Privacy policy

1. Introduction and scope

Vertigras (Pty) Ltd ("Vertigras", "we", "us", "our") is a South African applications development company. We design, build and publish our own software applications.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have under the Protection of Personal Information Act, 4 of 2013 ("POPIA"). It applies to everything we do, including:

• our applications, on every platform on which we publish them, including the Microsoft Store, Steam and other storefronts;
• our website and any related pages we operate;
• our dealings with clients, partners, suppliers, people who apply to work with us, and anyone who contacts us.

Where a particular product collects information not described here, or handles it differently, the product-specific terms in Annexure A apply in addition to this Policy. Where the two conflict, the product-specific terms prevail for that product.

We collect the minimum personal information necessary for the purpose at hand, and we protect it appropriately.

2. Who we are

For the purposes of POPIA, the responsible party is:

• Entity name: Vertigras (Pty) Ltd
• Registration number: 2024/227320/07
• Registered address: Greenpark Lifestyle Estate, Block 55 Unit 946, Witfield, Boksburg, Gauteng, 1459, South Africa
• Website: vertigras.com
• Email: admin@vertigras.com
• Telephone: 083 499 6271

Vertigras is the developer and publisher of record for the products we release, and holds the publisher accounts for the storefronts those products appear on.

3. Our Information Officer

Our Information Officer, registered with the Information Regulator of South Africa, can be contacted about anything in this Policy, about the personal information we hold, or to exercise any of the rights in section 13:

• Name: Sriram Maharaj (Founder)
• Email: admin@vertigras.com
• Telephone: 083 499 6271
• Postal address: as set out in section 2

We aim to acknowledge requests within 5 business days and to respond substantively within 30 days, or to tell you why we need longer.

4. When we are a responsible party, and when we are an operator

POPIA distinguishes between the party that decides why and how personal information is processed (the responsible party) and a party that processes it on someone else's behalf (an operator). Which role we occupy depends on the relationship.

We are the responsible party for the personal information of users of our own applications, visitors to our website, our business contacts, suppliers, and people who apply to work with us. This Policy governs that information.

We are an operator where we build, host or maintain software for a business client and, in doing so, process personal information belonging to that client's own customers, employees or users. In that role we act only on the client's documented instructions, we do not use that information for our own purposes, and the client remains the responsible party towards those individuals. Our handling of it is governed by our written agreement with that client, which includes the confidentiality and security obligations required by sections 20 and 21 of POPIA.

If your personal information reached us through a client's system and you want to exercise your rights over it, contact that organisation. If you contact us instead, we will refer you to them and notify them of your request.

5. What personal information we collect

What we collect depends on how you deal with us.

5.1 Users of our applications

• Account identifier. A username, account ID or player identifier that you choose or that is generated when you register, which lets us associate your content and settings with your account.
• Content you create. Text, saves, files, lists and other content you create or store in a product. You provide this at your discretion. We do not review, moderate or analyse it except as described in this Policy or where the law requires it.
• Technical and diagnostic information. Device type, operating system version, application version, crash reports, error logs and basic usage events, used to keep the product working. Where a product allows diagnostics to be switched off, your choice is honoured.
• Purchase and entitlement records. Where you buy a product or an in-product item, the storefront processes your payment, not us. We receive only the record that a purchase or entitlement exists, not your card or banking details.

5.2 Visitors to our website

Our website is informational. We do not use advertising or tracking cookies. Our hosting provider keeps standard server logs, which include IP addresses and request details, for security and diagnostics. If you email us from a link on the site, we receive whatever you choose to put in that email.

5.3 Business clients, partners and suppliers

Names, job titles, work email addresses, telephone numbers, employer details, contractual and billing information, and records of our correspondence and dealings with you.

5.4 People who apply to work with us

The information in your application: name, contact details, CV, work history, portfolio or code samples, and any notes we make during the process.

5.5 What we do not collect

We do not collect your real name, physical address, ID number, or financial account details through our applications, unless you voluntarily include that information in content you create. We do not buy personal information from data brokers, and we do not build advertising profiles.

If you choose to include special personal information as defined in section 26 of POPIA — such as health information, religious or philosophical beliefs, or biometric data — within content you create, you do so voluntarily, and we apply the safeguards in section 9 to it.

