Privacy Policy
1. Who we are
Coalition Software Pty Ltd (“we”) is the controller of the personal information described in this policy. We process it under South Africa's Protection of Personal Information Act (POPIA) and, where our users are in the EU/UK, under the GDPR. Reach us at support@skubase.co for anything privacy-related.
2. What we collect
- Account data: your name, work email address and password hash. Multi-factor authentication settings if you enrol them.
- Transactional emails: password reset and account-notification emails sent by our authentication provider.
- API key metadata: the names and masked (truncated) values of the API keys you create. We never store full raw keys.
- Billing data: processed entirely by Paddle, our Merchant of Record. We receive your business name, email and subscription status; we never see your card details.
- Usage analytics: only if you accept the analytics prompt, Google Analytics collects pageviews and portal usage events (for example logins and API-key creation). Analytics also sets its own cookies once you accept. Your user id is attached so we can understand aggregate usage; it is not used for advertising.
- Local browser storage: your analytics choice (
ga-consent) and portal interface preferences (column layout). These are functional and stay on your device.
3. What we do not collect
SkuBase stores your catalogue, price lists and stock, and the names of your reseller companies. We do not collect or process personal information about your end customers or their individual contacts: reseller records hold a company name and API keys, not individuals' contact details. You are the controller of your own business data.
4. Why we process it
- To provide the Service (accounts, authentication, security, API access) — necessary for our contract with you.
- Analytics — only with your consent, which you can withdraw any time by declining in the banner or clearing the
ga-consentbrowser setting. - Service improvement and abuse prevention — our legitimate interests.
5. Who processes data with us
| Provider | Role | Where data is hosted |
|---|---|---|
| Supabase | Authentication and application database | eu-west-1 (Ireland) |
| Fly.io | Skubase API backend | Johannesburg, South Africa |
| Cloudflare | Website and portal hosting, CDN | Global edge network |
| Paddle | Merchant of Record — payments, invoicing, tax | Paddle's global infrastructure |
| Google Analytics | Website analytics | Google's global infrastructure |
We share personal information only with these providers, with professional advisers where necessary, or where the law requires it. We do not sell personal information.
6. International transfers
Our providers are located in Ireland, South Africa, the United States and other countries. Where personal information crosses borders we rely on appropriate safeguards, including POPIA section 72 conditions and, for transfers out of the EU/EEA and UK, the European Commission's standard contractual clauses.
7. Retention
- Account and tenant data is kept while your account is active. When your subscription ends, your tenant data is deleted after a 30-day grace period, except where we must retain records for tax or legal compliance.
- Analytics data is retained according to your Google Analytics property settings.
- Revoked API key metadata is retained for audit purposes.
8. Security
We protect personal information with encryption in transit (TLS) and at rest, password hashing, optional multi-factor authentication, least-privilege access controls, and scoped, revocable API keys. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and the Information Regulator as POPIA requires.
9. Your rights
You may ask to access, correct, delete, restrict or object to the processing of your personal information, request a portable copy, or complain to the Information Regulator of South Africa. EU/UK users have equivalent rights under the GDPR. To exercise any right, email support@skubase.co; we respond within 30 days. You may withdraw analytics consent at any time without affecting the lawfulness of earlier processing.
10. Children
The Service is a business tool not directed at anyone under 18, and we do not knowingly collect children's personal information.
11. Changes
We may update this policy. Material changes are announced at least 30 days in advance by email to account holders and by updating this page's date.