Privacy Policy

Corbel ("we", "us") is used by South African quantity surveyors and contractors to measure take-off and price bills of quantities. This policy explains what personal information we process, why, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

Corbel is operated by Providus Labs (Pty) Ltd, a company registered in South Africa (CIPC reg 2026/142873/07). Our Information Officer can be reached at gareth@providuslabs.co.za.

2. Information we collect

Account information — name, email, phone number, firm name and role (owner / admin / estimator / viewer). Provided by you at sign-up or by your firm when you are invited.

Project & drawing data — the construction drawings (PDF) you upload, together with the measurements, conditions, estimates and exports you create from them. Drawings you upload may themselves contain third-party personal information (for example names on a title block); you are responsible for having the right to upload them, and we process them only to run the service for you.

Billing information — handled by Paystack when you subscribe. Payments are processed by Paystack; we do not store your card data.

Device and usage data — IP address, browser/device identifier, pages viewed. Used to keep the service secure and diagnose faults.

3. Why we process it (lawful basis)

We rely on the following grounds under POPIA Section 11:

• Consent — where you give it, for example optional product communications.
• Contract performance — to deliver the service to your firm and to you.
• Legal obligation — to retain financial and tax records as required by South African law.
• Legitimate interest — security monitoring, fraud prevention, and product improvement.

4. Who we share with

Your firm's team — projects, drawings, measurements and estimates are visible to the admins, estimators and viewers of the organisation you belong to, according to their role.

Service providers — we use a small set of processors, each bound by data-processing agreements that meet POPIA standards:

• Amazon Web Services (AWS) — hosting, file storage and email, in af-south-1 (Cape Town), with email delivery and operational backups transiting eu-west-1 (Ireland).
• Vercel — hosting of the Corbel web application.
• Cloudflare — content delivery and network protection.
• Paystack — billing and card processing.

We do not sell personal information and do not use your data to train models. We do not share it with marketers.

5. How long we keep it

Account data is retained for the life of your account plus one year after deletion, after which it is permanently removed.

Financial and tax records are retained for seven years in line with SARS requirements.

Drawings and project data are retained until you delete them or close the account, subject to any legal-retention obligation above.

6. Where it is stored

Primary storage is in AWS region af-south-1 (Cape Town). Email delivery and a small set of operational backups may transit eu-west-1 (Ireland). All transfers are within AWS's POPIA-compliant infrastructure.

7. Your rights

Under POPIA you may at any time:

• Request a copy of the personal information we hold about you.
• Ask us to correct anything that is inaccurate.
• Request deletion of your account. Where we are legally required to retain certain records (tax, audit) we will tell you what stays.
• Lodge a complaint with the Information Regulator of South Africa (POPIA), website inforegulator.org.za.

To exercise these rights, email gareth@providuslabs.co.zaor use the "Export my data" button in your account settings.

8. Security

We use TLS for all traffic, encrypted-at-rest storage, row-level tenant isolation on the database (so one firm can never see another's projects), MFA-capable sign-in, and short-lived signed URLs for any file download. No system is perfectly secure; if a breach affects you we will notify you and the Information Regulator within a reasonable period.

9. Changes to this policy

We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect.