Afrikaans

OntoHybrid — MAPSPIES privacy notice

This notice tells you what personal information OntoHybrid — MAPSPIES collects about you, why we collect it, who else sees it, how long we keep it, and what you can do about it. It is our formal notification under sections 17 and 18 of the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. Who we are and how to contact us

Responsible party: OntoHybrid (sole proprietor).
Postal address: a service address is being established and will be published here as soon as it exists. In the meantime every request under this notice is handled at the email address below, and you may also complain directly to the Regulator (section 8) without going through us first.
Information Officer: contact the Information Officer at privacy@streetmirrorapp.com.

For POPIA §23-25 requests (access, correction, deletion), or for anything else raised in this notice, please email the Information Officer at the address above. We will respond within seven calendar days for right-of-access requests and 30 calendar days for the others.

2. What personal information we hold

We deliberately keep this list short (POPIA §10 minimality) and publish it here so you can see the whole picture without reading the codebase.

2.1 About you (the enrolled user)

• Your phone number (E.164 format, e.g. +27821234567).
• Your chosen display name (whatever you typed at enrolment).
• A device identifier (a random UUID generated by the app on first launch — not linked to any advertising ID, IMEI, or IMSI).
• Your preferred language (English or Afrikaans).

2.2 About your emergency contacts

• Phone number and display name of each contact you add.
• Whether they have opted in via SMS double-tap (pending / active / declined / expired), and when.

2.3 About each verification session

• What triggered the session (panic button, keyword, sensor rule).
• A short, encrypted audio recording (voice biometric — see §8 below for the extra safeguards).
• A hash-chained audit trail of every event and decision (this is how we can later show a subject or the Regulator exactly what the platform did and why).
• Outbound SMS metadata (which provider, which message ID, delivered / failed).
• GPS coordinates collected during a live incident and persisted as a location trail so an emergency contact can see where you are on a map.

2.4 What we do NOT collect

• Email addresses.
• Physical addresses.
• Device fingerprints, IMEI, IMSI, or any identifier beyond the phone number you enrolled with.
• Voice biometrics on the server — the on-device baseline never leaves your phone.
• Any third-party analytics data. There is no Google Analytics, Segment, Mixpanel, or advertising SDK anywhere in this platform.

3. Why we hold it (purposes)

1. To send emergency alerts by SMS to the contacts you have pre-designated when your phone signals a possible incident (panic tap, keyword phrase, sensor rule).
2. To keep a short audit trail so that you (or a regulator) can later ask “what did the platform do?” and get an authoritative answer.
3. To detect and prevent misuse (rate limits, replay defence, test-mode isolation) so that real emergencies are not lost in noise.

4. Our legal basis under POPIA

• Your enrolment: §11(1)(b) — necessary to perform the contract you requested by installing the app and tapping Enrol.
• Adding an emergency contact: §11(1)(a) — consent of the third party, captured via an SMS double-tap. The contact stays “pending” and receives no alerts until they tap Confirm.
• Dispatching an alert during a real emergency: §11(1)(d) — necessary to protect your legitimate interest in your own physical safety, on top of the standing consent above.
• Retention of the audit trail: §14 — the shortest period reasonable to enable subject and regulator review.

5. Who else sees your data

5.1 SMS provider

To actually deliver an SMS we hand the recipient phone number and the message body to an SMS gateway. As of 2026-08-23 our provider is Twilio Inc. (United States). The provider necessarily sees:

• The recipient's phone number.
• The SMS body (which will typically name the sending user by display name so the recipient knows who the alert is from).

The provider holds this metadata under their own privacy policy and delivery-record retention rules. We do not authorise them to use your data for any other purpose.

5.2 Control-room partners

At MVP we have zero external control-room partners provisioned. If we ever add one (for example, an armed- response CMS), we will amend this notice AND notify existing users before their data is shared with a new recipient.

5.3 Internal servers

Speech-to-text (Whisper) and the AI decision model both run on the same server as the platform itself. Your audio is never sent to an external transcription API, cloud LLM, or storage bucket.

6. How long we keep it

• Session events + audit trail + encrypted audio: 1826 days by default (single retention knob because sessions cascade with the audio blob).
• Account erasure: an authenticated request tombstones the account. There is no scheduled worker that wipes records within an hour, and no packaged personal-data archive.

A legal hold under POPIA §14(5)(b) can extend retention for a specific subject if a live investigation requires it. The affected subject is notified before the hold is applied.

7. Your rights and how to exercise them

7.1 Right of access (§23)

You can ask for a copy of all personal information we hold about you. Email privacy@streetmirrorapp.com from the phone number on your account. There is no in-app data-export button today. Cryptographic key material is not included — that would weaken the platform's own security guarantees for you and other subjects.

7.2 Right to correction (§24)

Re-enrol the device to change your display name, language, or phone. Anything else, email the Information Officer.

7.3 Right to deletion (§24)

Email the Information Officer from the phone number on your account, or call POST /v1/users/{user_id}/erasure while signed in on this device. That authenticated call tombstones the account (the device id is rewritten). It is not a wipe within one hour, there is no public unauthenticated erasure form, and a user who has uninstalled cannot complete erasure over HTTP until a later wave rebuilds that path.

7.4 Right to object (§11(3))

Emergency contacts can reply STOP to any SMS at any time. We stop dispatching to that number immediately and record the objection permanently.

7.5 Right not to be subject to automated decisions (§71)

The AI classifier only decides whether to send an alert. It does not build a persistent profile of you and does not influence any decision that would produce legal consequences beyond the specific alert.

8. Complaints to the Regulator

You may lodge a complaint with the Information Regulator at any time. You are not required to raise the matter with us first (though we would like the chance to fix it):

• Website: https://inforegulator.org.za/
• Complaint email: complaints.IR@justice.gov.za
• Complaint form: POPIA/IR/EN

9. Security safeguards

• All network traffic uses HTTPS with HSTS pinning.
• Audio recordings are encrypted at rest with per-session AES-256 keys.
• The audit trail is hash-chained and Ed25519-signed — any after-the-fact tampering is detectable.
• All emergency signed URLs (audio playback, live location) expire within minutes and are rate-limited per token.
• We follow the incident-response runbook at docs/runbooks/breach-response.md for any suspected compromise, and we notify you within the POPIA §22 timeframe.

10. Changes to this notice

We may update this notice as the platform evolves. Material changes will be announced at the top of this page and, for subjects with a registered device, by an in-app notification. The “Effective” date at the top of this page shows when the current version took effect.