Privacy policy

Last updated 13 October 2026

This policy explains how Crypti (Pty) Ltd (“Crypti”, “we”, “us”) collects, uses, stores and shares personal information when you visit torque.crypti.co.za, join the Torque waitlist, or use the Torque product at app.torque.crypti.co.za. It is written for the Protection of Personal Information Act 4 of 2013 (POPIA) first, with notes for visitors in the European Union and United Kingdom under the GDPR and UK GDPR.

We keep this short and concrete. If anything here is unclear, write to [email protected].

1. Who we are

Crypti (Pty) Ltd, registration number 2023/626567/07, registered address 281 Chopin Avenue, Centurion, 0157, South Africa, is the responsible party (POPIA) and the controller (GDPR) for the personal information described in this policy.

Our Information Officer is Chad Michael Blanchard, reachable at [email protected]. The Information Officer handles access requests, objections, complaints and questions about this policy.

2. What this policy covers

It covers the public website, the waitlist, accounts in the Torque product, organisations created in Torque, and the data Torque reads from connected Git hosts. It does not cover websites we link to, or your own organisation’s use of personal information inside its Torque organisation — for that your organisation is the responsible party and we process on its instructions.

3. What we collect

Waitlist

Your email address (required), and if you choose to give them: your name, company, role and team size. We also record the time and policy version you consented under, a keyed hash of the network address the request came from (not the address itself) and a shortened browser identifier, to spot abuse. When you arrive from a link with campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) or from another website, we store those parameters and the referring site’s domain name (not the full address) with your entry, so we know which channel brought you here. These are captured once, on your first visit in a browser session, and kept only if you join the waitlist. We use double opt-in: nothing is kept as a confirmed entry until you click the link we email you.

Accounts

When you sign up: email address, display name, an optional avatar, your password (stored only as a hash) or the identifier from the sign-in provider you chose (GitHub or Google), session records (time, truncated network address, browser), and your theme preference. If you tick “Send me product updates” when you sign up, we record the time you did so; the box is unticked by default and you can withdraw at any time with the unsubscribe link in any product update.

Organisations

Organisation name, slug, logo and brand colour; members, roles and invitations; verified email domains; settings and audit events (who changed what, when, from which network address).

Git host metadata

When an organisation connects GitHub or GitLab, Torque reads repository names, visibility, default branches, branch names and commit identifiers, and the identity of the installing user. Torque does not clone or index source code in the current release. Access tokens are stored encrypted and are decrypted only inside a background job that needs them.

Agent content (future features)

Planned features will let your organisation run coding agents against its repositories, store tickets, agent output, merge request comments and knowledge base documents. That content belongs to your organisation and may contain personal information your organisation puts there. We will update this policy before those features reach you.

Technical information

Server logs with request identifiers, truncated network addresses and user agents; error reports (without secrets or tokens) when something breaks. The website loads Google Analytics only after you accept analytics in the cookie banner; see section 11.

4. Why we process it, and on what basis

Waitlist: to contact you about access to Torque. Basis: your consent (POPIA section 11(1)(a); GDPR article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email.
Product updates and analytics: to tell members what changed and to understand how the website is used. Basis: your consent (POPIA section 11(1)(a); GDPR article 6(1)(a)), given by ticking the sign-up box or accepting analytics in the banner. Withdraw it at any time: unsubscribe link, or Cookie settings in the website footer.
Accounts and organisations: to provide the service you asked for. Basis: performance of a contract (POPIA section 11(1)(b); GDPR article 6(1)(b)).
Security, abuse prevention, audit trails and logs: to keep the service safe and prove what happened. Basis: our legitimate interests (POPIA section 11(1)(f); GDPR article 6(1)(f)), balanced against your rights.
Legal obligations, such as responding to a lawful request: POPIA section 11(1)(c); GDPR article 6(1)(c).

We do not sell personal information, use it for advertising, or make automated decisions with legal effect about you.

We use a small number of operators (POPIA) / processors (GDPR) who act on our instructions under written terms:

Hetzner Online GmbH (Germany), which hosts our servers, databases, queues and backups in data centres in the European Union.
Cloudflare, Inc. (USA), which provides DNS and network protection for our websites and stores uploaded files (organisation logos and avatars today, attachments later) in Cloudflare R2.
Twilio Inc. (SendGrid, USA), which delivers confirmation, sign-in, invitation and notification emails.
Functional Software, Inc. (Sentry, USA), which receives error reports with secrets and tokens removed.
Google LLC (USA): Google sign-in, if you choose to sign in with Google, and Google Analytics 4, which receives truncated network addresses and page interactions from the website — only after you accept analytics in the cookie banner.
Loops (Loops, Inc., USA), the service we use to send waitlist and product-update emails and to keep the list of who has subscribed and unsubscribed.
GitHub, Inc. (USA) and GitLab Inc. (USA), or your organisation’s self-managed GitLab, when you sign in with GitHub or your organisation connects them — governed by their own terms and your account with them.

