Privacy notice

Last updated 28 October 2026. This notice explains how personal information is handled on Cmd.Ctrl under South Africa's Protection of Personal Information Act (POPIA).

Draft. The details of the company that runs Cmd.Ctrl have not been added yet, so this notice is not final.

1. Who is responsible

Cmd.Ctrl is a service for agencies and their clients to review work, sign it off and run projects. Two parties are involved:

The agency (the workspace owner) decides what is put into its workspace and why: its clients, briefs, designs, comments, quotes, time and suppliers. For that information the agency is the responsible party, and Cmd.Ctrl acts as its operator.
The company that runs Cmd.Ctrl is the responsible party for the account and security information described below (sign-in details, security records and billing).

2. What we hold

Your account: name, email address, company or organisation label, your role, when you last signed in, and your password stored only as a one-way hash. If you turn on two-step sign-in, the secret for your authenticator app is stored encrypted, with recovery codes stored only as hashes.
What you and your team put into a workspace: pictures, PDFs and videos you upload; comments, pinned feedback, questions and sign-offs (with the name of who made them and when); briefs, brand material (guides, fonts, images, templates, links); content calendars and the posts in them; tasks; supplier and client records, quotes, invoices and payments recorded; and time logged with the timer.
Security records: a log of important actions (signing in, failed sign-ins, access changes, sign-offs, deletions, exports, archiving), each with who did it, when and the internet address it came from. Short-lived counters of attempts from an internet address are kept to stop guessing of passwords.
Billing: a workspace's plan, what was paid and when. Card details are entered with PayFast and are never stored by Cmd.Ctrl.
Cookies: a cookie that keeps you signed in, and a short-lived one used between your password and your two-step code. There is no advertising, analytics or tracking software.

3. Why we use it

To provide the service you or your agency asked for, to keep it secure (sign-in checks, the security records), to bill for it, to send the emails it needs (invitations, sign-in links, notices that work is ready for review), and to meet legal duties. We do not sell personal information and we do not use it for advertising.

4. Who we share it with, and where it is stored

We use these providers to run the service. Some are outside South Africa, so personal information is sent across the border to them for the purposes above.

Vercel: runs the application. United States.
Neon: the database, which holds accounts and all workspace records. United States (AWS us-east-1).
Vercel Blob: the uploaded files (private; files are only given to people with access). Frankfurt, Germany.
A second copy of uploaded files is planned at a separate provider. This notice will name it when it is switched on.
PayFast: card payments for subscriptions. South Africa.
Anthropic: when a team member adds a meeting from a call transcript and chooses to have notes drafted, the transcript text is sent to Anthropic to write the summary, decisions and actions. United States. We use it only for that and do not send anything else.
Deepgram: when a team member adds a meeting from a recording of a call, the recording is sent to Deepgram to be turned into text. United States. It is not kept by us (only the text is saved) and we send nothing else.
Resend: sends the emails the service needs, once email is switched on. United States.

These providers process the information for us on our instructions. We share information with other people only where you or your agency direct it (for example, clients see the work shared with them) or where the law requires.

5. How long we keep it

Sign-in sessions: 30 days, or until you sign out.
Security records: 12 months, then removed. Attempt counters: about 2 days.
Workspace content and accounts: while the workspace is active. When a project is archived, its full-size files move to a separate archive store and are kept there for the workspace's keep period (12 months unless longer was arranged), then deleted; previews, comments and records remain.
Call transcripts: only added by the team, only with confirmation that everyone on the call knew it was being recorded or transcribed. Kept for the period the workspace owner chooses (12 months by default), then deleted; the meeting notes stay. Only the team can open a transcript, and each time is recorded. A meeting's summary, decisions and actions are shown to the client only if the team shares that meeting.
Deleted files in the backup: a file deleted from the service stays in the backup for 35 days, then is removed from it too.
When a workspace ends, its information is deleted or returned to the workspace owner on request, unless the law requires us to keep it.

6. Keeping it safe

Everything is sent over encrypted connections. Passwords are stored as one-way hashes. Owners and platform administrators must use two-step sign-in, and anyone can turn it on. Each person only sees the workspaces and projects they have been given, files are private and checked against those rights every time, and important actions are recorded. No system is perfectly secure; if personal information is ever accessed without permission we will tell the affected workspace owners and the Information Regulator as the law requires.

7. Your rights

You may ask to see the personal information we hold about you, to have it corrected or deleted, or to object to how it is used. For information inside an agency's workspace, ask that agency first; we will help them respond. Contact details will be added here.

If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

8. Changes

If this changes in a way that matters (a new provider, a new region, a longer retention period) we will update this page and its date.