Privacy policy
How XEQT (Pty) Ltd handles personal information in AdventureOS, for the operators who use it and for their customers.
Draft awaiting legal review. This describes what the system actually does with personal information. The POPIA and GDPR wording has not yet been settled by counsel and must be replaced with reviewed text before the service is sold.
Two kinds of people, two roles
For the operators who hold an account with us, we are the responsible party (the controller): we decide what we collect and why. For an operator's own guests and staff, the operator is the responsible party and we are the operator (the processor) — we hold and process that information on their instructions and for no purpose of our own.
What we collect about account holders
- Name, work email and the organisation you belong to.
- Authentication records: sign-in times, devices, sessions and security events.
- Billing records: invoices, payments and the bookings a fee was charged on.
- Support correspondence.
- Operational logs needed to run and secure the service.
What an operator's account holds about their guests and staff
- Guest booking details: name, contact details, the activity booked and what was paid.
- Staff records: who worked which session, at what rate, and what they were paid.
- Partner and agent records, including banking details, which are encrypted at rest.
This information belongs to the operator. We do not sell it, we do not use it to market to their guests, and it is isolated per tenant at the database level rather than by an application filter.
Who else sees it
Only the service providers needed to run the service — hosting, email delivery, payment providers you have connected, and any optional module you switch on. Each receives the minimum needed to do its job. Cross-operator sharing in the referral network happens only with explicit opt-in.
How long we keep it
For as long as the account is open, and afterwards only for as long as the law requires us to keep financial records. Operational logs are kept for a short, fixed period.
Where it is held
Data is held on infrastructure we operate. Cross-border transfers are made only where an adequate legal basis exists.
Your rights
You may ask us what we hold about you, ask for it to be corrected or deleted, object to processing, and ask for a copy in a portable form. A guest or staff member of an operator should direct such a request to that operator, and we will assist the operator in answering it.
Contact
Privacy questions and requests: support@adventureos.app. You also have the right to complain to the Information Regulator of South Africa.