1. Who is responsible for your information
Elite Way Holdings (trading as Chad Studio), registration [CIPC REGISTRATION NUMBER], is the responsible party (the “data controller”) for the information described here. Our Information Officer is Information Officer, Elite Way Holdings, reachable at [privacy@your-domain.co.za].
2. What we collect, and why
- Account details — email address, display name, hashed password or one-time code, and session cookies. Needed to sign you in and keep tenants isolated.
- Creator profile — handle, platforms, follower tier, city corridor, and the content niches you select. Used to build your rate card, media kit, and pitch matches. This is published on your public kit or storefront only when you publish it.
- Usage measurement — daily totals of how long the workspace is genuinely open (seconds and session counts), kept for 62 days to answer questions like “how long do people use the app on average”. There is no activity trail, no content record, and no per-minute story kept about you.
- Sharing links — if you join through another creator’s link, we record that the link brought you (the application and the confirmed account are counted separately) so the 25-credit reward is paid honestly and only once. The person who shared the link sees counts, never your details. Country and city or province from the wait-list form stay with your application.
- Money-workspace data — rate cards, pitch drafts, deal pipeline notes, invoices you generate, and the entries you add to your SARS income vault. You create this; we store it so your tools keep working.
- Storefront data — store name, tagline, items, prices and the payment link you supply. Chad never processes or holds your buyers’ card data: buyers pay through your own Yoco, PayFast or similar checkout, so card details never reach us.
- Voice notes and transcripts you record — the text you dictate, the generated plan, and a local copy in your browser’s IndexedDB. Audio is processed by your own browser’s speech engine; we do not receive an audio file unless your browser sends text.
- Usage and credit records — which tools you ran, credits spent, and purchases. Needed for billing, fraud prevention and the daily free-credit grant.
- Technical logs — IP address, device/browser, timestamps and error details, kept briefly for security and debugging.
We do not collect special personal information (health, biometrics, religion, political views) and we do not buy contact lists.
Creator wait-list and Elite Club
When you apply for access, we collect your name, email, social profile link, content niche, city and province, and the time and version of your consent. Chad Studio and Elite Club use this to review your application and contact you about access, not unrelated marketing. Applications are visible only to authorised administrators and are not sent to creative services. You may withdraw consent or request removal using the Information Officer contact above. An invitation expires after seven days; accepting it does not start a paid plan.
3. Our lawful basis
- Contract — we need your account data to deliver the service you signed up for.
- Legitimate interest — security, fraud prevention, product reliability and aggregated usage measurement.
- Consent — marketing email, and anything optional. You can withdraw consent at any time without losing access to the product.
- Legal obligation — records we must keep for tax and consumer law.
4. Direct marketing (POPIA section 69)
We send product and campaign email on the basis of consent or an existing customer relationship, always with a one-click unsubscribe. If you give us your business address as a brand contact, we treat that as B2B correspondence under section 69(3) but you can still opt out immediately, and we honour that opt-out permanently.
Chad does not send email to other people on your behalf unless you explicitly trigger that send. Where you draft brand outreach, Chad prepares the message and hands it to you or your own mail client; you remain the sender and the responsible party for that correspondence.
5. Who else sees your information
We keep this deliberately short, and we do not sell data — ever.
- Supabase — managed Postgres database and authentication, hosted in the European Union (eu-west-1). Access is locked down with row-level security.
- Vercel — application hosting and content delivery.
- Brevo — transactional email delivery (only if a mailer is configured).
- our AI engine provider — a named third party, disclosed on request — only if an AI key is configured, and only for the specific prompt/response of a tool you run. Prompts are stripped of account identifiers, internal IDs, secrets and other users’ data before they leave our systems.
- Yoco — payment processing for Chad subscriptions and credit top-ups. Yoco handles card data under its own PCI-DSS obligations.
These providers are operators processing on our instruction. Where data leaves South Africa we rely on POPIA section 72, transferring only to jurisdictions with comparable protection and under contractual confidentiality.
6. How your sensitive workspace files are protected
Your SARS income vault and any vault-stored credentials are encrypted at rest with a server-held master secret, and the database is configured so that anonymous and logged-in clients have no direct table access — only our server can read them. If you no longer want that data, delete the entries or ask us to delete your account.
7. How long we keep things
- Account and workspace data: while your account exists, then 30 days in backups.
- Credit and payment records: 5 years (tax and consumer-law records).
- Security logs: up to 90 days.
- Password-reset and one-time codes: minutes, and they are single-use.
8. Your rights
Under POPIA you may ask us to confirm what we hold about you, correct or delete it, object to processing, withdraw consent, and complain to the Information Regulator (South Africa). Email [privacy@your-domain.co.za] and we respond within 30 days. You can also ask for a machine-readable copy of your account and workspace data.
If there is a security compromise affecting your personal information, we notify you and the Information Regulator as soon as reasonably possible after discovery.
9. Cookies
We set a session cookie so you stay signed in, a launch-attribution cookie that remembers which referral or campaign link brought you (30 days), and nothing else for advertising. Browser storage (IndexedDB and localStorage) is used to keep your offline voice notes and interface preferences on your own device.
10. Children
Chad Studio is for people 18 and older. We do not knowingly process children’s personal information; if you believe a minor has an account, contact us and we will remove it.
11. Changes
If this notice changes materially we email account holders and update the date at the top. Continuing to use Chad Studio after a change means you accept the updated notice.