Privacy Policy
Last updated: 24 July 2026
Corporate customer? See our Data Processing Addendum for sub-processor list, security controls, breach notification timelines and international transfer safeguards.
What we collect
When you create an account we store your email address, business name and the answers/scores you submit to our diagnostics and learning modules. Documents you upload as evidence are stored in our secure backend.
How we use it
We use this data to generate your Investment Readiness Index, return your progress when you sign in, email you the diagnostic reports you request, and (for funders you authorise) share your aggregate readiness scores. We do not sell your data.
Who can see it
Only you (when signed in) and authorised Fetola team members. Approved funders may see aggregated/anonymised cohort statistics or your IRI when you opt-in. Database access is gated by row-level security so other users cannot read your data.
Retention & deletion
You can request deletion of your account and associated data at any time by emailing privacy@fetola.co.za. We respond within 30 days.
Security controls
- TLS 1.2+ in transit, AES-256 at rest.
- Row-level security on every customer table; passwords checked against the Have I Been Pwned breach corpus on sign-up.
- Two-factor authentication (TOTP) available to all users on the Security page; required for administrators.
- 30-minute idle session timeout and step-up re-authentication on sensitive admin actions (dashboard exports, share-link revocation).
- Tamper-resistant admin audit log retained for 12 months.
Cookies
We use a session cookie to keep you signed in. No third-party advertising cookies.
Contact
Information Officer: privacy@fetola.co.za. Security incidents: security@fetola.co.za.