Privacy Policy

1. Introduction

PondLog (“we,” “us,” “our,” or “Company”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and application (collectively, the “Service”).

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.

We comply with the protection of personal information regulations in South Africa (POPIA) and the European Union (GDPR), and respect the privacy rights of all users regardless of location.

2. Information We Collect

Information You Provide Directly

Account Registration:

• Name
• Email address
• Phone number (optional, for customer support)
• Billing address
• Payment information (processed by Paddle, not stored by us)
• Region/location (inferred from billing currency, can be manually set)

Pond and Fish Data:

• Pond names, volumes, filter types, locations (optional)
• Fish names, varieties, breeders, acquisition details
• Water parameter readings (temperature, pH, KH, GH, ORP, ammonia, nitrite, nitrate, dissolved oxygen, TDS, salinity)
• Health observations, diagnoses, treatments
• Photos of fish (if uploaded in Phase 2)
• Notes and comments

Customer Records (Pro Tier):

• Customer names, phone numbers, WhatsApp numbers, email addresses
• Customer water parameters shared with you for advice
• Sales history and pricing
• Treatment recommendations provided

Communications:

• Any messages, emails, or feedback you send to support
• Correspondence related to billing or account management

Information Collected Automatically

Usage Analytics:

• Pages visited, features used, time spent in app
• Device type, browser, operating system
• IP address (for security, not for location tracking)
• Error logs and performance data

This information is collected via PostHog (analytics tool). Error tracking via Sentry is planned for after launch and is not active at launch — if and when we enable it, we will update this policy and Section 7 before it processes any data. PostHog itself is not yet active at launch either — we will update this policy before it begins collecting data. See Section 5 for details on third parties.

Cookies. We use functional cookies to keep you logged in and remember preferences. We do not use advertising cookies or tracking cookies beyond what's necessary to operate the Service.

Information We Do NOT Collect

• Precise geolocation data
• Biometric data
• Medical records beyond what you voluntarily log
• Banking information (Paddle handles payments)
• Sensitive demographic information

3. How We Use Your Information

Provide and Improve the Service:

• Maintain your account and deliver features you request
• Generate trends, correlations, and health scores
• Store and display your pond and fish data
• Calculate costs and generate reports
• Send you provenance reports and customer information

Communication:

• Send account notifications (trial ending, subscription renewed, payment failed)
• Respond to support requests
• Notify you of material changes to the Service
• Send occasional product updates or feature announcements (you can opt out)

Analytics and Research:

• Understand how the Service is used
• Identify bugs and performance issues
• Develop new features based on user behavior
• Aggregate anonymized insights (e.g., “40% of users in SA use Hikari brand”)

Legal Compliance:

• Comply with legal obligations
• Enforce our Terms of Service
• Protect against fraud or illegal activity
• Resolve disputes

Business Operations:

• Manage billing and payments
• Conduct market research
• Create anonymized reports for business purposes

4. We Do NOT

• Sell your personal data to third parties
• Share your pond or fish data with other users (except through features you explicitly enable like dealer customer records)
• Use your data for targeted advertising
• Share health observations with anyone except you (and your customers if you're a dealer)
• Use your data to train AI models or large language models
• Commercialize your personal information

5. Data Sharing and Disclosure

With Your Consent

• Dealer customers (when you choose to send them provenance reports or share advice)
• Users you explicitly invite to multi-user features (team members, if that feature is added)

Service Providers

We share data with third-party service providers to operate PondLog:

Supabase (Database and Authentication)

• Stores all your account data, pond records, readings, fish information
• Supabase is GDPR and SOC 2 compliant
• Data is encrypted at rest and in transit
• Supabase terms: supabase.com/privacy

Paddle (Payment Processing)

• Processes payments and manages subscriptions
• Never receives your raw card data (you enter it on Paddle's secure checkout)
• Receives: email, billing address, subscription tier, amounts paid
• Paddle is PCI-DSS compliant
• Paddle privacy: paddle.com/privacy

Cloudflare (Security and DNS)

• Provides DDoS protection and SSL certificates
• Does not store your data, only passes traffic through
• Cloudflare privacy: cloudflare.com/privacy

PostHog (Analytics) — not active at launch; will be enabled after launch

• Will collect: pages visited, features used, device type, IP address
• Will NOT receive: personal data, pond/fish data, health observations
• PostHog is GDPR compliant
• We will enable this only after launch and will update this policy beforehand
• PostHog privacy: posthog.com/privacy

Sentry (Error Tracking) — planned for after launch; not active at launch

• Will collect: error messages, stack traces, user session IDs
• Will NOT receive: personal data, pond/fish data, payment information
• Sentry is GDPR compliant
• We will enable this only after launch and will update this policy beforehand
• Sentry privacy: sentry.io/privacy

Legal Requirements

We may disclose your information if required by law, court order, or government request, to the extent permitted by applicable law and only after notification where legally permissible.

