Privacy policy

This policy explains what personal information KhutsoGRC collects, why, and what rights you have.

Who we are

KhutsoGRC provides online compliance readiness self-assessments. For privacy questions, contact info@khutsogrc.com.

What we collect and why

• Account information (email, optional name): to create and secure your account. Legal basis: contract.
• Assessment data (answers, notes, scores): to provide the service. Legal basis: contract.
• Billing information (handled by Stripe): to take payment. Legal basis: contract and legal obligation.
• Usage events and marketing source (for example which link you signed up from): to improve the product. Legal basis: legitimate interest.
• Emails: account emails are part of the service. Trial reminders can be switched off in Account.

Who we share it with

We use trusted service providers (operators) to run KhutsoGRC: Supabase (hosting and authentication), Vercel (hosting), Stripe (payments), Resend (email) and, if enabled, PostHog (product analytics). They may only use your information to provide their service to us. We don't sell your information.

Cross-border transfers

Some providers store data outside South Africa. We only use providers with data protection terms that give protection similar to POPIA.

How long we keep it

See our Security & data handling page for retention periods.

Your rights

You can ask to access, correct or delete your information, object to processing, or withdraw consent. Most of this can be done in the app. For anything else, email info@khutsogrc.com. You also have the right to complain to the Information Regulator (South Africa).

Cookies

We use essential cookies to keep you signed in and to remember which assessment link you came from. We don't use advertising cookies.