StaffvanePrivacy policy
Last updated 8 October 2026
Who we are
Staffvane is operated by to be confirmed (registration number to be confirmed), to be confirmed. This policy explains what personal information Staffvane holds, why, where it is kept and what you can do about it. It is written with the Protection of Personal Information Act, 2013 (POPIA) in mind.
Two kinds of relationship
Companies that use Staffvane decide what employee information to keep in it. For that information the company is the responsible party and Staffvane is its operator: we process it only to provide the service, on the company’s instructions. If you are an employee, your employer is the first place to ask about your records.
Account holders. For the account you sign in with (your name, email address and password), Staffvane is the responsible party.
What is kept
- Account: name, email address, a hashed password, and two-step verification settings if you turn them on.
- Employee records entered by the company: contact details, job title, department, manager, start date, and, where the company chooses to record them, identity number, salary and documents such as contracts.
- Attendance: clock-in and clock-out times and the method used. If the company’s policy requires it, the location of the phone at the moment of clocking in or out (not at any other time), or a photo taken when clocking in with the app. A photo can be seen by you and by the company’s owners, admins and HR; each time it is opened is recorded; and it is deleted after 90 days. Nothing compares the photo with your face: Staffvane does no face recognition.
- What colleagues see: your name, job title, department, manager and work email, in the company’s directory. Not your phone number, ID number, salary, documents, attendance or leave.
- Leave: requests, balances, decisions and any certificate attached. The reason for leave and medical certificates can be special personal information; they are visible only to the employee, their manager and the people who run HR for the company.
- Work: projects, tasks and comments.
- Security records: an audit log of sensitive actions (who viewed a salary, who changed a role), sign-in sessions, and the network address of requests.
- Phone notifications: if you turn them on, a token that lets us send notifications to that phone.
We do not sell personal information, use it for advertising, or use tracking cookies. The website sets one cookie, which keeps you signed in.
Why it is kept
To provide the service the company signed up for: keeping employee records, recording attendance, managing leave and tracking work; to keep accounts secure; and to send the emails and notifications the service depends on (invitations, password resets, leave decisions).
Where it is kept, and who else handles it
Staffvane’s database is hosted in Frankfurt, Germany. Personal information is therefore transferred outside South Africa (POPIA section 72). There is no South African region available from our database provider. Providers in the European Union are subject to the General Data Protection Regulation, which gives protection substantially similar to POPIA; providers elsewhere process information under contracts that require the same. By using Staffvane a company agrees to this transfer on behalf of its organisation.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Neon | Database hosting | All records, encrypted at rest | Frankfurt, Germany (EU) |
| Vercel | Runs the website and the API | Requests as they pass through; nothing is stored | Frankfurt, Germany (EU) |
| Cloudflare R2 | File storage | Uploaded documents, sick notes, logos and data exports | European Union |
| Resend | Sends email | The recipient’s address and the content of each email | European Union and United States |
| Inngest | Runs scheduled and background work | Job details, encrypted by us before they are sent | United States |
| PayFast | Takes card payments for subscriptions | The paying owner’s name and email, and the amount. Card details go to PayFast only | South Africa |
| Sentry | Receives reports when Staffvane has an error | The error, where in the product it happened, and the ids of the company and account. No names, emails or anything typed | Frankfurt, Germany (EU) |
| Expo | Delivers push notifications to phones | A device token and the notification text | United States |
How it is protected
Each company’s records are separated from every other company’s in the database itself, not only in the application. Connections are encrypted. Files are private and reached only through short-lived links. Salary views and other sensitive actions are recorded. Passwords are stored hashed and can’t be read by anyone, including us.
How long it is kept
- A company’s records are kept for as long as the company uses Staffvane. Employers are required by law to keep some employment records for set periods; that decision is the company’s.
- Notifications are removed after 90 days.
- A data export file is removed after 7 days.
- When a company asks to be deleted, everything is removed 30 days later, including the accounts of people who belong to no other company. Database backups held by our hosting provider expire on a short rolling period after that. We keep one line recording that the deletion took place, with no personal information.
Your rights
You may ask to see the personal information held about you, to have it corrected, and in some cases to have it deleted or to object to its use.
- Employees: ask your employer first; they control your records and can correct them directly.
- Company owners can export everything their company holds, and delete the company, from Settings → Company → Your data.
- Anyone can contact our Information Officer, to be confirmed, at to be confirmed.
If you are not satisfied with our answer you may complain to the Information Regulator of South Africa: inforegulator.org.za.
If something goes wrong
If personal information is accessed by someone who shouldn’t have it, we will tell the affected companies and the Information Regulator as soon as reasonably possible, with what happened and what we are doing about it.
Changes
When this policy changes in a way that matters, we will tell company owners by email before it takes effect. The date at the top shows the latest version.