Privacy Policy

01Who we are

ManageMint Solutions is operated by Scott Bebington, trading as ManageMint Solutions, 10 Eaton Avenue, Bryanston, Sandton, 2191, Gauteng, South Africa ("we", "us"). We provide the ManageMint Solutions portal, a web application for managing clients, projects, tasks and teams, and this website.

For personal information we decide how to use, we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Scott Bebington, reachable at admin@managemintsolutions.com.

02Your organization's data and ours

We handle personal information in two different roles:

• Our own records. Account details, billing details, messages you send us and how you use the service. We decide how this is used and this policy covers it fully.
• Your workspace content. The clients, leads, projects, tasks, notes, files and staff records your organization puts into the portal. Your organization is the responsible party for that information and we process it on its behalf, as an operator, only to provide the service.

If you are a client, lead or employee of one of our customers and have a question about information they hold about you, please contact that organization first. We will help them answer you.

03What we collect

When you create or use an account

• Your name, surname, email address and phone number, and a profile picture if you add one. Profile pictures are stored at a link that opens without signing in, so do not use an image you would not want seen.
• Your password, which is stored only as a one-way hash by our sign-in provider.
• Your role and permissions in your organization.
• Your organization's name, billing email address and addresses.

When you pay

Card payments are processed by Paystack. Your full card number never reaches our servers. We keep the card type, the last four digits and the expiry date so you can see which card is on file, together with payment references, amounts and the invoices we issue.

While you use the portal

• An audit trail of changes to records: who made the change, what changed and when. Your organization uses it to see the history of its records.
• Technical information such as your IP address and browser details, which our hosting providers log when you make a request and which we use to limit repeated sign-in attempts.
• Error reports when something breaks. These identify you by an internal user id only and do not include screen recordings or the content of your requests.

When you contact us

The contact form sends us your name, email address, company name if you give one, and your message. It is delivered to us by email and not stored in our database.

04How we use it

We use personal information to:

• Provide the portal, sign you in, and apply the permissions your organization sets.
• Charge subscriptions, issue invoices and handle failed payments.
• Send service emails: account confirmations, password resets, notifications about tasks, leave and timesheets, invoices and payment alerts.
• Answer messages you send us.
• Keep the service secure, find and fix faults, and prevent abuse.
• Meet our legal and tax obligations.

We process it because it is needed to perform our agreement with you, because we have a legitimate interest in running a secure and reliable service, or because the law requires it. We do not sell personal information, we do not use it for advertising, and we do not send marketing newsletters.

05Health and other sensitive information

If your organization uses the HR features, its records can include leave taken, including sick leave, and supporting documents such as medical certificates. Under POPIA, health information is special personal information.

We process it only on your organization's behalf and for the employment purposes it is collected for. Supporting documents are kept in private storage, can only be opened by signed-in members of your organization, and open through links that expire after five minutes.

06Who we share it with

We use the following service providers to run ManageMint Solutions. Each one receives only what it needs to do its job and is bound by its own data protection terms.

• Supabase: database, sign-in and file storage, hosted in Frankfurt, Germany.
• Vercel: hosting for the portal, the api and this website.
• Upstash: a cache of your profile and permissions that makes the portal faster and expires within a day.
• Resend: delivery of the emails we send.
• Paystack: card payments and subscriptions.
• Sentry: error reports, hosted in the European Union.

We will also disclose information when the law requires it, for example in response to a valid court order.

07Information stored outside South Africa

Our database and files are stored in Germany, and some of our providers process information in other countries, including the United States. We only use providers that are bound by data protection law or agreements that give a level of protection comparable to POPIA, as section 72 of POPIA requires.

08Cookies

This website does not use analytics, advertising or tracking cookies. The portal stores your sign-in session in cookies so you stay signed in, and our hosting provider may set a technical cookie that keeps your browser on a consistent version of the site. These cookies are needed for the service to work and are not used to track you.

The portal also keeps your light or dark theme choice, and a copy of public holiday dates, in your browser's local storage.

09How we protect it

All connections are encrypted with HTTPS. Each organization's records are kept apart from every other organization's at the database level, access to records is checked against the permissions your organization sets, sign-in attempts are rate limited, and changes to records are logged.

No system is perfectly secure. If a breach affects your personal information, we will tell the affected organizations and the Information Regulator as POPIA requires, as soon as we reasonably can.

10How long we keep it

We keep your account and workspace content for as long as your organization has an account with us. When a subscription is cancelled, the organization's records are locked but kept, so reinstating the subscription restores them.

We keep the audit trail of changes to records for one year. Entries older than that are deleted automatically.

An account owner can ask us at admin@managemintsolutions.com to delete the organization and its data, and we will do so within 30 days. We keep a copy of the invoices and payment records that South African tax law requires us to hold for five years. Deleted data drops out of our providers' backups as those backups expire. Messages sent through the contact form are kept in our mailbox for as long as they are useful to answer you.

11Your rights

Under POPIA you may:

• Ask whether we hold personal information about you, and for a copy of it.
• Ask us to correct information that is wrong, or to delete information we no longer need.
• Object to us processing your information, on reasonable grounds.
• Withdraw consent where we rely on it.

Write to admin@managemintsolutions.com and we will answer within 30 days. For workspace content, your request is passed to the organization that holds it, as it decides what happens to that information.

If you are not satisfied with our answer, you may complain to the Information Regulator of South Africa at inforegulator.org.za.

12Children

ManageMint Solutions is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information about children through our own records.

13Changes to this policy

When we change this policy we update the date at the top of this page. If a change is significant, we will also email account owners before it takes effect.

14Contact

Questions about this policy or your personal information go to our Information Officer at admin@managemintsolutions.com, or by post to Scott Bebington, trading as ManageMint Solutions, 10 Eaton Avenue, Bryanston, Sandton, 2191, Gauteng, South Africa.