Privacy & POPIA notice

Who we are

DNS LABS STUDIOS (PTY) LTD (registration 2026/887605/07), 17 Ninth Avenue, Northmead, Benoni, 1501 (“DnS Labs”), operates Business in a Box Micro. We are the responsible party for the personal information processed on this platform. Contact: salomeb@dnslabs.dev.

What we collect and why

Business and contact details, user names and email addresses, documents you upload, quotes, invoices, payment records and service history. We use it only to deliver the financial administration, invoicing and debtors services you asked for, to bill for them, to keep you secure, and to meet legal record-keeping duties.

How we protect it

• All traffic is encrypted (TLS, HSTS). Passwords are hashed with Argon2id; operator accounts require two-step sign-in.
• Sensitive fields (ID numbers, bank details, private notes) and every uploaded document are encrypted with AES-256-GCM before storage.
• Each business can only ever see its own records. This is enforced on every request and tested.
• Every view, change, approval, download and payment is written to a tamper-evident audit log.
• Nightly encrypted backups and 7-day point-in-time recovery protect against data loss. Records are archived, never silently deleted.

Who we share it with

Only operators who need it to process your information for us: Vercel (hosting), Neon (database, EU), Afrihost (email), and Ozow (payments, when you choose to pay online). We do not sell personal information. Some providers store data outside South Africa under contractual safeguards that give adequate protection, as POPIA section 72 requires.

How long we keep it

For as long as you are a customer and afterwards for the periods tax and company law require (generally 5 to 7 years for financial records). After that it is securely destroyed or de-identified.

Your rights

You may ask for access to, correction of, or deletion of your personal information, object to processing, and complain to the Information Regulator (inforeg.org.za). Email salomeb@dnslabs.dev and we’ll respond within 30 days.

Cookies

We use one strictly necessary, secure session cookie to keep you signed in. No tracking or advertising cookies.