Privacy Policy

1. Who we are

Embrisk ("Embrisk", "we", "us", "our") is an AI search and SEO intelligence platform for agencies, operated by Tapnet Solutions (Pty) Ltd, a South African company. Tapnet Solutions (Pty) Ltd is the responsible party as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA"). This policy applies to this website and to any subscription or engagement between Embrisk and a customer.

Responsible party: Tapnet Solutions (Pty) Ltd
Registration No: 2023/135522/07
Information Officer: Wynand de Beer (registered with the Information Regulator)
Phone: +27 79 174 8357
Email: [email protected]
Registered office: 594 Bombani Street, Elarduspark, Gauteng, 0181, South Africa

2. What personal information we collect

2.1 Information you provide directly

• Demo request data (/demo): Your name, work email address, agency name, the number of clients you manage, and anything you write in the notes field.
• Snapshot request data (/snapshot): Your work email address, agency name, your client’s website address, and, if you add them, the client’s type of business and city.
• Marketing preference: Whether you ticked the optional box to receive emails about Embrisk, and when. The box is never ticked for you.
• Where the request came from: The page you sent the form from and any campaign tags in its address (for example utm_source). Never your IP address.
• Subscription data: For customers on a paid plan, the contact details of the account owner and the users they invite, billing details, and the workspace configuration they create.
• Client data you connect: Where you connect a property such as Google Search Console, we process the data that property returns. That data belongs to you and we process it only to provide the service. See Section 11.
• Correspondence: Emails, call notes and messages exchanged during a demo or an active subscription.

2.2 Information collected automatically

• Server logs: Standard web server and edge logs kept by our hosting provider for security and abuse monitoring, including IP address, user agent, requested path and timestamp. Retained for 30 days.
• Anonymous visit counts: When a page loads, our server records the page, the website that linked to it (just its name, such as google.com), your country and whether you are on a phone, tablet or computer. It records no IP address, no browser details, no cookie and nothing that identifies you or your device. This is not personal information, and it is how we count visits from everyone.
• Analytics, only if you allow them: If you choose “Allow analytics” in our cookie banner, we set one first-party cookie holding a random number, so we can count how many different people visit and which pages they see. We build this ourselves: nothing is sent to Google, Meta or any other third party, and it is never used for advertising. If you choose “Essential only”, or your browser sends Global Privacy Control, this does not happen.
• Your cookie choice: We keep an anonymous record of each choice (a random ID, yes or no, the date and the policy version) as proof that we asked.
• No advertising tags. This website loads no third-party analytics, advertising, remarketing or session-recording script of any kind.

3. Why we collect your information

4. Who we share your information with

We share personal information only with the operators listed on our Operator Agreements page, and only to the extent necessary to deliver the service. We do not sell, rent or trade personal information, and we do not share it with advertisers or data brokers.

5. Cross border data transfers

Some of your personal information is stored and processed outside of South Africa. We use international cloud providers because they provide the reliability, edge network and security guarantees the service depends on.

5.1 Where your data is stored

See the Operator Agreements page for the full operator list, the Data Processing Agreements in place, and each operator’s security certifications.

5.2 How we protect data during transfers (Section 72 of POPIA)

POPIA permits the transfer of personal information outside of South Africa where one or more of the conditions in Section 72 are met. We rely on all of the following, collectively, for every transfer:

• Adequate protection (s72(1)(a)): Our database and rate limit infrastructure are hosted in the European Union, which is subject to the General Data Protection Regulation (GDPR). GDPR provides a level of protection substantially similar to, and in many respects stronger than, POPIA, including binding rules on onward transfer, breach notification and data subject rights.
• Binding contractual agreements (s72(1)(a)): Data Processing Agreements with every operator contractually bind them to protection standards equivalent to POPIA. This includes clauses addressing confidentiality, security, sub-processor management, breach notification, and return or deletion on termination.
• Contract performance (s72(1)(c)): The transfer is necessary to perform the service you are requesting.

5.3 Your right to object

If you object to cross border transfer of your personal information, email [email protected]. We will explore South African hosting alternatives with you where commercially reasonable. In some cases we may not be able to deliver the service if cross border transfer is refused, and we will tell you before you commit to anything.

6. How long we keep your information

When data is deleted, it is destroyed so that it cannot be reconstructed, in accordance with Section 14(4) of POPIA.

