Who we are

Deciphr is operated by SP Global (Pty) Ltd. For privacy matters, SP Global acts as the responsible party (POPIA) and data controller (GDPR) for account and marketing data, and as an operator/processor for the workspace data your organization loads into the platform.

You can reach our privacy team through the contact form at the end of this page.

Information we collect

We collect only what we need to provide and secure the service:

You provide

• Account data: name, work email, organization, and role.
• Verification data: identity and entity information you submit through compliance workflows (KYC / KYB).
• Workspace content: wallet addresses, transactions, documents, and counterparties your organization ingests.
• Connected integrations (optional): if you connect Google Calendar, details of your calendar events. See Google user data below.

Collected automatically

• Usage and device data: pages viewed, actions taken, browser and IP.
• Security logs: append-only, hash-chained audit records of sensitive actions.

How we use information

We use personal information to operate accounts, deliver treasury, accounting, operations and compliance features, run identity verification, maintain security and audit trails, meet legal obligations, and improve the service. We do not sell personal information. Data we receive from Google is used only as described in Google user data.

Legal bases

Where GDPR applies, we rely on: performance of a contract (to deliver the service), legitimate interests (to secure and improve it), legal obligation (for compliance and record-keeping), and consent (for optional communications, which you may withdraw at any time).

Sharing and sub-processors

We share information only with vetted sub-processors who help us run the platform, such as cloud hosting, identity-verification providers, and screening partners. Each is bound by contractual confidentiality and data-protection terms. We may disclose information where required by law or to protect the rights and safety of users. On our public website (not inside the Deciphr app) we use Google Analytics to understand how visitors use our pages, only if you accept analytics cookies; see our Cookie Policy and How Google uses data when you use our partners’ sites or apps.

International transfers

Where personal information is transferred across borders, we apply appropriate safeguards such as standard contractual clauses and equivalent measures, consistent with GDPR and POPIA requirements.

Retention

We keep personal information only as long as needed for the purposes described, or as required by financial and compliance regulations. Audit and compliance evidence may be retained for the statutory periods applicable to financial records. Google Calendar data is deleted when you disconnect the calendar (see Google user data).

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. To exercise these rights, use the contact form below. You may also lodge a complaint with your data-protection authority or the South African Information Regulator.

Security

We protect personal information with encryption in transit and at rest, per-workspace isolation, role-based access, and continuous monitoring. See our Security page for details.

Google user data (Google Calendar)

You never sign in to Deciphr with Google. Google data reaches Deciphr only if you choose to connect Google Calendar from Settings → Integrations after you have signed in. This section explains exactly what happens to that data.

What we access

• We ask Google for one permission: read-only access to your calendar events. We cannot create, change, or delete anything in your calendar, and we do not access Gmail, Google Drive, your contacts, or any other Google service.
• For events in a rolling window (by default the past 7 days and the next 30 days) we read the title, start and end time, description, location, video-meeting link, status, and the names and email addresses of the people invited. By default we keep only events that look like meetings: events with two or more invitees or a video-meeting link.

How we use it

• To show your recent and upcoming meetings in Deciphr, and to let the meeting recorder match a recording to the right event so that notes and minutes are filed against it.
• When you use the meeting recorder, the event's title, times, description, and invitee names may be included in the request that drafts your minutes. That request is processed by our AI model provider only to produce your draft.
• Invitees appear only as text on the event. They are never added to your workspace, its team list, or its member directory.

Who can see it and who we share it with

• Synced meetings are visible to members of the Deciphr workspace in which you connected the calendar. Each workspace's connection is kept separate.
• We share Google user data only with the sub-processors needed to provide these features (our cloud hosting provider and, for drafting minutes, our AI model provider), under confidentiality and data-protection terms, or where the law requires it. We do not sell Google user data or transfer it to anyone else.

How we protect it

• Your Google access tokens are encrypted at rest with a key bound to your workspace, and all data is encrypted in transit and at rest. Each workspace's data is isolated at the database level, and changes to the calendar connection are recorded in an audit log.

How long we keep it and how to delete it

• Synced events and the encrypted access token are kept only while the connection is active. Events canceled in Google are marked as canceled on the next sync.
• When you click Disconnect, we revoke Deciphr's access with Google and immediately delete the stored token and every synced event for that workspace. You can also remove Deciphr's access at any time from your Google Account at myaccount.google.com/permissions, or ask us to delete your data through the contact form below.

What we never do with it

• We use Google user data only to provide and improve the user-facing features described above. We do not use it, or transfer it to others, for advertising (including personalized, retargeted, or interest-based advertising), to sell to data brokers or information resellers, to determine credit-worthiness or for lending purposes, or to create databases.
• Deciphr does not use Google Workspace APIs or any Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models, and our AI model provider may not use it to train its models.
• People at Deciphr do not read your Google user data unless you ask us to (for example, for support), it is necessary for security purposes such as investigating abuse, or it is required by law.

Deciphr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes & contact

We may update this Policy from time to time; material changes, including any change to how we use Google user data, will be notified in-product or by email. Questions? Use the contact form below or write to SP Global (Pty) Ltd.