Privacy Policy & PoPIA Notice

This Policy explains how FINCREST PTY LTD (registration number 2025/522652/07), which operates TorenOne (“TorenOne”, “we”, “us”), collects, uses and protects personal information when you use the Service, in line with the Protection of Personal Information Act 4 of 2013 (“PoPIA”). Our Information Officer is Tylda Wilondja, reachable at admin@torenone.com.

1. Information we process

• Account data: your name, email, firm and role, used to authenticate you and scope your data to your firm.
• Project data: the frame descriptions, inputs and calculation packages you create. These may contain project details you choose to enter.
• Usage & technical data: logs, request metadata and aggregate product analytics (e.g. designs run, pass/fail, latency) used to operate, secure and improve the Service. These do not include the content of your descriptions.

2. How we use it (purpose & lawful basis)

• To provide the Service (perform our contract with you).
• To secure the Service and prevent abuse (legitimate interest).
• To improve reliability and accuracy via aggregate analytics (legitimate interest).
• To comply with legal obligations.

We do not sell your personal information.

3. The AI parsing step (third-party processing)

When you submit a free-text description, that text is sent to a third-party AI provider (currently OpenAI) to extract a typed specification. The text may therefore be processed outside South Africa. The AI does not compute any engineering value— those come solely from TorenOne’s deterministic kernel. Please avoid submitting personal or confidential information you are not entitled to disclose. Data submitted through the provider’s API is not used to train its models.

4. Storage, location & transfers

Account and project data are stored with our infrastructure providers under access controls that scope each firm’s data to that firm. Data is hosted in the European Union and South Africa. Where personal information is transferred across borders (e.g. the AI step, or hosting regions), we rely on the PoPIA section 72 conditions for trans-border flows.

5. Retention

We keep project data and calculation packages while your account is active and per our retention policy (report PDFs are subject to a defined retention window). We delete or de-identify personal information when it is no longer needed for the purposes above or as required by law.

6. Sharing & sub-processors

We share personal information only with operators (sub-processors) that help us run the Service, each under appropriate safeguards, and where required by law. These currently include:

• Supabase — database, authentication and report storage.
• Fly.io — hosting of the engineering service.
• Netlify — hosting of the web application.
• OpenAI — the AI parsing step (see section 3).
• Paddle — payment processing and invoicing (Merchant of Record).
• Sentry — error monitoring (when enabled).

We do not sell your personal information.

7. Security

• Authentication and per-firm access isolation (row-level security).
• Encryption in transit; private report storage with scoped, short-lived access links.
• Rate limiting, security headers and dependency scanning.

No system is perfectly secure; we will notify you and the Information Regulator of a compromise as required by PoPIA.

8. Your rights under PoPIA

You may, subject to PoPIA, request to:

• access the personal information we hold about you;
• correct or delete inaccurate or outdated information;
• object to certain processing; and
• lodge a complaint with the Information Regulator (South Africa).

To exercise these rights, contact our Information Officer at admin@torenone.com.

9. Children

The Service is intended for professional use and is not directed at children.

10. Changes & contact

We may update this Policy; material changes will be notified. Questions: FINCREST PTY LTD (TorenOne), Information Officer Tylda Wilondja, admin@torenone.com. See also our Terms of Service and Refund & Cancellation Policy.