TMNuts and Tailormade Nuts Privacy Policy

Version 1.1. Effective . Last updated .

In short

  • The company you work for, or the processor you deliver to, decides what information it keeps about you on the platform. We run the platform for that company and follow its instructions.
  • We use personal information only to provide, secure, support and improve the platform, and to comply with the law. We do not sell it and we do not use it for advertising.
  • The TMNuts app has no advertising, no analytics and no tracking.
  • To see, correct or delete your information, ask your company, or email us at wian@tailormadetech.co.za. We reply within 30 days, and we pass requests about your company's records to your company.

1. About this policy

This policy explains how personal information is handled on Tailormade Nuts, a web platform for macadamia processors, and TMNuts, its mobile app for iOS and Android. In this policy we call them together "the platform". Tailormade Tech (Pty) Ltd, registration number 2022/867626/07 ("Tailormade Tech", "we", "us", "our"), builds and runs the platform.

Each processing company that uses the platform (a "customer") reaches it at its own web address, for example rsh.tailormnuts.com. This policy applies on every one of those addresses and in the TMNuts app.

It applies to:

  • staff of our customers who have accounts on the platform;
  • growers who use a customer's grower portal; and
  • people whose details a customer records on the platform, such as growers, buyers, shippers and their contact people.

In this policy, "your company" means the customer you work for or, if you are a grower, the processor whose grower portal you use.

We handle personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA"). Under POPIA, personal information includes information about identifiable companies and other juristic persons, so this policy also covers grower, buyer and shipper businesses.

2. Who is responsible for your information

This is the most important part of this policy.

Your company is the responsible party. Each customer is the responsible party, as POPIA uses that term, for the operational, grower and financial information it puts on the platform. The customer decides what it records, why, who in its business can see it and how long it keeps it. If you are a grower, the processor you deliver to is the responsible party for your information on its grower portal.

We are its operator. For that information, Tailormade Tech is the customer's operator. We process it only on the customer's instructions and under a written agreement with that customer. As POPIA sections 20 and 21 require, we keep it confidential and secure, and we use it only to provide the platform and to keep the usage and security records described in section 5.

Where we are the responsible party. Tailormade Tech is the responsible party only for the information we need to run the platform itself: account administration, security, support and service improvement. Section 5 explains this.

What this means for you. Questions and requests about information a company holds about you, such as your delivery records or the bank details on a grower portal, go to that company first. We help the company answer. Questions about the platform itself, about your sign-in account or about this policy can come straight to us.

3. Information on the platform

Accounts

  • Your name, email address and password. Your password is stored only as a one-way hash, which means we cannot read it.
  • The companies you belong to, your role, and the facilities you may use.
  • Sign-in information, such as when you sign in and the session that keeps you signed in.
  • Your screen preferences, such as table layouts.
  • A record of the actions you take on the platform, linked to your account and email address (the audit log). For example, it shows who changed a delivery record and what changed. People your company authorises can see when you last signed in and how many changes you made.
  • A record of the data exports you make.
  • If your company asks you to accept a document in the platform, such as its terms of use or a description of how the system works: the document and version you accepted, the time, and your browser's user agent (a short text that identifies your browser and type of device).
  • If you ask to join a company on the platform, or ask a processor to connect you to its grower portal: your name, email address, what you told the company to identify yourself, and the outcome of your request.

Growers and their businesses

  • Names and grower codes, and the names, positions, email addresses and phone numbers of contact people.
  • Physical and postal addresses, company registration numbers and VAT numbers, and whether a grower is VAT or GAP registered.
  • Bank account details used to pay growers: account name, account number, account type, branch code and bank, the preferred payment method, and proof of bank account documents a grower uploads.
  • Farm names and farm locations (GPS coordinates).

Buyers, shippers and other contacts

  • Company and contact names, positions, email addresses, phone numbers, addresses, VAT and company registration numbers, and customs codes.

Operational and financial records

Deliveries, weights, bins and moisture readings, quality control results, sizing, stock, bulk bags, dispatch, prices, contracts, invoices, remittances and payments, and documents such as weighbridge, warehouse, export and price list files. These are business records, but many of them are linked to a named grower or user.

Photos

Photos you choose to take or attach of deliveries, samples and bags. The platform uses your camera or photo library only when you choose to add a photo.

Nutty, the AI assistant

If your company turns Nutty on, your questions, Nutty's answers, any ratings you give and the information Nutty looked up to answer you are stored with your account. Section 6 explains this.

Email

Email addresses that receive password reset emails, grower invitations, weekly reports, remittance notifications and similar messages from the platform.

