Privacy Policy

This Privacy Policy describes how Elestack Digital Solutions ("Elestack", "we", "us") collects, uses and protects personal information through ComplianceDesk (the "Service").

1. Information we collect

Account information (name, email, organisation), authentication data (hashed passwords, MFA enrolment status), content you upload to the Service (control statuses, evidence files, policy documents, incident records), and operational data such as audit log entries, IP address and request metadata used for security and rate limiting.

2. How we use information

To provide and secure the Service, authenticate users, send transactional emails (verification, password reset, invites), process billing, and — where you opt into AI features — to generate gap analyses, summaries and chatbot responses. Prompt and response content sent to AI features is not persisted; only metadata about the request (timestamp, feature used, organisation) is logged.

3. Multi-tenant isolation

Each organisation's data is logically isolated. Every request is checked against the requesting user's organisation membership before any tenant-scoped data is read or written, enforced at the application layer on every code path that serves data. Members of one organisation cannot access another organisation's data through the Service.

4. Sub-processors

Depending on configuration, the Service may use third-party sub-processors for email delivery (Cloudflare Email Service, or an SMTP provider), file storage (Cloudflare R2 or another S3-compatible provider, or a self-hosted disk), payment processing (Paystack or PayFast, depending on the configured gateway), and error monitoring (GlitchTip or Sentry, only if enabled), and — only if you accept analytics cookies — Google Analytics. AI-assisted features, where enabled, currently run against an internal, non-third-party engine — no prompt or document content is sent to an external AI provider. Each sub-processor only receives the data necessary to perform its function.

5. Cookies and analytics

We use one strictly-necessary cookie to keep you signed in, which does not require consent under POPIA or the GDPR. If you accept via the cookie banner, we also use Google Analytics to understand how visitors use our public marketing pages (not the authenticated application) — this is optional, and we do not load Google Analytics or set its cookies until you accept. You can withdraw acceptance at any time by clearing your browser's local storage for this site, which will show the banner again on your next visit.

6. Data retention and deletion

Customer Data is retained for as long as an organisation's account is active, plus a reasonable period after termination to allow export, after which it is deleted. The audit log is insert-only and is not deleted on a per-action basis, consistent with its purpose as a tamper-resistant compliance record.

7. Your rights

Depending on your location, you may have rights to access, correct, export or delete your personal information (for example under POPIA or the GDPR). Requests can be directed to your organisation administrator or to legal@compliance-desk.com.

8. Security

We use measures including encrypted transport, application-enforced multi-tenant isolation, rate limiting and security headers to protect personal information. No system is completely secure, and we cannot guarantee absolute security.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to account owners before they take effect.