Privacy Policy

1. Introduction

CityFlow AI ("we", "our", "the Platform") is committed to protecting the personal information of users and municipalities that access our Platform. This Privacy Policy explains how we collect, use, disclose and safeguard your information in accordance with the Protection of Personal Information Act (POPIA) and applicable South African law.

2. Information We Collect

• Account information: name, email address, phone number, municipality.
• Usage data: pages visited, features used, timestamps, IP address.
• Municipal data: projects, properties, infrastructure assets and service requests entered by your team.
• Billing information: handled by our payment processor — we do not store raw card details.

3. How We Use Your Information

• To provide, operate and improve the Platform.
• To send service notifications, security alerts and administrative messages.
• To process subscription payments and manage your account.
• To generate aggregated, anonymised analytics to improve our services.
• To comply with legal obligations.

4. Data Sharing & Third Parties

We do not sell your personal information. We may share information with:

• Supabase: database and authentication infrastructure.
• Payment processors: for subscription billing (PCI-DSS compliant).
• Law enforcement: when required by a valid legal process.

5. Data Retention

We retain your data for the duration of your subscription plus 30 days after termination to allow data export. Anonymised usage analytics may be retained for up to 24 months. Backup data is securely deleted within 90 days of the retention period expiry.

6. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, row-level security on all database tables, regular security audits, and role-based access controls. No system is 100% secure; we encourage you to use strong passwords and enable two-factor authentication.

7. Your Rights (POPIA)

Under POPIA you have the right to: access personal information we hold about you; request correction of inaccurate information; object to processing; request deletion (subject to legal retention requirements); and lodge a complaint with the Information Regulator of South Africa.

8. Cookies

We use essential cookies required for authentication and session management. We do not use advertising or cross-site tracking cookies.

9. Changes to This Policy

We will notify you by email and in-app notification at least 30 days before making material changes to this Privacy Policy.

10. Contact & Information Officer

For privacy enquiries or to exercise your rights, contact our Information Officer at privacy@cityflow.ai.