7. Your rights under POPIA

As a data subject, you have the right to:

• Access: Request a copy of all personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Object: Object to the processing of your personal information on reasonable grounds
• Withdraw consent: Withdraw any consent you have given, at any time
• Complain: Lodge a complaint with the Information Regulator

To exercise any of these rights, email [email protected] with the subject line "POPIA request". We respond within 30 days, free of charge.

South African Information Regulator
Email: [email protected]
Complaints: [email protected]
Website: https://inforegulator.org.za

8. Security

• All traffic is served over HTTPS, with TLS encryption in transit
• Strict security headers: Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS
• The platform database (Neon) uses TLS connections with channel binding, encryption at rest, and automated point-in-time backups
• Where an IP address is used for abuse prevention it is passed through a keyed hash (HMAC-SHA256) before storage; the raw address is never stored
• Public forms are protected by rate limiting, payload length limits and server side validation
• Access to production systems is granted on a need-to-know basis and revoked within one working day of a person leaving the engagement
• Third party operators used for hosting, database and productivity are SOC 2 Type II or equivalent certified

9. Cookies

We use as few cookies as we can, and none for advertising. The full list, with what each one does and how long it lasts, is in our Cookie Policy. In short:

• Strictly necessary: one cookie that remembers your cookie choice, so we do not ask on every page. These do not need consent.
• Analytics, only with your consent: one first-party cookie with a random number, set only after you choose “Allow analytics”.

You can change your mind at any time with “Cookie settings” at the bottom of every page. We treat a Global Privacy Control signal from your browser as a “no” and apply it without asking.

The authenticated Embrisk application, once you are a customer, uses a strictly necessary session cookie to keep you signed in. It is HttpOnly and Secure, carries no tracking identifier, and is set only after you sign in.

10. Direct marketing

We only send marketing emails to people who ticked the optional box on one of our forms, as section 69 of POPIA requires. The box is never ticked for you, and leaving it empty does not change how we handle your request. We record when you opted in. Every marketing email includes a one-click unsubscribe, and you can also email [email protected] at any time. We do not buy, rent or share mailing lists. Transactional messages, such as replies to your enquiry, invoices and service notices, are not marketing and are sent as part of the service.

11. Data you connect on behalf of your own clients

Embrisk is sold to agencies, so some of the data in a workspace concerns the agency’s clients rather than the agency itself. For that data:

• You are the responsible party and we are the operator. We process it only on your documented instructions and only to provide the service.
• You are responsible for having a lawful basis to connect a client property and to share that client’s data with us.
• We do not use client data to train models, to build a cross-customer dataset, or for any purpose other than producing your measurements and reports.
• On termination we delete or return the data in accordance with Section 6 and your written instruction.

12. Children

Embrisk is intended for businesses and adults. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will delete it.

13. Data breach notification

If we become aware of a security breach that compromises your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with Section 22 of POPIA. Notifications will include the nature of the breach, its potential consequences, and the protective measures we recommend.

14. If you live outside South Africa

14.1 European Union, EEA and United Kingdom

Where the GDPR or UK GDPR applies, Tapnet Solutions (Pty) Ltd is the controller. The legal bases we rely on are listed in Section 3. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing. We never make decisions about you by automated means alone. You may complain to the data protection authority where you live or work. Analytics cookies are used only with your prior consent, as the ePrivacy Directive and PECR require.

14.2 United States (including California)

In the last 12 months we collected identifiers and professional information (name, work email, agency) from our forms, and, with consent, internet activity on this website. We use them only for the purposes in Section 3. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information. We honour Global Privacy Control as an opt-out. You may ask to know, delete or correct your information, and you will not be treated differently for doing so. Send requests to [email protected]; an authorised agent may make them on your behalf.

14.3 How we answer requests

We answer within 30 days (POPIA and GDPR) or 45 days (US state laws), free of charge. We may ask you to confirm the email address the request is about, so we never give one person’s data to another.

15. Changes to this policy

We may update this privacy policy from time to time. If we make material changes we will announce them on this page and, where appropriate, by email to active customers. Continued use of the site or the service after an update constitutes acceptance of the updated policy.

16. Contact us

• Responsible party: Tapnet Solutions (Pty) Ltd
• Information Officer: Wynand de Beer
• Phone: +27 79 174 8357
• Email: [email protected]
• Registered office: 594 Bombani Street, Elarduspark, Gauteng, 0181, South Africa