Privacy Policy

1. Responsible Party

The responsible party for the processing of your personal information, as defined in POPIA, is:

You may lodge a complaint with the Information Regulator (South Africa) at inforeg.org.za if you believe your personal information has been processed in violation of POPIA.

2. Personal Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide

2.2 Information Collected Automatically

We do not use cookies for tracking or advertising. We do not use invasive third-party analytics (no Google Analytics, no Meta Pixel).

We use Vercel Analytics and Vercel Speed Insights to understand aggregate page views and site performance. These services are privacy-friendly: they do not use cookies, do not track individual users across sites, do not collect personal information, and are GDPR-compliant. Data is collected in aggregate form only (e.g., total page views, average load times) and cannot be used to identify you.

3. Legal Basis for Processing (POPIA Section 11)

We process your personal information on the following grounds:

• Consent (s11(1)(a)): By submitting the waitlist registration form, you voluntarily consent to the processing of your email, company name, and AI adoption estimate for the stated purposes.
• Legitimate interest (s11(1)(f)): Job descriptions are processed to provide the resilience analysis you requested. Aggregate, anonymised data may be used for AI adoption trend research.
• Contract (s11(1)(b)): Processing is necessary to provide the analysis service you requested.

4. How We Use Your Information

• • To provide AI resilience analysis results
• • To notify you when premium features launch (if you joined the waitlist)
• • To track aggregate, anonymised AI adoption trends across industries
• • To improve the accuracy and quality of the scoring engine
• • To prevent abuse (rate limiting)

We will never sell your personal information to third parties. We will never use your email address for unsolicited marketing beyond the premium launch notification you opted into.

5. Third-Party Processors & Cross-Border Transfers

Your information may be processed by the following third-party service providers, some of which operate outside the Republic of South Africa. Per POPIA Section 72, we ensure these parties maintain adequate data protection measures:

Job descriptions submitted for analysis are sent to OpenAI's API for processing. With API usage, OpenAI does not use submitted data for model training per their API data usage policy.

6. Data Retention

7. Your Rights Under POPIA

As a data subject, you have the right to:

• Access (s23): Request confirmation of what personal information we hold about you and obtain a copy.
• Correction (s24): Request correction or deletion of inaccurate, irrelevant, or excessive personal information.
• Deletion (s24): Request deletion of your personal information. We will comply within 30 days unless a legitimate reason for retention exists.
• Objection (s11(3)): Object to the processing of your personal information on reasonable grounds.
• Withdraw consent: Withdraw your consent to processing at any time, without affecting the lawfulness of processing before withdrawal.
• Complaint (s74): Lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise any of these rights, email privacy@theresiliencematrix.com. We will respond within 30 days as required by POPIA.

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal information (POPIA s19), including:

• • All data transmitted over HTTPS (TLS 1.3)
• • Database access restricted via row-level security policies
• • API rate limiting to prevent abuse
• • Prompt injection detection to prevent misuse of the analysis engine
• • No storage of passwords (we do not have user accounts)
• • Environment variables for all API keys and secrets

9. Children's Information

The Resilience Matrix is designed for professionals and is not directed at children under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly. Per POPIA s35, processing of children's personal information requires prior consent of a competent person.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. Your continued use of the service after changes constitutes acceptance of the revised Policy.

11. Contact

For any questions about this Policy, to exercise your data subject rights, or to lodge a complaint:

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):