Account information
Name, email address, authentication identifiers, profile details, account-security events and records of accepted service terms.
Privacy and data protection
Privacy notice
This notice explains how DebitGuard processes personal information when people use the website, create accounts, join workspaces, purchase subscriptions, submit enquiries or use the Consumer Complaint Risk Intelligence service.
Responsible party
DebitGuard (Pty) Ltd is the responsible party for personal information processed for the operation of the DebitGuard service. Privacy and Information Officer enquiries may be sent to support@debitguard.co.za.
Information we process
Workspace information
Workspace name, account type, membership, Admin/Analyst/Viewer role, invitations, saved companies and configuration choices.
Subscription information
Plan, billing interval, Paddle customer, transaction and subscription identifiers, entitlement status and cancellation dates. DebitGuard does not receive or store full payment-card details.
Service usage
Selected companies, products, periods and filters used to provide the analysis; saved companies, monitoring configurations, snapshots, alerts, report records and relevant workspace actions. Some selections and temporary analysis information are stored in your browser.
Enquiries and support
Contact details, organisation information and messages submitted through enterprise enquiries, email or support channels.
Technical information
Security logs, request metadata, browser storage, essential cookies or tokens, error information and request counters used to protect Preview and signed-in access. Protection records can include identifiers transformed into non-readable values; they are used for security and request limits, not advertising.
Public complaint evidence
Our analysis also uses complaint records published by the United States Consumer Financial Protection Bureau (CFPB). Depending on the available source, these can include complaint identifiers, dates, product and issue details, geographic information, recorded responses and public narrative evidence. Previously assessed narrative evidence may remain relevant when the source later changes or removes it.
This evidence is separate from your account information. Published complaint content can still contain personal information, so public availability does not remove the need to handle it responsibly. Contact us if you have a privacy concern about evidence shown through DebitGuard; corrections to the original source should also be raised with that source.
Why we process personal information
- To create and secure accounts and workspaces.
- To provide company previews, paid analysis, watchlists, monitoring, alerts and reports.
- To manage subscriptions, entitlements, billing, cancellation and customer support.
- To send necessary authentication, invitation, monitoring and service communications.
- To prevent fraud, scraping, unauthorised access and misuse.
- To maintain system reliability, evidence trails, quality controls and legal compliance.
- To respond to enquiries and, where permitted, communicate about relevant DebitGuard services.
Depending on the activity, processing is based on consent, performance of a contract, compliance with legal obligations, protection of legitimate interests, or another lawful ground recognised by applicable data-protection law.
Service providers and disclosures
DebitGuard uses specialised service providers to operate the platform. The information shared depends on the function they provide. Some providers process information for DebitGuard, while others have their own responsibilities for the information they collect.
- Supabase: authentication, database and secure account records.
- Netlify: website hosting, deployment and serverless Functions.
- PostHog: website and product analytics, enabled by default unless you turn it off or your browser privacy preference disables it. Events can include pages, selected companies/products/periods, analysis sections, video progress and checkout actions. For signed-in users, activity can be linked to the account identifier, email and name. Passwords, payment-card details, support messages and assistant conversations are not collected by this integration. Session recording and automatic click/form capture are disabled.
- Paddle: Merchant of Record for checkout, payment processing, tax, buyer support and subscription billing. Paddle handles transaction information as an independent controller under its privacy notice.
- Resend: transactional and monitoring email delivery, including recipient details, message content and delivery status needed to send service emails.
- Google: Google OAuth when a user chooses Google sign-in.
- Logo.dev: company-domain lookup and logo display. Loading an external logo can disclose the requested company domain and ordinary request metadata, such as your IP address, to the provider.
Information may also be disclosed where required by law, a regulator, court process, security investigation, corporate transaction or the protection of DebitGuard, its users or others.
International processing
Some service providers and infrastructure may process information outside South Africa. DebitGuard takes reasonable steps to use reputable providers and appropriate contractual, organisational and technical safeguards for cross-border processing.
Cookies and browser storage
DebitGuard uses essential authentication sessions, security tokens and browser storage for sign-in, active-workspace selection, Preview limits, checkout continuation and restoring analysis navigation. Temporary cached analysis information also helps the site respond faster. These functions are not used to sell personal information.
Website and product analytics is enabled by default. You can turn it off without losing access to essential features using “Analytics preferences” at the bottom of the page. Existing choices to turn analytics off remain respected. Analytics uses browser storage to distinguish visits and, after sign-in, associate activity with your account. Browser Do Not Track and Global Privacy Control preferences disable this analytics integration. Turning analytics off stops future tracking; it does not automatically delete activity already collected. Contact us to request deletion. No advertising tracking is added by this integration.
Retention
Information is retained for as long as reasonably necessary to provide the service, maintain security and audit trails, resolve disputes and meet legal, tax, accounting and regulatory obligations. Retention periods vary according to the record and the customer relationship. Information that is no longer required is deleted, de-identified or securely restricted where appropriate.
Security
DebitGuard applies role-based access, authenticated server requests, row-level database controls, secret management, signed webhook verification, encrypted connections and other reasonable technical and organisational measures. No internet service can guarantee absolute security, and users must keep credentials confidential and notify DebitGuard promptly of suspected misuse.
Your rights
Subject to applicable law, you may request access to personal information, correction or deletion of inaccurate or unnecessary information, object to certain processing, withdraw consent where processing depends on consent, or raise a complaint.
Send requests to support@debitguard.co.za. You may also lodge a complaint with the Information Regulator (South Africa).
Children
DebitGuard is a professional service and is not intended for children. Accounts must be created by people who are at least 18 years old and able to enter into binding agreements.
Updates to this notice
This notice may be updated as the service, providers, data sources or legal requirements change. Material updates will be communicated through the website, account or email where appropriate.