TrailA.ioLegal
Privacy Policy
TrailA.io is owned and operated by Tech & Artery (Pty) Ltd (“we”, “us”, “our”), the responsible party under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). TrailA.io connects Landowners, Creators and Buyers around wildlife photography and video, with a provable record behind every licence. This policy covers Buyers, Creators, Landowners and anyone browsing the catalogue before signing up.
1. What we collect
We collect only what your role needs, not a fixed set of fields for everyone.
Everyone. Name, email address, password, and multi-factor authentication if you enable it, held by our identity provider, not by us directly. Company accounts (every Landowner and Buyer) also carry an organisation membership, so teammates on the same company resolve to one shared record. We store your user id, your chosen role, and the record that role belongs to.
Creators. Handle, display name, attribution, region, verification status, self-reported VAT-vendor status, and whether a payout account is connected (a reference id, never a bank account number).
Landowners. Company name, region, subscription tier, the land-access agreements you administer (which creators, which land, revenue share, status), land location at park level rather than a precise pin, billing references (a mandate id and payout connection status, never bank details), and the date and version of the agreement you accepted.
Buyers. Company name, contact name, country code, the licences your company holds, and which teammate completed each checkout.
Audit and provenance records. Every meaningful event on an asset (ingestion, rights clearance, a licence request, a payment, a licence issued, a file download attempt, a payout) is logged with who did it, when, and what happened. This log is append-only: it's never edited or deleted, because it's the record a licence's provenance is proved against.
Payment data. We never collect or store card or bank details ourselves. Checkout and payout setup redirect to our payment processor's own pages; we only receive references back (a mandate id, a payment id, a status, an amount, VAT treatment).
Communications and technical data. In-app notifications and replies, mirrored to email where configured, plus standard request logs and the session cookie that keeps you signed in. We don't use advertising or cross-site tracking cookies.
2. How we use it
To run the marketplace: linking a Creator's upload to its land and agreement, enforcing what a licence may cover, computing and freezing each licence's revenue split, gating original files to licence holders, processing payments and payouts, billing subscriptions, and sending the notifications above. To meet legal and tax obligations, including VAT (currently 15%, South Africa). To secure the platform: authenticating you, reviewing rights before an asset goes live, and logging every file-download attempt. We don't sell personal information, and we don't currently send marketing communications.
3. Who we share it with
Service providers who run parts of the platform for us (identity and authentication, payments and payouts, hosting and storage, email delivery), each limited to what its role requires. Within the marketplace, visibility is role-scoped: a Creator's handle and location appear on their own asset cards; a Buyer sees only their own licence receipt, never anyone else's; a Landowner sees their own land's agreements and revenue, not a Buyer's contact details beyond what a dispute requires; TrailA.io staff, each individually provisioned, can see the full audit trail to review rights and resolve disputes. Where a Landowner's own signed agreement authorises them to review submissions or negotiate a Buyer's licence directly for their own land, their staff see the Creator submission and Buyer negotiation details that requires, on the same individually-provisioned basis as our own staff, and still only for their own land. We may also disclose information where required by law, to a regulator, to professional advisers, or as part of a merger, financing, or sale of the company.
4. International transfers
Buyers, Creators and Landowners aren't all in South Africa, and our service providers may run infrastructure elsewhere. Where information is transferred internationally, we rely on the safeguards POPIA requires, and, for anyone in the EEA or UK, equivalent GDPR safeguards.
5. Retention
Audit and provenance records are kept indefinitely, including after an account closes, since they're what a licence's chain of custody is proved against. Account data is kept while your account is active and for a reasonable period after. Financial records are kept as long as tax law requires.
6. Your rights
Under POPIA, you can ask what personal information we hold, ask us to correct or delete it, object to our processing, and complain to South Africa's Information Regulator at any time. If you're in the EEA or UK, GDPR gives you the equivalent rights. Two limits apply to deletion: we can't remove an audit-log entry a licence relies on, or a financial record before its retention period ends. In those cases we restrict or anonymise instead. Contact us below to exercise any of these.
7. Consent and marketing
Most of our processing rests on performing your contract with us, a legal obligation, or a legitimate interest, not consent. We do ask you to confirm you've read and agree to this policy once, when you first set up your account, and keep a record of when and which version you accepted. Beyond that, we ask for consent only where the law requires it: before sending any marketing communication (we send none today), and before using any non-essential cookie (we use none today). If either changes, we'll ask first, separately from this policy.
8. Security
Sign-in and multi-factor authentication are handled by our identity provider. An asset's original file is reachable only through one gated route, which requires a held licence, ownership, or a staff account, and logs every attempt. We never handle your card or bank details ourselves.
9. Children
TrailA.io isn't directed at children. Onboarding assumes you're an adult acting for yourself or a company you're authorised to represent.
10. Changes
We may update this policy. We'll update the effective date above, and tell you directly if a change is material.
11. Contact us
Questions, requests or complaints: [email protected]. You can also complain directly to South Africa's Information Regulator.