AgriTrekker Privacy Policy

This Privacy Policy explains how Agri Sync Solutions (Pty) Ltd ("we", "us", "our") collects, uses, stores and shares Personal Information when you visit our website at agritrekker.co.za, register or use the AgriTrekker web application, mobile application and AI Assistant (together, the "Service"), or contact us.

It is written to comply with the Protection of Personal Information Act, 4 of 2013 ("POPIA"). It forms part of our Terms of Service. Words defined in the Terms of Service have the same meaning here.

1. Who we are

Agri Sync Solutions (Pty) Ltd
Registration number: 2024/505036/07
Registered address: 94 Merriman Avenue, Stellenbosch, 7600, South Africa
Email: support@agritrekker.co.za
WhatsApp: +27 62 117 0782

Information Officer: Louis Anthony Wilkinson, louis@agritrekker.co.za

2. Our two roles under POPIA

The Service is used by businesses (our customers), and those businesses enter information about their own employees and operations. That creates two different roles:

2.1 We are the responsible party for

• the people who register and administer a Business Account (owners, managers, accountants and administrators);
• billing and payment records;
• support requests, feedback and error reports;
• visitors to our website and people who contact us; and
• analytics and advertising measurement described in section 9.

For this information, we decide why and how it is processed, and this Policy describes that processing.

2.2 The Business is the responsible party, and we are its operator, for

• Business Data: fuel logs, tank and pump readings, vehicles, equipment, farms, repair and maintenance records, photographs, documents, reports and AI Assistant conversations;
• the employee accounts the Business creates so that its staff can use the mobile application; and
• any other Personal Information the Business enters into the Service.

For Business Data, the Business decides what to record and why. We process it only to provide the Service and on the Business's instructions, under section 10 of the Terms of Service. If you are an employee of a Business that uses AgriTrekker and you have questions about how your information is used, please contact your employer first. We will assist them where reasonable.

3. What we collect

3.1 Account information (web application)

When someone registers, we collect their name, email address, phone number, preferred language and the date of registration, and we create a Firebase Authentication account with a password (which we cannot see). We also record which Businesses the person belongs to, their role in each, and when they were last active.

3.2 Employee accounts (mobile application)

A Business creates accounts for its employees by choosing a name, a username and a password and assigning a role. We convert the username into an internal login identifier in the form username@agritrekker.co.za; this is not a real mailbox and receives no email. We do not collect employee identity numbers, personal email addresses, personal phone numbers or photographs of employees.

3.3 Business and billing information

For each Business we store its name, contact phone number and the identity of the person who created it. If the Business subscribes, we collect billing name, billing email, billing phone, physical address, company registration number and VAT number where supplied, and an invoice history.

3.4 Payment information

Card payments are processed by Paystack. We never receive or store your full card number or security code. From Paystack we receive and store the last four digits, card brand and expiry date, a payment authorisation token and a customer reference so that we can renew your Subscription and show you which card is on file. EFT payments are matched against the payment reference on your invoice; we do not store your banking details.

3.5 Business Data (as operator)

Everything Users capture in the Service, including:

• fuel refuels, tank fills, transfers and pump readings, with quantities, prices, odometer readings, timestamps, the vehicle or tank involved, the farm or location selected (a name you defined, not GPS), and the name of the User who logged it;
• vehicles and equipment, including registration numbers;
• repairs and maintenance records, including who reported, was assigned to and completed a task, costs, hours, and photographs taken with the device camera or chosen from its photo library;
• documents and images attached to the AI Assistant, and AI Assistant conversations;
• an action log of who did what and when, which is visible to the other Users of the same Business.

We do not collect device location. The mobile application does not request location permission. Photographs are stored as uploaded; we do not currently remove embedded metadata, so you should be aware that some cameras embed location data in photographs.

3.6 Device and technical information

• Push notification tokens for each device on which the mobile application is signed in, with the platform (iOS or Android) and last-seen date, so that we can deliver alerts. Tokens are removed on sign-out and when they become invalid.
• Error reports generated automatically when something goes wrong in the application: the error message and stack trace, the screen you were on, your user ID, email and name, your Business ID, browser or device information, and the application version.
• Standard server logs (IP address, request time, user agent) kept by our hosting provider for security and troubleshooting.

3.7 Support, feedback and contact

When you send feedback through the application we collect your name, Business, the feedback text and any contact email or phone number you provide. When you email or WhatsApp us, we keep the correspondence. When you use the contact or booking forms on our website we collect the details you enter and send them by email to our team.

4. Why we use it, and our lawful basis

We do not use your Personal Information for automated decision-making that has legal or similarly significant effects on you.

5. Marketing

We do not send marketing emails, newsletters or advertising to our customers. The emails we send are transactional: invoices, payment notices, fuel summaries, subscription notices and alerts. We do not market third-party products or services. From time to time we may tell existing customers about new AgriTrekker features or products, for example by WhatsApp, in the course of our ordinary relationship with you; you can ask us to stop at any time.

6. The AI Assistant

When a User uses the AI Assistant, their messages, any images they attach, and the parts of the Business Data needed to answer (for example fuel logs, vehicle records or error details) are sent to Google for processing by a large language model (currently Gemini, accessed through Firebase AI services). Google processes this information under its Cloud data-processing terms as our sub-operator and does not use it to train its models.

