Privacy notice

This notice explains how Fabricata ("we") handles personal information in Fabricata Flow ("Flow"), in line with the Protection of Personal Information Act, 2013 (POPIA).

Two kinds of information

Account information is about the people who use Flow: name, email address, password (stored only as a one-way hash), job title if you add one, which workspaces you belong to, and when you signed in. We are responsible for this information.

Workspace content is what a company puts into Flow: jobs, customers and their contact details, projects, notes, files and photographs. The company that owns the workspace decides what goes in and is responsible for it; we process it on that company's behalf, only to provide the service.

What we use it for

• To create and secure your account and let you sign in.
• To provide Flow: showing your workspace's jobs, sending the notifications Flow is designed to send, and generating PDFs and exports you ask for.
• To send service emails: invitations, password resets and email confirmations. We do not send marketing email from Flow.
• To keep the service secure and working: technical logs of requests and errors, which we use to find and fix problems.

We do not sell personal information, and we do not use workspace content for advertising or to train models.

Where it is stored

Flow runs on Vercel, with the database on Neon and files in private Vercel Blob storage, all in the European Union (Frankfurt). Personal information is therefore transferred outside South Africa, to providers bound by data protection obligations that give it a level of protection comparable to POPIA. If email delivery is enabled, emails are sent through Resend.

Payments for plans are made through PayFast, a South African payment provider. Card details are entered on PayFast's own pages and never reach Flow; Flow sends PayFast the payer's name, email address and the plan being bought, and keeps a record of each payment PayFast confirms, for receipts and accounting.

How it is protected

All traffic is encrypted. Each company's data is separated and every request is checked on the server against the signed-in person's workspace. Files are private and opened only through links that expire within minutes. Passwords are never stored in readable form. See Security for more.

How long we keep it

Account information is kept while you have an account. Workspace content is kept while the workspace exists; items a workspace archives are kept until it deletes them. When a workspace is closed, its content is deleted, apart from what the law requires us to keep. Technical logs are kept for a short period only.

Your rights

Under POPIA you may ask to see the personal information we hold about you, ask us to correct or delete it, and object to its processing. You can update your name and password yourself under Your account. For anything else, email flow@fabricata.co.za. If your information is part of a company's workspace, we may refer your request to that company as the responsible party. You may also complain to the Information Regulator of South Africa.

Cookies

Flow uses a single essential cookie to keep you signed in and to protect forms against forgery. There are no advertising or analytics cookies.

Changes

If this notice changes in a way that matters, we will say so in Flow before the change takes effect.