Privacy Notice

What data we collect

• Name, email address, phone number (for account management)
• Job title, department, team assignment (for access control and personalisation)
• Activity logs (for security and audit compliance)
• Knowledge base queries and feedback (for system improvement)
• Training progress and assessment results (for professional development tracking)

How we use your data

• Authentication and role-based access control
• Personalised AI responses based on your team context
• Activity logging for ISO 27001 and PCI DSS compliance
• Training progress tracking and certification
• Internal communications and notifications

Third-party data sharing

• Anthropic (Claude AI). Query content is sent for AI processing. Anthropic does not retain or train on this data.
• Voyage AI. Document content is sent for embedding generation.
• Telegram. Notification messages are sent via Telegram Bot API if configured.
• Microsoft 365. Emails sent via SMTP for proposals and notifications.

Data retention

• Activity logs are retained for a minimum of 2 years (ISO 27001 requirement).
• Expired invitation and password reset tokens are automatically cleaned up.
• Inactive conversation sessions are removed after 7 days.

Your rights under POPIA

• Right to access. You can download your personal data from your profile page.
• Right to correction. You can update your personal information at any time.
• Right to deletion. You can request deletion of your data from your profile page.
• Right to object. You may object to processing of your personal information.

Security

Mission Control implements industry-standard security controls including AES-256 encryption for sensitive data, bcrypt password hashing, rate limiting, account lockout protection, and comprehensive audit logging. The platform is designed to comply with PCI DSS and ISO 27001 requirements.

Contact

For privacy-related enquiries or to exercise your rights, contact:
Email: josh.kruyt@addpay.africa
Data controller: AddPay (Pty) Ltd