• AI Assistant conversations are stored under the Business Account. Only the User who had the conversation can view it in the application. Users can delete their own conversations at any time, which also deletes the attachments.
• Our team may review conversations to improve the accuracy, safety and usefulness of the product and our support. We do not publish, sell or otherwise disclose conversations to third parties.
• The AI Assistant can take actions in the Service on a User's instruction. Those actions are recorded in the action log like any other action.

7. Who we share it with

We share Personal Information only with the parties below, and only as needed:

• Google (Google Cloud and Firebase): hosting, databases, file storage, authentication, push notifications, transactional email delivery, analytics, backups, and the language model behind the AI Assistant.
• Paystack (Paystack Payments Limited): card payment processing and subscription billing. Paystack's own privacy policy governs its processing.
• Meta Platforms: advertising measurement on our website and web application (section 9).
• Professional advisers and authorities: our accountants, auditors and lawyers, and courts, regulators or law-enforcement bodies where the law requires or permits disclosure.
• A successor business: if we sell or transfer our business, Personal Information may be transferred to the new owner under this Policy.

Within a Business, the names of Users and the actions they took are visible to the other Users of that Business, and fuel-summary reports sent to the Business's billing contact include usage by employee.

We do not sell Personal Information.

8. Where it is stored and cross-border transfers

Our systems run on Google Cloud and Firebase. As at the effective date of this Policy:

• fuel-log data, uploaded files and photographs, and most of our application servers are hosted in Google's Johannesburg (africa-south1) region in South Africa;
• our primary application database (Google Cloud Firestore), which holds accounts, Businesses, assets, repairs and maintenance, AI Assistant conversations and billing records, is hosted in Google's multi-region location in the European Union;
• user authentication, some background processing and email delivery run in Google data centres in Europe and the United States;
• AI Assistant requests may be processed in any Google region where the model is available; and
• Paystack and Meta process information in their own data centres, which may be outside South Africa.

These transfers are made under POPIA section 72 on the basis of our providers' data-processing agreements and standard contractual terms, which require a level of protection substantially similar to POPIA.

9. Cookies, analytics and advertising measurement

9.1 Website (agritrekker.co.za)

Our website uses Google Analytics (GA4), Google Ads conversion tracking and the Meta (Facebook) Pixel. These set cookies and similar identifiers to measure visits, understand which pages are used, and measure whether our advertising leads to sign-ups. We also store a small flag in your browser to remember your chosen language. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics and personalised advertising through Google's and Meta's own controls.

9.2 Web application

In the web application we use Firebase Analytics to understand which features are used and where users encounter problems. Events are associated with your user ID. We also fire Google Ads and Meta Pixel conversion events (for example, when a trial is started) so that we can measure our advertising. Where we send a conversion event to Meta from our servers, your email address is first hashed so that Meta cannot read it, and it is used only to match the event to an advertising campaign. We do not use these tools to show you advertising inside the Service.

10. How long we keep it

• Account and Business Data: for as long as the Business Account exists. If a Subscription lapses we keep the data so that the Business can resume or export it. We delete it within 30 days of a verified written request from the Business, subject to the exceptions below.
• Employee accounts: until the Business removes the employee or requests deletion.
• Invoices and payment records: at least five years after the end of the tax year to which they relate, as required by South African tax and company law.
• AI Assistant conversations: until the User deletes them or the Business Account is deleted.
• Push notification tokens: until sign-out, or until the token becomes invalid.
• Error reports and feedback: for as long as needed to investigate and improve the Service, generally not more than two years.
• Website contact and booking enquiries: for as long as needed to respond and follow up.
• Backups: our databases keep backups and point-in-time recovery for a limited period, after which they are overwritten. Deleted data may persist in backups until then.

11. How we protect it

We take reasonable technical and organisational measures to protect Personal Information, including encryption in transit and at rest, role-based access controls enforced by security rules for every Business, restricted and named administrator access for our own staff, logging and monitoring, and regular backups. Passwords are handled by Firebase Authentication and are never visible to us.

If we have reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected Business or individuals as soon as reasonably possible, as POPIA section 22 requires.

12. Your rights

Under POPIA you have the right to:

• be told what Personal Information we hold about you and to request a copy;
• ask us to correct or delete Personal Information that is inaccurate, out of date, incomplete, misleading or unlawfully obtained;
• object to processing based on our legitimate interests;
• withdraw consent where processing is based on consent;
• ask us not to send you direct marketing; and
• complain to the Information Regulator (South Africa): complaints.IR@justice.gov.za, https://inforegulator.org.za.

To exercise these rights, email our Information Officer at louis@agritrekker.co.za. We may ask you to verify your identity. We will respond within a reasonable time and in any event within the periods POPIA allows. If your request concerns Business Data held for a Business (for example, you are an employee of one of our customers), we will refer the request to that Business and assist it.

Our PAIA manual, prepared under the Promotion of Access to Information Act, 2 of 2000, is available from the Information Officer on request.

13. Children

The Service is for business use by adults. We do not knowingly collect Personal Information from anyone under 18.

14. Changes to this Policy

We may update this Policy. For material changes we will give at least 14 days' notice by email to Business Account owners and by notice in the application. The current version is always available at https://agritrekker.co.za/privacy-policy and in the application.

15. Contact

Questions about this Policy or about your Personal Information: Louis Anthony Wilkinson, Information Officer, louis@agritrekker.co.za, or support@agritrekker.co.za, or WhatsApp +27 62 117 0782.