HelderStack (Pty) Ltd · 2026-09-18

Dashboard privacy policy

This policy covers HelderCut registration, workspace use, team invitations, API access, saved cutting results, exports and credit checkout.

Responsible party and workspace responsibilities

HelderStack (Pty) Ltd, registration 2025/373269/07, 20 Briza Street, Somerset West, Western Cape, South Africa, is responsible for account administration, service operation and billing information. An organisation using HelderCut controls the personal information it places in its project names, labels, notes or team records. Where we process that information solely on its instructions, we act as its operator. An organisation must have authority to invite users and provide information, and must use appropriate operator arrangements where required.

Information and purposes

• Your name, email, workshop name, password hash, account status, role, sign-in timestamps and accepted policy version support account creation, authentication, access control and service administration.
• Inviting administrators provide a colleague's name, email and role so we can create access and send a password setup link.
• Stock names, dimensions, grain direction, panel labels and quantities, notes and saved layouts are processed to save, optimize and export your work. These should contain production details rather than unnecessary personal information.
• API credential digests, prefixes and revocation status support authenticated integrations. The full secret is displayed only when created.
• Purchase amounts, credits, order references, verification status and timestamps support payment verification and accounting. Hosted checkout processes payment details; HelderCut does not collect or store card numbers.
• Privacy requests, correspondence, necessary security records and stock-change history support rights, support, security and accountability.

Account fields marked required are needed to supply the service; without them we cannot open an account. Notes and credit purchases are optional. Core optimizations are free during launch. The service currently offers sandbox payments only, and test credits have no monetary value.

Lawful grounds and communication

Processing may be necessary to perform our agreement or act at your request, pursue legitimate interests in operating and securing the service, or meet legal duties. Consent is used only where required for the relevant activity. Accepting terms is not blanket consent to unrelated processing.

We send service emails such as invitations, welcome messages and password resets. The service administrator receives a copy of the registration welcome email for onboarding administration. Reset messages go to the account holder and do not copy the administrator in ordinary operation. We do not currently send direct-marketing campaigns from these account details.

Who can access information

Your workshop's authorised users can access its shared stock and cutting lists according to their roles. Owners and administrators can manage team access and credits. Authorised service administrators and contracted hosting, database, backup, email and payment providers may process the information necessary to perform their functions. Advisers and authorities may receive information when legally permitted or required. We do not sell your information.

Exports are generated for authenticated users and downloaded directly. They are not made into public sharing links. Keep downloaded files and API keys secure. Your integrations may send information to systems you control; you are responsible for authorising those destinations.

Cross-border processing and safeguards

Hosting, backup, email or payment service providers may process information outside South Africa. Where this occurs, we must use a permitted ground and appropriate safeguards under POPIA section 72. Operator arrangements must address confidentiality and security where POPIA section 21 applies. Contact the Information Officer for information relevant to your organisation's processing arrangement.

We apply role permissions, workspace separation, password protection, protected credentials, secure transport in hosted operation and access controls. We investigate suspected compromises and make legally required notifications. Keep your credentials confidential and tell us promptly about suspected unauthorised access.

Retention, deletion and saved results

Workspace records remain available while needed to provide the service. You can delete cutting lists and their saved results, remove stock and revoke keys. A saved cutting result contains an independent snapshot: editing or removing a stock definition does not erase that earlier snapshot. Remove the associated cutting list if you no longer need its saved plans.

Account erasure and shared workshop deletion require identity and authority checks. Financial, security, dispute or other records may be retained where law requires or permits it. Backup copies expire under the applicable backup schedule rather than disappearing instantly. Retention must be reviewed, with records deleted or de-identified once no lawful purpose remains. Contact us for assistance with records, histories or backups not controlled by a self-service action.

Your rights and automated calculations

You may request access, correction, lawful deletion or restriction, object where POPIA permits, withdraw consent where it is the basis, and complain to the Information Regulator. Use the dashboard's Account page to download your profile data or record a request. We may verify identity and authority before responding. Download cutting plans from their saved result page.

Optimization is a calculation based on dimensions and constraints, not a decision about your legal rights or eligibility. Always verify layouts before production. This service is intended for people aged 18 or older. Do not store children's information, special personal information or unrelated customer records in cutting notes.

Contact and complaints

Information Officer: Frederick Adriaan Henning
HelderStack (Pty) Ltd
20 Briza Street, Somerset West, Western Cape, South Africa
[email protected]

You may contact the Information Regulator (South Africa) or use its eServices portal for applicable complaints and requests. Postal or office information and prescribed forms should be checked on the Regulator's current website.

Public website use: Website privacy · Accounts and API: Dashboard privacy · Terms