Privacy policy

POPIA · South Africa · Version 1.0 · effective 6 September 2026

ArrayTrace is the responsible party for personal information processed through ArrayTrace. This policy says what we hold, why we hold it, how long we keep it, who else sees it, where it goes and what you can make us do about it. It is read with our terms of use and our data protection notice, and with our PAIA manual.

1. Who is accountable

the Protection of Personal Information Act 4 of 2013 requires us to name one person accountable for how personal information is handled here, and to make them reachable. That is our Information Officer.

Registration of the Information Officer with the Information Regulator (South Africa), as section 55 of POPIA requires, is in progress.

2. What we hold

What you give us directly. Your name and email address, the team you belong to and your role in it, and your password stored only as a hash. If your firm subscribes, the billing records that follow from that - never your card number, which is held by the payment provider and never reaches us.

What you put into the product. Sites and their coordinates, the client name and contact details you record against a project, designs, weather selections, simulations, financial models and the proposals you generate. This is your firm's working material and we process it to run the service.

What the service records as it runs. An audit trail of who changed what and when, application logs, and sign-in attempts including ones that fail.

What you send us about the product. If you use the feedback button, the message you write, the page you were on, and any screenshot you chose to attach.

3. Why we are allowed to

• To perform our contract with you - creating your account, storing your designs, running simulations, producing documents, taking payment.
• Because we have a legitimate interest - keeping accounts secure, detecting abuse, and diagnosing faults. The ground we rely on for security processing is section 11(1)(d) of POPIA.
• Because the law requires it - keeping financial records for the periods tax legislation sets, and answering lawful requests.

We do not sell personal information, and we do not use your projects, designs or client data to train any model.

4. Site coordinates are treated as sensitive

A site coordinate identifies both a person's home and a customer's commercial pipeline, so it is handled as sensitive throughout. Application logs record a project by its identifier and never by address or coordinate, and the audit trail carries the same restriction. Passwords, tokens, identity numbers and banking details are never written to a log in any form. The same rule applies to feedback: an item is logged by its reference and the page path, never by what somebody wrote.

5. Sign-in records

Sign-in, registration, password-reset and email-verification events record the address that was tried, including attempts that fail. This is necessary to detect credential-stuffing and brute-force attacks against your account, and it is the one deliberate exception to the rule above that email addresses are not written to logs. It relies on the legitimate-interest ground in section 11(1)(d) of POPIA. Passwords are never recorded, in any form, on any code path.

6. How long we keep it

Account and project data

While your team is active. Erasing the team removes it.

Audit trail

For as long as the team exists. It is what answers "who changed this figure", so it deliberately outlives the record it describes.

Application logs

Rolled daily and kept for 30 days, then deleted. They carry identifiers, not addresses or coordinates.

Financial records

Five years, which is what the tax legislation that applies to us requires. This outlasts an account being closed, and it is the one thing erasing a team does not remove.

Feedback

Until the defect it describes is resolved and the item is closed. It is not attached to your team's estate, and erasing a team leaves the reports that team made standing.

7. Who else sees it

Your own team. A project belongs to the team, not to the person who made it, so everybody in your team can see it. That is the product working, and it is worth knowing before a personal note goes into a project field.

Anybody you share a project with. A share link is view-only and shows the site and the proposals you generated. Anybody holding the link can open it, so withdraw a share when it is no longer wanted; that takes effect immediately.

If you are reading this because somebody sent you a link rather than because you have an account: we hold nothing about you. The page you were sent belongs to the firm that sent it, and we have no name, address or account for you. Opening it asks a map service for the tiles around the site, which is a request your browser makes and which carries your network address to that service the way any hosted map does. The page also remembers where you had scrolled to, in your own browser, and that never reaches us.

Our own staff. Whoever operates this deployment can see accounts, teams and settings in order to support them. Those screens are restricted to named administrators and every role change is written to the audit trail with a reason.

Service providers. Each one is listed in section 8 below with what it receives and where it is, rather than described in general terms.

Authorities, where we are legally compelled.

8. Where it is kept, and what leaves the country

Customer data is held on our own servers in South Africa and is processed under South African law.

Some of what the product does calls a service outside that boundary. Every one of them is listed here with exactly what it receives, because "we use third-party services" does not tell you whether your site coordinate left the country. Where a transfer does leave South Africa it is made under section 72 of POPIA, on the ground that it is necessary to perform the contract you have with us.

