Information Officer at support@zelpano.com, or submit a request online at zelpano.com/data-request. Where your information is held on behalf of an organisation (with Zelpano acting as its operator), we will direct your request to that organisation as the responsible party.

You may also complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za, general enquiries enquiries@inforegulator.org.za, tel 010 023 5200, inforegulator.org.za.

Zelpano uses strictly necessary cookies to keep you signed in and to keep the platform secure. We do not use advertising cookies or cross-site tracking cookies.

We may update this policy from time to time. When we make material changes we will update the effective date below and, where appropriate, notify you. Continued use of the platform after a change means you accept the updated policy.