1. Who we are and scope
Breadwinner Deli (Pty) Ltd, registration 2025/944373/07, trading as Saffrio, is the responsible party for the personal information described in this policy. Our registered office is Unit 8, 21 Columbus Crescent, Rivergate, Western Cape, 7441, South Africa. Our contact and Information Officer can be reached at info@saffrio.co.za.
This policy covers saffrio.co.za and the Saffrio app, including the installable app. It explains what we collect, why we use it, who may receive it and your rights under South Africa’s Protection of Personal Information Act (POPIA).
2. Information we collect
Accounts and access: your name and email address, company and site details, business type, selected standards, roles and invitations. Passwords are handled by our authentication provider; we never see your password in plain text.
Templates and indexes: form templates and lightweight record and document indexes, including file IDs or links, dates, signer names, revisions and issue counts. Live completed records and document contents are stored in your connected cloud, not in our database.
Enquiries: the details you submit in notify-me, contact and quote forms, such as name, email, business, business type, selected plan, message and POPIA consent.
Subscriptions: subscription and billing status received from PayFast. We do not receive or store card or bank details.
Technical information: IP address, device and browser information and service logs. We use essential cookies and local storage for sign-in and the offline app. Offline caching is limited to static app assets and a generic offline page, not authenticated records or other users’ data. We do not use advertising cookies.
3. Client-owned storage
Live documents, completed records, specifications and certificates of analysis (COAs) are saved directly from your browser to your company’s own Microsoft 365 OneDrive or SharePoint, or Google Drive. File contents do not pass through or get copied to Saffrio servers. Access tokens stay in browser memory, are not stored on our servers and are cleared when you sign out.
Your company controls access, backups, retention and deletion in its connected cloud. Disconnecting Saffrio or deleting a Saffrio account does not automatically delete those cloud files.
Demo companies use temporary Saffrio demo storage and reset nightly. Do not upload confidential or production information to shared demos. An unconnected active 3-day free trial may also use temporary demo storage; connect your own cloud storage for live use. Connecting storage does not automatically migrate earlier trial files or records.
4. Google user data
We request only the https://www.googleapis.com/auth/drive.file scope. This gives Saffrio access only to files and folders you create with Saffrio or explicitly select in the Google Picker, not the rest of your Google Drive.
For those files and folders, we access contents and metadata such as names, IDs, folders and dates. We use this access only to create Saffrio folders and save or open your records and documents at your request.
Google file contents are not copied to Saffrio servers; only file IDs or links are kept in our index. Access tokens remain in browser memory and are cleared on sign out.
We never sell Google user data, share it with third parties, use it for advertising or use it to train artificial intelligence or machine-learning models. No humans read it except with your explicit permission for support, for security or abuse investigations, or as required by law.
You can revoke access through Google Account → Security → Third-party connections, or choose Disconnect in Saffrio Settings. Disconnecting stops the app using its current connection; removing the connection in your Google Account revokes Google’s authorisation.
Saffrio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Microsoft user data
Our Microsoft connection uses delegated permissions Files.ReadWrite, Files.ReadWrite.All, Sites.Read.All and User.Read. Although some permissions allow broader access within your Microsoft account, Saffrio uses them only to let you choose a site or folder and save or open Saffrio files on your behalf.
Microsoft file contents transfer directly between your browser and your connected Microsoft 365 storage. Tokens remain in browser memory, are not stored on Saffrio servers and are cleared on sign out. We do not sell this data or use it for advertising or AI or machine-learning training. Human access is limited to your explicit permission for support, security or abuse investigations, or legal requirements.
You can disconnect in Saffrio Settings and revoke Microsoft access through myapps.microsoft.com or your company’s Microsoft 365 administrator.
6. How and why we use information
We use information to provide the service, manage accounts and access controls, administer billing, provide support, respond to enquiries, send service emails, prevent fraud and abuse, secure the service and meet legal obligations.
Under POPIA, our lawful grounds are performance of a contract for the service; your consent for enquiries and notify-me submissions; legitimate interests in operating and protecting the service; and compliance with legal obligations. We limit processing to what is needed for these purposes.
We do not send direct marketing without your consent. You can unsubscribe or withdraw marketing consent at any time by following the unsubscribe option in the message or emailing us. Essential account, security and billing messages are service communications, not marketing.
7. Who we share information with
We use service providers acting as operators to deliver the service: Lovable Cloud / Supabase for hosting, database and authentication; Cloudflare for content delivery; our transactional email provider for service emails; and PayFast for payments. They receive only the information needed for their service, subject to applicable safeguards.
Microsoft and Google receive and store files only as directed by you through your connected cloud. We may disclose information where required by law. We never sell personal information. These service arrangements do not involve copying your connected Google or Microsoft file contents to our hosting or email providers.
8. Cross-border transfers
Some service providers process information outside South Africa. Where information is transferred across borders, we rely on providers with adequate safeguards, including applicable laws or binding agreements protecting personal information, as required by section 72 of POPIA.
9. Retention
We retain account data while your subscription is active and for up to 12 months after cancellation, unless you request earlier deletion. We retain enquiries for up to 24 months and billing records for 5 years as required by law. A legal retention obligation may prevent immediate deletion of specific records.
Technical logs are kept for a limited period needed for troubleshooting, security and abuse prevention, rather than indefinitely. Your company controls retention and deletion of files in its own cloud; our account retention periods do not delete those files.
10. Security
We use encryption in transit, row-level access controls to separate company data and least-privilege access. No online service can guarantee absolute security. Keep your account secure and manage the permissions and backups of your connected cloud.
If a security compromise affects personal information, we will notify the Information Regulator and affected people as POPIA requires.
11. Your rights
You can request access to your personal information, correction or deletion, object to processing, and withdraw consent, subject to POPIA and applicable legal obligations. Withdrawing consent does not affect processing already lawfully carried out.
Send requests to info@saffrio.co.za. We respond within 30 days and may need to verify your identity before releasing or changing personal information.
You may complain to the Information Regulator (South Africa) at inforegulator.org.za or POPIAComplaints@inforegulator.org.za.
12. Children
Saffrio is not intended for people under 18. If you believe a child has provided personal information to us, contact us so we can address it.
13. Changes to this policy
We will post updates on this page with the updated effective date and notify account holders of material changes.
14. Contact
Responsible party: Breadwinner Deli (Pty) Ltd, registration 2025/944373/07, trading as Saffrio.
Registered office: Unit 8, 21 Columbus Crescent, Rivergate, Western Cape, 7441, South Africa.
Contact / Information Officer: info@saffrio.co.za.