6. How we use personal information

We use personal information only for these purposes:

• to create and maintain your account, and to authenticate you when you sign in;
• to store, sync, back up and display your content to you across your devices;
• to deliver, update and support the products you have installed, and to honour purchases and entitlements;
• to respond to support queries and correspondence;
• to keep our products and systems secure, working and free from abuse, including investigating fraud, cheating and violations of our terms;
• to understand, in aggregate, how our products are used so that we can improve them;
• to perform our contracts with clients, partners and suppliers, and to invoice and be paid;
• to assess applications for work;
• to comply with our legal obligations and with the rules of the platforms we publish on.

We do not use your content for advertising or profiling. We do not use it to train artificial intelligence models, whether our own or anyone else's. We do not sell personal information to any third party.

7. Legal basis for processing

We process personal information on the bases recognised in section 11 of POPIA:

• Performance of a contract. Processing your account identifier and the content you create is necessary to provide the product you signed up for; processing client and supplier contact and billing information is necessary to perform our agreements.
• Consent. Where we ask for an optional permission — for example, location-based reminders, optional diagnostics, or marketing emails — we rely on your consent, which you may withdraw at any time without affecting the lawfulness of what came before.
• Legitimate interests. Securing our products, preventing abuse and fraud, and understanding aggregate product usage, balanced against your rights and interests.
• Legal obligation. Where the law, a court order, or a platform operator's lawful requirement obliges us to retain or disclose information.

8. Where we store information

Our primary hosting is with Amazon Web Services, on servers in the European Union (Ireland region). Accounts and sync for our applications, including Skedaddle and TomeVox, are provided by Supabase, which runs on Amazon Web Services infrastructure in Europe. Some supporting services — storefront platforms, error reporting, email and business administration tools — process limited information in other countries, including the United States.

Where personal information is transferred to or stored in a country outside South Africa, we ensure appropriate safeguards are in place in accordance with section 72 of POPIA. In practice this means the recipient is bound by contractual data protection commitments, including the provider's standard data processing terms, that give effect to principles substantially similar to those in POPIA and that restrict onward transfer.

We will tell you which providers hold information relating to you if you ask our Information Officer.

9. How we protect information

We apply reasonable technical and organisational measures to secure personal information against loss, damage, unauthorised access, interference and disclosure, as required by section 19 of POPIA. These include:

• encryption of data in transit using TLS, and encryption of stored user content at rest;
• secure password storage using industry-standard hashing;
• access controls limiting which personnel can reach account or user data, strictly to what support or maintenance requires;
• separation of client environments from one another and from our own product systems;
• encrypted backups, held on the same terms as the live data;
• regular software updates and security testing;
• written confidentiality and security obligations on every employee, contractor and service provider who may come into contact with personal information.

No system is perfectly secure. We review these measures as our products and the risks to them change.

10. Sharing and disclosure

We do not share your account identifier or the content you create with third parties, except:

• Service providers who host or process information strictly on our behalf, under contractual confidentiality and data protection obligations. Currently these are principally Amazon Web Services for hosting and storage, and Supabase (which runs on Amazon Web Services in Europe) for the accounts, sync and storage of our applications, including Skedaddle and TomeVox.
• Platform operators. Where you obtain a product through a storefront such as the Microsoft Store or Steam, that operator handles your account with them, your payment and your purchase record under its own privacy policy, not this one. We receive only the limited information the platform passes to us as publisher, such as the fact of a purchase, aggregate sales and usage reporting, and any support message you send through the platform.
• Development partners. Where a product is made with a co-developer or partner under a written agreement, we may share information about that product with them to the extent the agreement requires, subject to equivalent confidentiality and data protection obligations.
• Professional advisers, such as our auditors, accountants and attorneys, where necessary and under a duty of confidence.
• Where the law requires it, including a court order or a lawful request from a regulatory authority.
• Where necessary to investigate or prevent fraud, security incidents, or breaches of our terms of use.
• With your explicit consent, for example where you choose to share content with another user.

If our business or a product line is ever sold or transferred, personal information may transfer with it. We would notify affected users beforehand, and the recipient would be bound to handle it on terms no less protective than this Policy.

11. Export and portability of your content

Where a product offers an export or backup feature, it generates a downloadable file of your own content in that product's native format, so that you can keep a copy or re-import it on another device.