6. Data Retention

Account Data:

• While your account is active: indefinite (you own it)
• After account deletion: 12 months (for backup/compliance), then deleted

Trial and Cancelled Accounts:

• Trial data is retained when the trial ends — accounts move to the free fallback plan
• Cancelled subscription data: deleted 12 months after cancellation (unless you request sooner)

Backups:

• Supabase maintains backups for 7 days for disaster recovery
• Your right to deletion applies after the backup retention period

Analytics:

• PostHog data: retained for 12 months
• Aggregate analytics: retained indefinitely (anonymized, cannot identify you)

You can request immediate deletion of your data at any time by contacting support.

7. Your Rights

Under GDPR (EU users) and POPIA (SA users), you have the right to:

Right of Access. You can request a copy of all personal information we hold about you. We will provide it in a portable, machine-readable format within 30 days.

Right to Correction. You can correct most account and pond/fish information directly in the app, or request we do so.

Right to Deletion. You can request deletion of your account and all associated data by emailing support. We will delete it within 30 days (after backup retention period, typically 7 days).

Right to Data Portability. You can request your data in a standard format (CSV, JSON) suitable for import elsewhere.

Right to Withdraw Consent. If you've consented to marketing emails or analytics, you can withdraw that consent at any time by emailing support.

Right to Restrict Processing. You can request we limit how we use your data while we process a dispute.

Right to Object. You can object to us processing your data for certain purposes, including marketing and analytics.

To exercise any of these rights, email support@pondlog.app with “Data Rights Request” in the subject line. We will respond within 30 days.

8. International Data Transfers

PondLog's data is hosted by Supabase in the EU West (Ireland) region. If you are located in a jurisdiction with data-transfer restrictions, by using PondLog you consent to the transfer and processing of your data in the region above and in other jurisdictions where our service providers (e.g. Paddle, PostHog, Cloudflare) operate.

We maintain appropriate safeguards (encryption, contractual protections) to protect your data during transfer.

9. Children's Privacy

PondLog is not intended for users under 18 years old. We do not knowingly collect information from children. If we learn we have collected information from a child, we will delete it promptly and, if applicable, notify parents/guardians.

10. Security

We implement industry-standard security measures to protect your data:

• HTTPS encryption for all data in transit
• Encryption at rest in Supabase
• Row-level security (users can only access their own data)
• Regular security audits
• Limited staff access to production data (only as needed)
• No hardcoded credentials or API keys in code

However, no system is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

11. Third-Party Links

PondLog may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Please review their privacy policies before providing personal information.

12. Marketing Communications

We may send you occasional emails about new features, product updates, or important notices. You can opt out of marketing emails (but not critical account notifications) by clicking “Unsubscribe” in any marketing email or by emailing support.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting the updated policy on the Service. Continued use of PondLog after such notification constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, your personal information, or our privacy practices, please contact us:

Email: support@pondlog.app
Address: 19 Uitzicht Crescent, Richwood, Cape Town, 7441, South Africa
Response Time: We will respond to privacy inquiries within 30 days

15. Information Officer (POPIA) & Data Protection Contact

As a South African business, our Information Officer under the Protection of Personal Information Act (POPIA) is Rian Loubser, registered (or to be registered) with the Information Regulator of South Africa.

• Information Officer / privacy contact: privacy@pondlog.app
• For EU/GDPR data-subject requests you may use the same contact.

You may also lodge a complaint with the Information Regulator (South Africa) or, if you are in the EU, your local data protection authority.

By using PondLog, you acknowledge that you have read and understood this Privacy Policy and agree to our privacy practices.
This policy is effective as of June 2026 and was last updated on June 2026.