legal
Privacy Policy
Effective: 1 May 2026 · Last updated: 13 July 2026
1. Who we are
Solvd Studio (Pty) Ltd (“Solvd Studio”, “we”, “us”) is registered in South Africa. We operate the Thola tender intelligence platform at thola.solvdstudio.co.za and the studio homepage at solvdstudio.co.za.
2. What we collect
Account information
Name, email address, phone number (optional). Collected when you sign up.
Business profile
Sectors, keywords, provinces, B-BBEE level, CIDB grading, budget range, and business-registration details (legal/trading name, CIPC/CSD/VAT/tax numbers, addresses, contact details). Collected during onboarding and profile completion.
Special personal information (POPIA §26) — optional, consent-only
If you choose to complete your profile for eligibility assessment and bid-form auto-fill, you may provide special personal information — your ownership demographics (race / gender / youth / disability breakdown) and owner age — together with other sensitive details (annual turnover, banking details, SARS tax-compliance PIN). We collect these only with your explicit, granular, purpose-specific consent, recorded with a timestamp and withdrawable at any time. They are stored server-side under strict access controls and are never shown in any shared or public output — only the resulting eligibility pass/fail is surfaced.
Directors' and shareholders' information — third-party data
If you add directors or shareholders to your business profile for bid-form auto-fill, Thola processes the following information about those individuals: full name, South African ID number or passport number, nationality, and shareholding percentage. These are third parties who have not signed up for Thola directly.
Director and shareholder names, nationalities, and shareholding percentages are retained in your mutable profile. SA ID numbers and passport numbers are never stored in Thola's records — they are used to fill the current document and then discarded. Only a reference to the profile field from which the value was drawn is recorded (not the value itself). This design ensures a POPIA §24 deletion request can always be honoured by clearing the profile — no immutable copy of the identifier is ever created.
You are responsible for ensuring you have a lawful basis to provide this information to Thola. See our Terms of Service, clause 6, for your obligations as the data controller for third-party personal information.
Compliance documents
PDFs you upload to the Compliance Vault: tax clearance certificates, B-BBEE certificates, CSD registration summaries, CIDB grading certificates, and similar. These are uploaded voluntarily and stored securely.
Usage data
Pages visited, features used, timestamps. Used to improve the product. Not linked to identifiable personal information in analytics.
3. Why we collect it
- §Account information: To identify you, send notifications, and provide support
- §Business profile: To match tenders to your business using our scoring algorithm
- §Directors' information: To auto-fill director and shareholder sections of bid forms (Annexure 5, SBD 7, CoR 30.1). Not used for any other purpose.
- §Compliance documents: To check your documents against tender requirements and identify compliance gaps
- §Usage data: To understand how the product is used and where to improve it
4. How long we keep it
- §Account and profile data: while your account is active, plus 12 months after account closure.
- §Directors' names, nationalities, shareholding percentages: retained in your mutable profile for as long as you keep them there. You may remove individual directors at any time from your business profile page. Account closure removes all director data within 30 days.
- §Directors' SA ID numbers and passport numbers: never retained in our records. They are used only to fill the current document and are discarded immediately. No value is stored in any log, audit record, or database table.
- §Compliance vault documents: until you delete them. Deletion is immediate and permanent.
- §Agent logs and usage data: 12 months rolling.
5. Who we share it with
We use the following sub-processors (acting as Operators under POPIA) to provide the service. We do not sell your data to third parties.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | US (AWS) |
| Anthropic | AI processing of document text and chat messages | US |
| Resend | Transactional email delivery | US |
| Trigger.dev | Background job processing | US |
| Vercel | Web hosting and edge functions | US / Global |
6. Cross-border transfers
Several sub-processors store data outside South Africa (primarily in the United States). Each operates under standard contractual clauses and privacy frameworks (GDPR, SOC 2) that provide adequate safeguards for the protection of personal information. By using Thola, you consent to your data being transferred to and processed in those countries.
7. Your rights under POPIA
- §Access: request a copy of your personal information we hold
- §Correction: ask us to correct inaccurate information
- §Deletion: request deletion of your account and associated data
- §Objection: object to specific processing activities
- §Complaint: lodge a complaint with the Information Regulator of South Africa
Information Regulator: inforegulator.org.za
8. Analytics
We use Plausible Analytics, a privacy-respecting analytics service that does not set cookies and does not track individual users. Usage statistics are aggregated. No personal information is sent to Plausible.
9. Contact us
For privacy-related requests or questions, email privacy@solvdstudio.co.za. We respond within 5 business days.
10. Changes to this policy
We may update this policy as the product evolves. Material changes will be communicated by email to registered users at least 14 days before taking effect. The effective date at the top of this page reflects the current version.