Privacy

This notice describes the personal information collected through this website and the RadarCipher application, what it is used for, where it is kept, who can reach it and how long it is kept. It describes how the product and the live service currently work.

RadarCipher is a business software service operated under the VirtualCoreX freelance service brand. VirtualCoreX is an unincorporated South African business and is not a registered company or corporation. The supplier disclosures are on the supplier information page. Privacy questions and requests can be sent to support@radarcipher.com.

Privacy and data-protection enquiries, including requests under the Protection of Personal Information Act, can be sent to support@radarcipher.com.

This website, the RadarCipher application, its database and its backups run on one virtual server rented from Vultr (The Constant Company, LLC), located in Singapore. Personal information RadarCipher holds is therefore stored and processed outside South Africa.

The measures this notice describes apply to that information wherever it is held.

This site sets no analytics cookies, no advertising cookies and no tracking pixels, and it embeds no third-party scripts. Fonts are served from the site itself rather than from a font provider.

The web server records each request to this website and the application: the IP address, the time, the page requested and the browser’s details. These request logs are rotated daily, and the previous ten days are kept.

Your account: your name, email address, a hash of your password (never the password), your locale and timezone, and the devices signed in as you, with the IP address and browser details recorded when you sign in. A second authentication factor, if you set one up, is stored encrypted. Sign-in attempts record the email address used, the IP address and browser details.

Your organisation: its name, country, timezone, working hours and currency; the legal name, contact details, address, industry and email domains you enter for it; the people in it and their roles; and its subscription state.

Operational data from the systems you connect: this is the substantial part. To find what has not happened, RadarCipher reads and stores a canonical record of messages, calendar events, companies, contacts, deals, quotes and tasks from the systems you connect — including message content, because whether a customer is still waiting for an answer cannot be judged from a subject line. This includes personal information about the people your organisation deals with, such as their names, email addresses and the messages exchanged with them.

What it derives: findings, the evidence behind them, risk scores, suggested actions and drafts, approvals, and the audit history of who did what, which records the IP address and browser details of the person acting.

Subscriptions: when you confirm a subscription, the quote and the version of the Commercial Terms it was confirmed under are recorded. When you confirm a cancellation, the version already governing that subscription is recorded. Either way, the IP address and browser details of the person confirming are recorded too.

To do the one thing the product does: notice that something expected has not happened, and be able to show you why it thinks so. A finding without its evidence is an assertion, and the evidence is the underlying records.

Your organisation decides what RadarCipher may read by choosing which systems to connect and approving access at the provider. On the live service, HubSpot can be connected today; Google Workspace and Microsoft 365 connections are built but not yet available there. RadarCipher requests read access only: for HubSpot, read access to companies, contacts, deals, quotes and owners; for Google, read-only Gmail and Google Calendar access; for Microsoft 365, Mail.Read and Calendars.Read. Each also identifies the account being connected. Access to act in a connected system, such as sending a message, would first have to be approved at that provider.

Your name and email address are needed to create an account and use the application. Connecting a system is your organisation’s choice; without a connection RadarCipher has nothing to examine for it.

Your organisation’s data is bound to your organisation in the database itself, under PostgreSQL row-level security that the application’s own database role cannot switch off. Within your organisation, what each person can see and do is decided by their role.

RadarCipher’s support tools do not show your organisation’s business content, such as messages, findings or records from connected systems, by default. They show limited account information, such as your organisation’s name, subscription state, usage counts and the health of connected systems. Viewing business content to support you needs a support session opened with a recorded reason. A support session is read-only, limited to your organisation and ends automatically within eight hours, and opening and ending it are recorded in RadarCipher’s internal audit records.

Whoever administers RadarCipher’s server, database and backups can technically access stored data, and does so only where necessary to operate, secure or restore the service.

Vultr (The Constant Company, LLC) provides the server described above.

The systems you connect — HubSpot today, and Google or Microsoft once available — are the sources of the data. RadarCipher reads from them; they are not recipients of anything.

Payments are taken by PayFast, through the PayFast merchant account operated under the VirtualCoreX freelance service brand. To start a checkout, RadarCipher asks VirtualCoreX’s billing service to create it, identifying your organisation by an internal reference. PayFast collects the payment details. RadarCipher never receives or stores a card number.

Email: account and notification emails are sent through Namecheap Private Email, which receives each recipient’s address and the message in order to deliver it. Namecheap publishes a Data Processing Addendum for its hosted services. RadarCipher’s own logs record a partly masked recipient address and the subject of an email, never its content or links.

AI processing: RadarCipher does not currently send your organisation’s content to an AI model provider, and no AI provider is configured on the live service. This notice will be updated before that changes.

RadarCipher uses no analytics, advertising, error-tracking or telemetry service.

Kept until deleted by hand: account and organisation details, records imported from connected systems, findings and their evidence, audit history, notification records and invitations. RadarCipher does not currently delete these automatically, and cancelling a subscription does not delete them. Audit history is append-only: it can be read but not rewritten.

Connected systems: a record deleted in a connected system is marked as archived in RadarCipher rather than deleted. Disconnecting a system stops synchronisation, deletes its stored credential and, for Google and HubSpot, asks the provider to revoke RadarCipher’s access; the records already imported are kept.

Deleted automatically: a sign-in session after 30 days, after 7 days without use, or 30 days after it was signed out; sign-in attempts after 90 days; verification and password-reset links once they expire, or 7 days after use; and records of completed background work after 7 days, or 30 days if it failed.

Logs and backups: application logs are kept until they reach a fixed size and are then overwritten. Web server request logs are kept for ten days. A backup of the database is taken every day and kept for 14 days, on the same server and without separate encryption. Backups taken before maintenance are kept until they are removed.

You can see and correct your account details in the application. You can ask for access to, correction of, or deletion of the personal information RadarCipher holds about you by writing to support@radarcipher.com.

A deletion request for a user account is currently carried out by retiring the account: its email address, password and sign-in methods are removed, while the name and the record of what the account did are kept. There is not yet a process for deleting an organisation and the records imported into it.

Where the Protection of Personal Information Act 4 of 2013 applies, you may also lodge a complaint with the Information Regulator.

This website sets none. The application sets a session cookie when you sign in, which is what keeps you signed in; it is necessary for the service and is not used for tracking.