Privacy Policy

Version 1.1 · Effective 12 August 2026

This Privacy Policy explains how Rooikat Systems (“we”, “us”, “our”) collects, uses, stores and protects personal information when you use Mamba (the “Service”). We are the responsible party for this information under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

In short: we collect only what we need to run your account, process your payments, and provide the Service. We never see or store your card details — Payfast does. We don't sell personal information to anyone, ever.

1. What we collect

1.1 Product accounts. When you create an account we collect your name, email address and account credentials (your password is stored hashed), and generate records needed to operate your account.

1.2 Billing information. When you subscribe or pay for work we process billing records: your billing contact details, VAT number (if provided), and the amount, date, payment status and a payment reference. Your card details are captured and stored by Payfast, our payment processor — we receive only a secure payment token and transaction confirmations, never your card number.

1.3 Content you submit. To provide the Service we process the images you upload for conversion, the prompts and reference images you provide for AI generation, and the vector files, mockups and other outputs we generate for you.

1.4 Consent records. When you accept our Terms & Conditions in the Service we record your user ID, the date and time, and the version of the Terms you accepted, so the agreement can be verified later.

1.5 Technical data. Our servers keep standard technical logs (IP address, request time, user agent) and audit records for security, rate limiting and troubleshooting.

2. How we use it

To create and operate your account and deliver the services you've paid for.
To process the content you submit and return your generated results.
To process payments, manage subscriptions and handle failed-payment retries.
To send transactional messages: welcome and password-reset emails, payment confirmations, free-trial reminders, renewal reminders, cancellation confirmations, failed-payment notices and client-approval notifications. These are service messages, not marketing.
To keep records we are legally required to keep (e.g. tax and transaction records).
To protect the Service against fraud, abuse and unauthorised access.

We do not send marketing communications without your consent, and we do not sell or rent personal information to third parties.

3. Who we share it with

We share personal information only with service providers who need it to perform functions on our behalf, under appropriate safeguards:

Payfast — payment processing (they act as an independent responsible party for the card data they collect; see the Payfast privacy policy).
Email service providers — to deliver transactional emails.
Third-party AI providers — when you use AI generation features, the prompt and any reference image you submit are sent to third-party AI model providers to generate your result. We send only what is needed to fulfil your request.
Hosting infrastructure — the servers the Service runs on.

We will disclose information where the law requires it — for example to a regulator, court or law enforcement acting within their powers.

4. Cookies & tracking

The Service uses only the cookies or tokens strictly necessary to keep you signed in and keep your session secure. We do not use advertising or analytics trackers. Fonts on these pages are loaded from Google Fonts, which may log the request as described in Google's privacy policy.

5. How long we keep it

Uploaded images & generated files — stored to provide the Service and automatically deleted after a retention period (currently 30 days on the Free plan and 90 days on Pro).
Account data — for the life of your account and a reasonable period after closure.
Billing, transaction and consent records — for the periods required by South African tax and commercial law (typically five years or longer where required).
Technical logs — for a short rolling period, then deleted or anonymised.

6. How we protect it

We apply appropriate technical and organisational measures: encrypted connections (HTTPS/TLS), hashed passwords, secrets kept out of source code, access limited to those who need it, audit logging, and payment card handling delegated entirely to a PCI DSS compliant processor. No system is perfectly secure, but if a breach occurs that affects your personal information we will notify you and the Information Regulator as POPIA requires.

7. Your rights

Under POPIA you may, at any time:

Ask what personal information we hold about you and request a copy.
Ask us to correct or update inaccurate information.
Ask us to delete information we are not legally required to keep. The Service also provides account deletion, which anonymises your account.
Object to processing, or withdraw consent where processing is based on consent.
Lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, email info@rooikatsystems.com from the address linked to your account. We respond within 24 hours and resolve requests as quickly as the law allows.

8. Children

The Service is intended for adults and businesses. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Each revision carries a new version number and effective date at the top of this page. Material changes will be communicated to active customers before they take effect.

10. Contact

Privacy questions and information requests: info@rooikatsystems.com.