These principles apply wherever we offer such a feature:

• it covers only your own content, never another user's, even where something has been shared with you;
• export files are made available through a secure, time-limited in-product download rather than as an email attachment, so that your information is not left sitting indefinitely in an inbox outside our control;
• generated files that you do not download are deleted automatically after a short window;
• once you have downloaded a file to your own device, protecting it is your responsibility, since it is then outside our safeguards;
• turning the feature off stops future exports but does not delete files you have already downloaded.

The specific behaviour of each product's export feature, including whether it runs automatically and on what schedule, is set out in Annexure A.

If a product has no export feature, you can still ask our Information Officer for a copy of the personal information we hold about you, under section 13.

12. How long we keep information

We keep information longer only where the law requires it, or where it is needed for a dispute or investigation that is under way.

13. Your rights

Under POPIA you have the right to:

• be told what personal information we hold about you, and to receive a copy of it;
• have inaccurate, misleading or outdated information corrected;
• have personal information deleted, including your account and the content in it, where we have no lawful ground to keep it;
• object, on reasonable grounds, to processing based on our legitimate interests;
• withdraw consent at any time, where processing rests on consent;
• object to direct marketing at any time, and not to receive unsolicited electronic marketing;
• not be subject to a decision with legal consequences for you based solely on automated processing — we do not make such decisions;
• lodge a complaint with the Information Regulator, and to seek civil relief.

In most products you can exercise the core rights yourself from your account settings: export your content, correct it, or delete your account. Otherwise, contact our Information Officer using the details in section 3. We may ask you to confirm your identity before we act, so that we do not disclose your information to someone else. Access requests follow the procedure in the Promotion of Access to Information Act, 2 of 2000, and a prescribed fee may apply to a copy; we will tell you in advance if it does.

14. Children

Each of our products carries an age rating on the storefront where it is published, and the age restrictions applying to that product are stated in its store listing and in Annexure A.

We do not knowingly collect personal information from a child under 18 without the consent of a competent person, as section 35 of POPIA requires. If we learn that we have done so, we delete it promptly. A parent or guardian who believes a child has provided us with personal information should contact our Information Officer, and we will act on it.

15. Security compromises

If there are reasonable grounds to believe that personal information in our care has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected individuals as soon as reasonably possible after discovering it, as section 22 of POPIA requires, unless a public body tells us to delay so as not to impede an investigation.

The notification will describe what happened, what information was involved, what we are doing about it, and what you can do to protect yourself. Where we hold the information as an operator for a client, we notify that client immediately so that they can meet their own obligations.

16. Changes to this Policy

We may update this Policy to reflect changes in our products, our practices or the law. The date at the top shows when it was last revised, and the current version is always available on our website.

For material changes we will give notice in the affected product or by email before the change takes effect. Where a change requires your consent, we will ask for it rather than assume it.

17. Contact us and complaints

For any question about this Policy, or to exercise your rights, contact our Information Officer using the details in section 3.

If you are not satisfied with our response, you may complain to the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Complaints email: complaints.IR@justice.gov.za
• General enquiries: enquiries@inforegulator.org.za
• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Complaints to the Regulator are made on the prescribed form, which is available on its website.

Annexure A — Product-specific terms

This Annexure sets out, for each product, what it collects beyond the general position in section 5 and anything that works differently. A new entry is added when a product is released, and the date at the top of this Policy is updated.

A1. Skedaddle

What it is. A bullet-journal, to-do list and notes desktop application for Windows, distributed through the Microsoft Store. Your notes are stored in your Skedaddle account, so the same notes are available on every computer where you sign in.

Updates. Updates to the application are delivered by the Microsoft Store under Microsoft’s own terms and privacy policy.

Age restriction. 18 years and older, consistent with the age rating on each storefront where it is published.

Plans and purchases. Skedaddle is offered as a subscription, billed monthly or annually, and starts with a free trial. Subscriptions are bought through the Microsoft Store, which processes your payment and manages billing, renewals, cancellations, the end of your free trial and refunds under Microsoft’s own terms. We receive only the record of which plan you have, whether you are in a trial, and for how long your subscription runs, never your card or banking details (section 5.1).

Your account. Skedaddle requires an account. You sign up with an email address and a password. We use your email address to create and secure your account, to confirm it, and to send you messages about your account, the service or this Policy. We do not send you marketing unless you opt in. Your password is held by our authentication provider only as a secure hash, and we never see it.

