Privacy Policy

Last updated: 28 September 2026

1. Who we are

DataDam ("DataDam", "we", "us", "our") operates a self-hosted IoT telemetry platform for agricultural and property monitoring, together with the Brew Butler, Vault Guard and Shepherds Watch modules built on top of it, accessible via app.datadam.co.za, the module sites linked from datadam.co.za, and the DataDam Android app. This policy explains what personal information we process, why, and the choices and rights you have.

DataDam is based in South Africa, and this policy is written with reference to the Protection of Personal Information Act, 2013 (POPIA). If you access DataDam from outside South Africa, your information may still be processed here as described below.

[Registered business name and physical address to be added here if DataDam operates under a registered legal entity.]

2. Information we collect

What we collect depends on which parts of DataDam you use.

Account information

• Name, email address and phone number provided at registration or by an administrator who creates your account.
• Your password, stored only as a salted hash — we cannot see or recover it.
• Your role and module access (e.g. Brewer, Armourer, Shepherd), and, if you enable it, a two-factor authentication (TOTP) secret, stored encrypted.

Subscription and payment information

• Billing is handled by our payment processor, Paystack, via their own hosted checkout page. Your card details are entered directly with Paystack and never reach DataDam's servers.
• We store only payment references returned by Paystack (customer code, authorization code, subscription code) plus your card's brand, last four digits and expiry date for display purposes — all encrypted at rest.

Telemetry and device data

• Readings from IoT hardware nodes you register (for example weather, humidity, soil moisture, light, water, air quality, contact, motion and RFID sensors), along with device identifiers, timestamps and, where applicable, the location you assign to a device.
• Weather forecast data is retrieved from the Norwegian Meteorological Institute (yr.no / met.no) for locations you configure.

Module-specific data you enter

• Brew Butler: recipes, ingredient inventory, batches, equipment and water profiles.
• Vault Guard: firearm and ammunition inventory, vault and security records, customer and licence records, and photographs of paper stock registers you upload for OCR-assisted digitisation (processed by a self-hosted OCR service — your photographs are not sent to a third-party cloud AI provider).
• Shepherds Watch: herd, animal, camp and grazing records, including manually entered GPS coordinates displayed on a map, vaccination schedules and RFID gate movement records.

Communications

We send transactional emails — account activation, password reset, billing notices, and device or security alerts you configure — and keep a log of these for delivery troubleshooting and audit purposes.

Technical information

Like most web services, our servers log standard technical data such as IP address, browser and device type, and request timestamps. We use Cloudflare Turnstile to distinguish human visitors from bots on login, registration and password-reset pages; this does not track you across other websites.

3. How we use information

• To create and administer your account, and authenticate you securely.
• To operate the platform: ingest and display telemetry, run the dashboards, and provide the features of whichever modules you subscribe to.
• To process payments and manage your subscription, including billing notices and renewal or expiry reminders.
• To send you service communications, and alerts you have configured (for example a vault humidity breach or a batch temperature warning).
• To detect and prevent fraud, abuse and automated (bot) access.
• To meet legal and regulatory obligations — for example, Vault Guard's stock register features exist to help firearm dealers meet their own recordkeeping obligations under South African firearms legislation.
• To maintain and improve the reliability and security of the service.

We do not use your personal information to serve third-party advertising, and we do not sell personal information.

4. Our legal basis for processing

Under POPIA, we process personal information on one or more of the following bases:

• Performance of a contract — to provide the DataDam service you or your organisation has signed up for.
• Consent — for example, when you opt in to a specific alert or communication.
• Legitimate interests — such as keeping the platform secure and preventing fraud, balanced against your rights.
• Legal obligation — such as retaining records that firearms or other regulated-industry legislation requires you, as the account holder, to keep.

5. How we share information

We share personal information only with the service providers needed to run DataDam, and only to the extent necessary:

• Paystack — payment processing (Paystack (Pty) Ltd, a licensed payment service provider).
• Cloudflare — bot protection (Turnstile) on authentication-related pages.
• Google — Google Maps, to display location data you have entered (e.g. camp/grazing coordinates).
• Our hosting and email delivery providers — to run the servers and deliver transactional email.

We may also disclose information where required by law — for example, in response to a valid request from the South African Police Service in connection with firearms recordkeeping, or another lawful order from a competent authority.

6. Data security

• Passwords are stored as salted hashes, never in plain text.
• Sensitive stored values — two-factor authentication secrets and Paystack payment references — are encrypted at rest.
• All traffic to DataDam is encrypted in transit (HTTPS).
• Access to administrative and regulated-module functions (such as Vault Guard's firearm records) is restricted by role, and significant actions are recorded in an audit log.

No system is completely secure, but we design and review DataDam with these protections as a baseline, not an afterthought.

7. Data retention

We retain personal information for as long as your account is active, or as needed to provide the service, meet the legal and regulatory obligations described above (including firearms recordkeeping retention periods that apply to Vault Guard users), resolve disputes, and enforce our agreements. If you deactivate your account, we retain a minimal record rather than immediately erasing everything, so that the same email address cannot be used to circumvent a deactivation; you can request deletion as described below.

8. Your rights

Under POPIA, you have the right to:

• Ask us to confirm what personal information we hold about you, and access a copy of it.
• Ask us to correct information that is inaccurate, out of date, incomplete or misleading.
• Ask us to delete or destroy personal information we no longer have a legal basis to keep.
• Object to our processing of your personal information on reasonable grounds, or withdraw consent you previously gave.
• Lodge a complaint with South Africa's Information Regulator if you believe we have not handled your information properly.

To exercise any of these rights, contact us using the details below. The Information Regulator can be reached at inforegulator.org.za.

9. Cookies and similar technologies

DataDam uses browser storage to keep you signed in (your session token) and to remember preferences such as your chosen theme. Cloudflare Turnstile may set a cookie to complete its bot check. We do not use third-party advertising or cross-site tracking cookies.

10. Children's privacy

DataDam is intended for business and personal use by adults managing property, livestock, brewing or firearms inventory, and is not directed at children. We do not knowingly collect personal information from children.

11. International data transfers

Some of our service providers (for example Paystack, Cloudflare and Google) may process data on infrastructure located outside South Africa. Where this happens, we rely on those providers' own safeguards for cross-border data transfer as part of engaging them.

12. The DataDam Android app

The DataDam Android app is a wrapper around the same app.datadam.co.za web application described throughout this policy — it does not collect any additional personal information beyond what is described above, and does not request access to your device's camera, contacts, or precise location.

13. Changes to this policy

We may update this policy from time to time, for example as DataDam adds new features or modules. We will update the "Last updated" date above when we do. Material changes affecting how we handle your information will be communicated to registered users by email.

14. Contact us

Questions about this policy, or a request to exercise any of the rights above, can be sent to:

• Email: info@datadam.co.za