Privacy notice.

Who we are

Claripick ("we", "us") provides grant management and statutory compliance software for South African non-profit organisations and grantmaking funds, available at claripick.com and app.claripick.com. Under the Protection of Personal Information Act 4 of 2013 (POPIA), your organisation is the responsible party for the information it stores in its workspace, and we act as its operator. For the account information we collect directly (your name, email and preferences) we are the responsible party.

Where your data lives

Your workspace data (grants, deadlines, documents, funder and donor records, financial figures) is stored and processed in Google Cloud's Johannesburg region, africa-south1, in South Africa. Three narrow, ancillary functions are handled outside South Africa, namely sign-in, reminder email and the optional accounting sync, and each is set out in sections 5 and 6.

What we collect

Account information: your name, email address and optional phone number. Workspace content: whatever your organisation chooses to store, such as grants, budgets, uploaded documents, funder and donor contacts. Usage information: basic technical logs needed to keep the service secure and reliable. We do not sell personal information, and we do not use your workspace content for advertising or to train anything.

Beneficiary and special personal information

Our structured impact reporting works on aggregate numbers (for example, counts of people reached by age band), which is what funders ask for and which avoids holding named beneficiaries. However, your document vault and evidence notes can hold whatever files and text your staff upload. If you place special personal information (health, information about children, or details of a person's circumstances) into the vault or evidence, you remain the responsible party for it and must have a lawful basis under POPIA sections 26, 27 and 34. We recommend keeping identifiable special personal information out of the platform, and we can help you configure your workspace to do so.

Cross-border processing (section 72)

Some processing necessarily happens outside South Africa. Each is either necessary to perform our contract with you (POPIA s72(1)(b)) or done with your consent, and each provider processes personal information under a written agreement with security and confidentiality obligations:

• Sign-in: authentication runs on Google's global identity service, which holds only your email address and your account identifier. Your name, phone and preferences stay in Johannesburg.
• Email: reminder and digest emails are delivered by a United States provider, which receives the recipient's email address and the message (titles, dates and links only, never financial figures or beneficiary details).
• Accounting sync (optional): if you connect Xero, QuickBooks Online or Sage, we read the ledger lines you have tagged to grants from that provider's servers, which are outside South Africa. You can disconnect at any time.

The companies that help us run the service

We use a small number of subprocessors. We will keep this list current and give reasonable notice of any material change:

• Google Cloud and Firebase: hosting, database, file storage and authentication. Workspace data in Johannesburg; authentication is a global Google service holding your email only.
• Resend: transactional email delivery (United States).
• Xero, QuickBooks Online and Sage: accounting-system sync, only for organisations that choose to connect one (outside South Africa).

How long we keep it

We keep your workspace data for as long as your account is active. When an administrator deletes a workspace, it is recoverable for a 30-day grace period and then permanently erased: every record, every stored document, and any connected accounting credentials. Where the law requires a longer period (for example, section 18A donation records and tax-related documents under the Tax Administration Act, generally five years), we retain those for the period the law prescribes. Backups are cycled and purged on a rolling schedule.

Messages we send

Deadline reminders and weekly digests carry titles, dates and links only, never financial figures or beneficiary details. Any electronic marketing or donor appeal you send through the product is subject to POPIA section 69: you must have the recipient's consent. Record it against the donor; a structured consent register is on the roadmap and is not built yet. You control your own reminder channels and can switch them off at any time.

Your rights

You may request access to, correction of, or deletion of your personal information. Organisation administrators can export their full workspace as a data file and can delete the workspace entirely from within the product (Settings, then Your data); deletion runs after a 30-day grace period. To exercise any right, or if you are not an administrator, email privacy@claripick.com. You may also lodge a complaint with the Information Regulator of South Africa.

Security

Data is encrypted in transit and at rest. Access is controlled per organisation and per role; every sensitive change is written to an append-only audit trail your administrators can review; payment approvals require two people; and any accounting-system credentials are encrypted a second time with a key we hold separately, so a stored credential is useless on its own. If a breach ever occurs that compromises your personal information, we will notify the Information Regulator and affected users as section 22 of POPIA requires.

Contact

Information Officer, Claripick (Pty) Ltd: privacy@claripick.com. We respond to privacy requests within the periods POPIA prescribes. Our PAIA manual is available on request.