Legal
Privacy Policy
This policy explains what personal information MODUVO OS collects, why we collect it, how we look after it, and what rights you have. It is written to meet the requirements of the Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
MODUVO OS is a software platform operated by Moduvo (“we”, “us”). For the purposes of POPIA we are the responsible party for the personal information described in section 3, and an operator for the customer data described in section 4.
- Responsible party: Moduvo
- Registration number: [to be completed]
- Registered address: [to be completed]
- Information Officer: [name] — jarvis@moduvo-os.com
2. Two kinds of information
It matters which is which, because our obligations differ:
- Account information — information about the people who use MODUVO OS. We decide how this is handled, so we are the responsible party.
- Customer data — information our customers load into their own workspaces about their business, staff, clients or programme participants. The customer decides how that is handled. We process it only on their instruction.
3. Account information we collect
- Your name and email address.
- An encrypted representation of your password. We never store your password itself.
- If you sign in with Google, the unique account identifier Google gives us, your email address, your name and profile picture. We do not receive your Google password and we request no access beyond your basic profile.
- Sign-in records: date, time, IP address and browser description. These are kept for security — they are how we detect and stop attacks on your account.
- An audit trail of significant actions taken in the platform, recording who did what and when.
4. Customer data
Data loaded into a workspace belongs to the customer organisation. We access it only to run the service, to fix a fault, or where the customer asks us to. It is isolated per organisation: no customer can see another customer's users, workspaces, documents, workflows or audit logs.
If you are an employee, client or programme participant of one of our customers and you want to know what information they hold about you, contact them directly — they control it, not us. We will help them respond.
5. Why we process it
- To give you access to the service and keep your session secure.
- To send transactional messages: verification, password reset, invitations and security alerts.
- To provide support and investigate faults.
- To meet legal and contractual obligations, including keeping an audit trail.
We do not sell personal information, and we do not use customer data to train AI models.
6. AI processing
Where AI features are used, they operate on the data the user is already permitted to see — the AI has no privileged access and no route around the permission model. AI actions are written to the same audit trail as human actions.
7. How long we keep it
- Account information: while your account is active, and for a reasonable period afterwards to meet legal obligations.
- Sign-in and audit records: retained for security and compliance purposes.
- Customer data: for the term of the customer's subscription, and deleted or returned on request after it ends, subject to any legal retention obligation.
8. Where it is processed
MODUVO OS is hosted on servers in the European Union. Where personal information is transferred outside South Africa, we do so on the basis that the receiving country or party provides an adequate level of protection, as required by section 72 of POPIA.
9. How we protect it
- All traffic is encrypted in transit using TLS.
- Passwords are stored using a modern one-way hashing algorithm.
- Sessions are held server-side and can be revoked centrally.
- Repeated failed sign-in attempts are throttled.
- Access is governed by role-based permissions, and every organisation's data is isolated.
10. Your rights under POPIA
You may ask us to confirm what personal information we hold about you, correct or delete it, object to processing, or complain. Write to jarvis@moduvo-os.com and we will respond within a reasonable period.
You also have the right to complain to the Information Regulator (South Africa): inforegulator.org.za.
11. Cookies
We use a single essential cookie to keep you signed in, and a session cookie to protect forms against cross-site request forgery. We do not use advertising or third-party tracking cookies.
12. Changes
If we change this policy we will update the date above and, where the change is significant, tell account holders by email.
Questions about this policy: jarvis@moduvo-os.com