Technical information

When you use the platform, our hosting providers receive technical information such as your IP address and your browser and device type, as happens with any website or app. They keep it in server logs for security and operation, and our sign-in provider records the IP address and browser of each sign-in session. Apart from that, the platform's records do not store IP addresses. To protect sign-in and password reset from abuse, we keep counters linked to a one-way hash of your email address or IP address, which cannot be turned back into the original.

We also record the days on which each user was active, so that we can count active users for each customer and support our customers.

4. Where the information comes from

  • From you, when you use the platform.
  • From your company, when its staff create your account or record information about you. A grower's details are mostly recorded by the processor, and growers can submit changes through the grower portal.
  • From your device, when you choose to take or attach a photo.
  • Automatically, as you use the platform: the audit log, sign-in records and technical information.

You do not have to give us information. But without your name, email address and a password we cannot create your account, and without the details your company needs, it may not be able to record your deliveries or pay you. Some information is required by law, such as VAT numbers on tax invoices.

5. Why the information is used

For your company, as its operator

To provide the platform to your company: to record and track deliveries, quality, stock and dispatch; to calculate prices, remittances and payments; to produce invoices, reports and statements; to send the emails your company sets up; and to run the grower portal. Your company is responsible for having a lawful reason under POPIA for this processing and for telling people about it where POPIA requires.

For our own purposes, as responsible party

  • To create and manage accounts and control who can see what.
  • To keep the platform secure, to detect and investigate misuse, and to keep audit records.
  • To provide support and to answer requests.
  • To find and fix faults, to improve the platform, and to understand how much each customer uses it, using error reports and records of how the platform is used, such as the days each user was active and the data exports made.
  • To comply with the law.

We rely on the legitimate interests of Tailormade Tech and of our customers in running a secure, working platform (POPIA section 11(1)(f)), and on our legal obligations where they apply (section 11(1)(c)).

We do not sell personal information, we do not use it for advertising, and we do not use it to profile people or to make decisions about them by automated means alone.

6. Nutty, the AI assistant

Nutty is an AI assistant that answers questions about your company's information on the platform.

  • It is off unless your company turns it on. Your company chooses which staff roles may use it and whether its growers may use it.
  • What is sent to the AI provider. When you ask Nutty a question, the platform sends Anthropic: your question; the recent conversation; your name and role; your company's name; today's date; the names of your facilities or, for a grower, your grower codes; the page you are on, including any search on it; and the information Nutty looks up to answer you. A short version of your question and the page you are on are also sent to a smaller Anthropic model that decides how to answer.
  • What Nutty can look up. Nutty can only look up what your own account is allowed to see. This can include grower, contact and staff names, deliveries, vehicle registrations and payment amounts. Nutty's grower search leaves out bank details, VAT and registration numbers, email addresses, phone numbers and map coordinates, but it can show where a farm is.
  • Who processes it. Anthropic, PBC, in the United States, provides the AI models through its API. Under Anthropic's commercial terms, Anthropic does not use this content to train its models.
  • What is kept. Your questions, Nutty's answers, your ratings and the full exchange with the AI model are stored with your account in the platform's database, so that you can see your history and we can investigate problems and improve Nutty's answers. Your company's administrators see usage totals and the reports Nutty made for staff, including who asked for each one, but not your conversations.
  • How long. Conversations are kept while your sign-in account exists, including after your company removes your access. You cannot delete a conversation yourself, but you can ask us to.
  • Check its answers. Nutty's answers are generated automatically and can be wrong. Our Terms of Service explain how to use them.

7. The TMNuts app

  • Sign-in. The app uses the same account as the web platform. It connects to our database provider and to your company's web address.
  • Camera and photos. The app asks for access to your camera or photo library only when you choose to add a photo. Photos are uploaded to your company's private storage on the platform as soon as you add them, even if you do not save the record.
  • Nutty. If your company turns Nutty on, its staff can use it in the app. Your questions go through your company's web address to the AI provider, as section 6 explains.
  • What it does not do. The app does not access your location, contacts or microphone, and it does not send push notifications. It contains no advertising, no analytics or tracking software and no crash reporting software, and it does not track you across other apps or websites.
  • What it keeps on your device. Your sign-in session, which includes your email address; the company and facility you chose; your light or dark mode setting; information it loads in advance for the screens you use, so you can keep working without signal; captures you make without signal, until they can be sent; and temporary copies of photos and documents you take or open.
  • When you sign out. The app clears your session, your company and facility choice and the information it loaded in advance. Captures that have not been sent yet stay on the device so that a shift's work is not lost. Only the same person, signed in to the same company, can see, send or discard them. Temporary copies of photos and documents can stay in the app's storage until your phone clears them or you remove the app.
  • Removing the app deletes this information from your device. If your phone backs up app data, for example to Google Drive or iCloud, a backup can still hold a copy.

