Privacy Policy

Version 2.0 · effective 30 October 2026

This notice explains what personal information Ingenious Nexus processes, why, on what lawful basis, who it is shared with, how long it is kept and how you can exercise your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

Ingenious Nexus (Pty) Ltd, a private company registered in South Africa (registration number 2025/198437/07).
449 Ramogotsi Section, Chaneng, Rustenburg, 0310, South Africa.

We provide the Ingenious Nexus SME Finance Platform (the "service") and the websites that promote it.

2. Our two roles

• Responsible party. For information about website visitors, people who join the waitlist or contact us, account holders (sign-in, security and support) and subscription billing, we decide why and how it is processed.
• Operator. For the records a business captures in the service (its customers, suppliers, staff, invoices, bank lines, documents), that business is the responsible party and we process the information on its behalf, under its instructions and our Terms of Service. Questions about those records should go to the business concerned first.

3. What we collect, why, and our lawful basis

We don't ask for special personal information (such as health, religion or biometrics) or information about children, and we ask you not to upload it. Fields marked optional can be left blank. We don't sell personal information, use your business records for advertising, or make decisions about you by automated means alone.

4. Direct marketing

We only send product news to people who ticked the box asking for it (or existing customers about similar services, with an easy way to opt out every time, as POPIA s69 allows). You can unsubscribe at any time by replying to any email or contacting us. Service messages, such as security alerts, invoices and reminders you set up, are not marketing.

5. Who we share information with

We use these operators (service providers) to run the service. Each may use the information only to provide its service to us and must keep it secure:

• Vercel Inc.: application hosting, file storage (Vercel Blob) and scheduled tasks.
• Neon: managed PostgreSQL database hosting.
• The email provider configured for the service: delivering emails you or the service send.
• WhatsApp (Meta Platforms): only if a business chooses to send documents through WhatsApp.

We disclose information when the law requires it (for example to SARS or under a court order), and may share it with professional advisers bound by confidentiality. If the business is sold or restructured, information may transfer to the new owner under the same protections.

6. Transfers outside South Africa

Our hosting and database providers store and process information in data centres in the United States. We transfer information there under POPIA s72, relying on the providers' data processing terms, which require them to protect personal information with safeguards comparable to POPIA's conditions, and on the transfer being necessary to perform our contract with you. If you have questions about these safeguards, contact our Information Officer.

7. How we protect information

• Encrypted connections (HTTPS) and strict browser security headers.
• Passwords stored as bcrypt hashes; bank account numbers and authenticator secrets encrypted with AES-256-GCM.
• Each business's records separated and checked on every request; role-based permissions within a business.
• Optional two-step verification for every user (required for platform administrators); account lockout after repeated failed sign-ins; automatic sign-out after 15 minutes of inactivity.
• An append-only audit log of changes, and a double-entry ledger where posted entries are corrected by reversal, not overwritten.

No system is perfectly secure. If a security compromise affects your personal information we will notify the Information Regulator and affected people as soon as reasonably possible, as POPIA s22 requires.

8. How long we keep information

• Financial and tax records (invoices, payments, ledger, subscription billing): at least five years under the Tax Administration Act and VAT Act, and up to seven years where the Companies Act applies. These are not deleted on request before that period ends.
• Account and security records: while the account is open and for up to 12 months after it closes, unless needed for a dispute or investigation.
• Waitlist and contact messages: until 12 months after your last contact with us, or sooner on request.
• Cookie preference records: 12 months.

When a retention period ends, information is deleted or de-identified.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy (signed-in users can download their own account data under My account → Your data);
• ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully held (you can edit your profile yourself);
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent you gave, without affecting earlier processing;
• lodge a complaint with the Information Regulator (South Africa).

We'll respond within a reasonable time and, for access requests, as set out in our PAIA and POPIA Manual. We may need to confirm your identity first.

10. Information Officer and contact

For privacy questions and requests, write to our Information Officer: use the contact form on our website or write to us at the address above.

Changes to this document

We'll update this document when our services or the law change, and show the new version number and date at the top. For material changes affecting account holders we'll also notify you by email or in the app before they take effect.

• Version 1.0 (8 October 2026): First version
• Version 2.0 (30 October 2026): Full POPIA notice: lawful bases, processors, cross-border transfers, retention, rights, Information Officer