What it collects. Your email address, and the content you create: list items, notes, labels, dates and repeat rules, saved filters (“loadouts”), and pictures you paste into notes or list items. It also stores your app settings, such as theme, layout and filters, so that they follow you from one computer to another. A few display preferences, such as zoom level and the page you are on, stay on each computer and are not synced. Nothing beyond the categories in section 5.1.

How syncing works. Skedaddle keeps a working copy of your content on your computer so that it responds instantly and keeps working when you are offline. Changes are synced to your account in the background whenever you are connected, and appear on your other computers when you sign in there.

Who can see your content. Only you. Every record and picture in your account is protected by access rules in our database, so that only your signed-in account can read or change it. Skedaddle has no feature for sharing content with other users. Section 9 describes how we protect it.

Optional permissions. None. Skedaddle does not ask for access to your location, contacts, camera or microphone.

Analytics and advertising. None. Skedaddle contains no analytics, advertising or third-party tracking.

Export feature. Skedaddle does not currently offer an export or backup feature. You can ask our Information Officer for a copy of your content under section 13. If an export feature is added, this entry will be updated and section 11 will apply to it.

Signing out and deleting your account. Signing out removes your account’s content from that computer; it stays in your account. To delete your account and all of its content, contact our Information Officer using the details in section 3. We delete it within the periods in section 12. Uninstalling Skedaddle from Windows (Settings › Apps) removes the application and its local copy, but not your account.

Hosting. Your account, synced content and pictures are hosted by Supabase, on Amazon Web Services infrastructure in Europe. Section 8 applies.

A2. TomeVox

What it is. An audiobook player desktop application for Windows, distributed through the Microsoft Store, for the audiobook files you already own, in formats including m4b, m4a, mp3, aac, ogg, opus, flac and wav. Your listening progress is kept in your TomeVox account, so you can pick up where you left off on any device where you sign in.

Updates. Updates to the application are delivered by the Microsoft Store under Microsoft’s own terms and privacy policy.

Age restriction. 18 years and older, consistent with the age rating on each storefront where it is published.

Plans and purchases. TomeVox is offered as a subscription, billed monthly or annually, and starts with a free trial. Subscriptions are bought through the Microsoft Store, which processes your payment and manages billing, renewals, cancellations, the end of your free trial and refunds under Microsoft’s own terms. We receive only the record of which plan you have, whether you are in a trial, and for how long your subscription runs, never your card or banking details (section 5.1).

Your account. TomeVox requires an account. You sign up with an email address and a password. We use your email address to create and secure your account, to confirm it, and to send you messages about your account, the service or this Policy. We do not send you marketing unless you opt in. Your password is held by our authentication provider only as a secure hash, and we never see it.

What syncs to your account. Your email address; your listening progress and position in each book; your bookmarks and favourites; the book details you edit, such as title, author and series; your settings; and the information needed to recognise the same book on each of your devices, such as its title, author, series and length. Nothing beyond the categories in section 5.1.

What stays on your device. Your audio files, which are never uploaded. TomeVox reads them in the folders and files you choose to add, and never copies, moves or re-tags them; it deletes them only if you choose a delete option and confirm it twice. Your library database, cover images and diagnostic log files are also kept on your device, in the application’s own storage in your Windows user profile. The application keeps only its 20 most recent log files and deletes older ones automatically.

Who can see your data. Only you. Everything in your account is protected by access rules in our database, so that only your signed-in account can read or change it. Section 9 describes how we protect it.

Windows media controls. While a book plays, TomeVox shows its title, author and cover in Windows’ own media controls, so that media keys and the volume card work. This is handled by Windows on your device.

Optional permissions. None, beyond access to the folders and files you choose to add.

Analytics and advertising. None. TomeVox contains no analytics, advertising or third-party tracking.

Support requests. Log files can include file names, folder paths and book titles. They stay on your device unless you choose to send one to us with a support request. If you do, we use it only to resolve that request and keep it as support correspondence under section 12.

Deleting your data. Settings › Danger zone › “Factory reset” deletes TomeVox’s database, settings and cover images from your device, and uninstalling TomeVox from Windows (Settings › Apps) removes the application; neither deletes your account. To delete your account and everything synced to it, contact our Information Officer using the details in section 3. We delete it within the periods in section 12.

Hosting. Your account and synced data are hosted by Supabase, on Amazon Web Services infrastructure in Europe. Section 8 applies.