Effective date: 2026-03-25

Privacy policy

Introduction#

Strukturs (“we”, “us”, or “our”) operates the platform at strukturs.ai. This privacy policy explains how we collect, use, store, and protect your personal information when you visit our website, create an account, or use our services.

We are committed to processing your data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (GDPR) and South Africa's Protection of Personal Information Act (POPIA).

Information we collect#

• Account data — name, email address, organisation name, and role when you register.

• Usage and analytics data — pages visited, features used, session duration, and device information collected via cookies and similar technologies.

• Uploaded financial documents — files you upload to the Vault or Finance Scaler for processing. These are stored in your isolated tenant environment and never used for model training.

• Cookies — we use essential, analytics, marketing, and personalisation cookies. You can manage your preferences at any time via our cookie settings.

How we use your information#

• Service delivery — to provide, maintain, and improve the platform and your tenant environment.

• Analytics — to understand usage patterns and improve product experience (only with your consent).

• Communication — to send service-related notifications and, where you consent, marketing updates.

• Security — to detect, prevent, and respond to fraud, abuse, or security incidents.

Legal basis for processing (GDPR)#

We rely on the following legal bases under Articles 6 and 9 of the GDPR:

• Consent — for analytics and marketing cookies, and optional communications.

• Contractual necessity — to perform our obligations under your subscription agreement.

• Legitimate interest — to improve and secure the platform, provided these interests do not override your rights.

• Legal obligation — where processing is required by applicable law.

POPIA compliance#

As a responsible party under POPIA, we process personal information of South African data subjects in accordance with the following conditions for lawful processing:

• Accountability — we take responsibility for ensuring compliance with POPIA's conditions.

• Processing limitation — personal information is processed only for a specific, lawful purpose.

• Purpose specification — we collect information for defined purposes and retain it only as long as necessary.

• Information quality — we take reasonable steps to ensure personal information is complete and accurate.

• Security safeguards — appropriate technical and organisational measures protect your information against loss, damage, or unauthorised access.

You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

Data sharing and third parties#

We do not sell your personal information. We may share data with trusted infrastructure providers (hosting, analytics, email delivery) who process it on our behalf under strict data processing agreements. We only share data where necessary to deliver the service or where required by law.

Data retention#

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account data is retained for the duration of your subscription and deleted within 90 days of account closure, unless a longer retention period is required by legal obligation.

Financial documents stored in your Vault remain your property. Upon subscription termination, you may export your data during a 30-day grace period before it is permanently deleted from our systems.

Your rights#

Under GDPR and POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you.

• Rectification — request correction of inaccurate or incomplete information.

• Erasure — request deletion of your personal information where there is no compelling reason for continued processing.

• Data portability — receive your data in a structured, machine-readable format.

• Objection — object to processing based on legitimate interest or direct marketing.

• Restriction — request that we limit the processing of your personal information in certain circumstances.

• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at the address below. We will respond within 30 days (or as required by applicable law).

Cookies#

We use cookies to provide essential site functionality, analyse traffic, deliver personalised content, and support marketing efforts. Essential cookies cannot be disabled. You can manage your cookie preferences at any time by opening our cookie settings panel.

International data transfers#

Your data may be transferred to and processed in countries outside of South Africa or the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and equivalent protections under POPIA Section 72.

Children's privacy#

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Changes to this policy#

We may update this privacy policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. The effective date at the top of this page reflects the latest revision.

Contact us#

If you have questions about this privacy policy or wish to exercise your data subject rights, please contact us:

Strukturs Email: <privacy@strukturs.ai>