The payment provider · South Africa

Taking subscription payments. The amount, a merchant reference and the billing email address. Card numbers are entered on the provider's own page and never reach us.

The mail service · As configured for this deployment · leaves South Africa

Sending the messages the product sends. The recipient's address and the message itself. Which provider carries it, and therefore where it is handled, is configured for this deployment.

Map imagery and geocoding · United States · leaves South Africa

Drawing satellite imagery under a design, and turning an address into a point. The address or place name being searched, and the map tiles a browser asks for while somebody pans. A tile request carries the viewer's own network address to the provider, which is true of any hosted map.

The open geocoder and building-footprint service · European Union · leaves South Africa

Address lookup and roof outlines where the licensed provider is not configured. A search term, or a bounding box around the area being drawn. Nothing it receives identifies a person.

The irradiance service · European Union · leaves South Africa

The weather year a design is simulated against. A grid-cell coordinate. The site's own coordinate is snapped to the grid before the request leaves us, so the exact position of a customer's site is not what goes out. Nothing it receives identifies a person.

The reference exchange rate service · European Union · leaves South Africa

The indicative second currency shown beside a price. A currency pair and a date. No customer data of any kind. Nothing it receives identifies a person.

The document-reading service · United States · leaves South Africa

Reading a manufacturer datasheet or a published tariff into catalogue figures. The text of the datasheet or tariff document being read. These are manufacturers' and utilities' published documents. No project, design, client or account data is sent, and nothing sent is used to train a model. Nothing it receives identifies a person.

The component certification register · United States · leaves South Africa

Refreshing the certified-equipment list, and only when an administrator asks. Nothing. We download the published register from them; nothing of ours goes back. Nothing it receives identifies a person.

A service that receives nothing identifying a person is still listed, because the way to show that a transfer is harmless is to say what it carries rather than to leave it out.

9. Cookies, and what we do not do with them

This site sets three cookies. All three are necessary for it to work at all, and there is no analytics, no advertising network, no tag manager and no tracking pixel anywhere on it. That is why you are not being asked to accept anything: a banner asking permission for a cookie that keeps you signed in would be theatre, and consent is not the ground we rely on for any of them.

Sign-in

Keeps you signed in between pages. Set when you sign in, cleared when you sign out.

Form protection

Set on every page, signed in or not. It is what stops another site submitting a form to us as you, so it has to exist before you have done anything.

Status message

Carries a one-line notice across a redirect - "your password has been changed". Read once and discarded.

The designer and a shared project also keep a little state in your own browser's storage: a map session and where you had scrolled to. It never leaves your device and we cannot read it.

10. What you can make us do

• See it. Your team's whole estate exports as JSON from Your data, and your own account data from your profile. Both need you to be signed in; if you no longer have an account, write to the Information Officer at privacy@arraytrace.com instead.
• Correct it. Your own details from your profile; your firm's from the team screens.
• Erase it. A team's owner can erase the whole team from Your data. It is the one operation in the product that deletes rather than archives, it takes the projects, designs, simulations and documents with it, and it cannot be undone.
• Object, or withdraw consent, where we relied on either.
• Complain - to us first, and to the Information Regulator (South Africa) if our answer does not satisfy you. Their details are on the data protection notice.

We answer a request within 30 days. We may ask you to prove who you are first, because handing somebody's records to whoever asks for them is its own breach. Where erasing something would break a record we are obliged to keep, we will say so and say exactly what is retained and why, rather than quietly keeping it.

11. Security

Traffic is encrypted in transit. Passwords are hashed, never stored or recoverable. Third-party credentials in the administration console are encrypted at rest against the deployment's own key ring. Every team's data is separated by a filter applied at the database query itself, not by each screen remembering to ask. A URL from another team's account therefore resolves to nothing rather than to their pipeline.

12. If something goes wrong

If we have reasonable grounds to believe your personal information has been accessed or acquired by somebody not entitled to it, section 22 of POPIA requires us to tell the Information Regulator (South Africa) and to tell you. We aim to do both within 72 hours of establishing those grounds, and we will not wait until we have the whole picture before telling you there is one.

The notice will say what happened, which of your information was involved, what we have done about it, and what you can do to protect yourself. It comes from the address on your account, written plainly and not inside a marketing template. If we cannot reach you individually we will publish it on the data protection notice.

13. Changes

We may change this policy. A material change bumps the version above and is notified to the email address on your account before it takes effect; a correction of wording is simply made. Because the text is held in source control, what changed and when is a matter of record.