Coding and review agents always run on your organisation’s own Anthropic (Claude) or OpenAI (Codex) subscription or API key. Code, prompts and output sent to those providers go under your organisation’s agreement with them; we do not supply, resell or proxy model access.

We may also disclose information when the law requires it, to protect the rights or safety of a person, or as part of a merger or sale of the business, in which case this policy continues to apply.

6. Transfers outside South Africa

Our servers, databases and backups are hosted by Hetzner in the European Union. Cloudflare, SendGrid, Sentry, Google, Loops, GitHub and GitLab process data in the United States of America and other countries. We transfer personal information outside South Africa only where POPIA section 72 allows it: the recipient is bound by a law or agreement that gives substantially similar protection, the transfer is necessary for the contract with you, or you have consented.

EU and UK visitors: our hosting is in the EU. Transfers to the United States of America and elsewhere rely on the EU–US Data Privacy Framework (and the UK extension) where the provider is certified, or otherwise on the standard contractual clauses (and the UK addendum) with the provider.

7. How long we keep it

Waitlist entries that are never confirmed are deleted after 30 days.
Confirmed waitlist entries are kept until you unsubscribe or until Torque opens to you and you create an account, whichever comes first, and then for up to 12 months.
When you unsubscribe, the entry is deleted in the next nightly clean-up and only a one-way hash of the address is kept, so we never email it by mistake.
Account and organisation data, including the organisation’s audit events: for as long as the account or organisation exists.
When an owner deletes an organisation, it is removed 14 days later — its database, files and audit events — unless an owner cancels the deletion before then.
Server logs: 30 days, unless we need them longer to investigate an incident or meet a legal duty.
Error reports: deleted by our error monitoring service within 90 days.
Backups: encrypted copies of our databases are kept for up to 6 months, so deleted information leaves the last backup within 6 months. If we ever restore from a backup, we delete again anything that was deleted after that backup was taken.
Your cookie choice is stored in your browser for 12 months, then we ask again.
Our CRM record of a waitlist member or an opted-in member (email, name, company, role, team size, campaign parameters, subscription status) is deleted when the waitlist entry is deleted or the account is closed, and no later than 12 months after you unsubscribe.

8. How we protect it

Each organisation has its own database. Secrets such as Git host tokens are envelope-encrypted: every secret has its own data key, wrapped by a master key held outside the database. Passwords are hashed with a modern algorithm. Connections use TLS. Access to production is limited to the people who operate it, and administrative actions are logged. Self-managed Git hosts must be reachable over the public internet; private and loopback addresses are refused.

No system is perfectly secure. If we learn of a breach that is likely to affect you, we will notify you and the Information Regulator as POPIA section 22 requires, and supervisory authorities as the GDPR requires.

9. Your rights

Under POPIA you may ask us what personal information we hold about you and how it has been used (section 23), ask us to correct or delete it (section 24), object to processing based on legitimate interests (section 11(3)), and withdraw consent at any time (section 11(2)(b)). Under the GDPR you additionally have rights to restriction, portability and to lodge a complaint with a supervisory authority.

To exercise a right, email [email protected] from the address concerned, or write to the Information Officer at 281 Chopin Avenue, Centurion, 0157, South Africa. We may ask for proof of identity. We respond within the period the law allows — normally 30 days — and we do not charge for a first request unless it is manifestly excessive.

Our PAIA manual, at torque.crypti.co.za/paia-manual, explains how to request other records we hold, the fees, and how we process personal information.

10. Complaints

If you are unhappy with how we handled a request, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; 010 023 5200; [email protected]; inforegulator.org.za. EU and UK residents may complain to their local data protection authority.

11. Cookies

The website stores your cookie choice in your browser’s local storage under the name torque_consent, for 12 months. That is the only thing stored before you decide.

If you accept analytics, Google Analytics 4 sets the first-party cookies _ga (2 years) and _ga_<measurement id> (2 years) to tell visits apart, and sends page views, section views, scroll depth, outbound clicks and waitlist steps (never your email or anything you type) to Google with a truncated network address. We use Google Consent Mode: nothing from Google loads until you accept, and rejecting loads nothing at all. Change your mind any time with “Cookie settings” in the footer; withdrawing stops the measurement and removes the Google cookies we can reach.

The product sets only the cookies it needs to keep you signed in and to protect forms against cross-site request forgery. Those are essential, so no banner is shown there.

12. Children

Torque is for professional use. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to [email protected] and we will delete it.

13. Changes to this policy

We will update this page when our practices change, and change the “Last updated” date. For material changes affecting waitlist members or account holders we will also email you before they take effect. Your waitlist consent is recorded against the version in force when you gave it.

14. Contact

Crypti (Pty) Ltd, 281 Chopin Avenue, Centurion, 0157, South Africa. Information Officer: Chad Michael Blanchard, [email protected].