8. Cookies and browser storage on the web platform

The web platform uses only the cookies and browser storage it needs to work:

  • sign-in cookies that keep you signed in;
  • preference cookies that remember light or dark mode, your active facility and, for growers, the processor you are viewing; and
  • browser storage for screen preferences such as table column layout and recent pages for the back button; captures waiting to be sent if you lose your connection, which stay until you send or discard them, even after you sign out; and copies of the pages you open, which can include the information shown on them, so the platform can open without signal. These page copies are deleted when you sign out.

On a shared computer, always sign out when you finish.

There are no analytics or advertising cookies and no tracking across websites. Pages that show a map load Google Maps, so Google receives your IP address and browser information when a map loads (see section 9).

9. Who the information is shared with

Within your company

People in your company see information according to the roles and permissions your company gives them. Growers see their own information in the grower portal.

Our service providers

We use the providers below to run the platform. Each one processes personal information to provide its service to us, under contract, and where a customer is the responsible party they act as sub-operators.

  • Supabase: database, sign-in and file storage. The platform's data is stored on Amazon Web Services in the eu-west-1 region, in Ireland.
  • Vercel: hosting and content delivery for the web platform. The platform's servers run in Dublin, Ireland, and Vercel's network delivers pages from locations close to you. Vercel Inc. is based in the United States.
  • Anthropic: the AI model behind Nutty, only if your company turns Nutty on (see section 6). United States.
  • Resend: sends the platform's email, such as password reset emails, grower invitations, weekly reports and remittance notifications. Resend receives the content of these emails, including attached reports. United States.
  • Google: Google Maps Platform, on staff pages that show or search a map, and to find the locations of farms and facilities and work out pickup distances. The addresses, map searches and coordinates of farms, facilities and delivery destinations are sent to Google. The platform does not send grower names, but anything typed into a map search goes to Google. Google also receives your IP address and browser information directly when a map loads, and uses it under its own privacy policy. United States.
  • Sentry: error and performance monitoring for the web platform. Data is stored in Germany. Sentry is set up to receive technical details and timings only. It does not receive cookies, request contents, user details or screen recordings.

Some features fetch public information, such as exchange rates, from public sources. No personal information is sent to those services.

Other cases

We may disclose personal information if the law requires it. For information we hold as responsible party, we may also disclose it where necessary to protect the rights, property or safety of our customers, users or Tailormade Tech. If Tailormade Tech's business is sold or restructured, information we hold as responsible party may pass to the new owner, who must protect it as this policy describes. Customer data passes only as each customer's agreement with us allows.

10. Information sent outside South Africa

The platform's data is stored and processed outside South Africa: in Ireland and Germany, in the European Union, and in the United States by the providers listed in section 9.

POPIA section 72 allows personal information to be sent to another country only in the cases it lists. We rely on the recipients being bound by law or by binding agreements that give an adequate level of protection, substantially similar to POPIA. For Ireland and Germany, we consider that the European Union's General Data Protection Regulation gives that protection. For providers in the United States, we rely on their data processing terms.

11. How the information is protected

  • Separation between customers. Each customer's data is kept apart from every other customer's by rules enforced in the database itself (row level security), so one company cannot see another's information.
  • Permissions. Within each company, people see and change only what their role allows.
  • Audit log. Changes to records are logged with who made them and when. The log cannot be edited.
  • Encryption in transit. All traffic between your browser or app and the platform is encrypted (HTTPS).
  • Private files. Uploaded photos and documents are kept in private storage and open through links that expire after an hour. Documents the platform generates, such as remittances and invoices, open only for signed-in users allowed to see them. Company logos are public.
  • Passwords and sign-in. Passwords are stored only as one-way hashes, and sign-in and password reset are rate limited.
  • Error reports. Error reports are set up to leave out cookies, request contents and user details.

No system is completely secure. If we have reasonable grounds to believe personal information on the platform has been accessed or acquired by someone not authorised to do so, we will tell the affected customer immediately, as POPIA section 21 requires. Where we are the responsible party, we will notify the Information Regulator and the people affected as POPIA section 22 requires.

12. How long the information is kept

  • Customer data is kept for as long as the customer's agreement with us runs. While it runs, the customer decides how long to keep its records, and some records, such as tax and accounting records, must be kept for periods set by law. When the agreement ends, we delete the customer's data or return it to the customer, as the customer instructs under its agreement with us, unless the law requires us to keep it longer.
  • The audit log keeps a copy of every change, including earlier versions of details such as bank accounts, for as long as your company's agreement with us runs.
  • Your sign-in account is kept until you ask us to close it, or until no company you belong to still has an agreement with us. Your company can remove your access to its workspace at any time.
  • Nutty conversations are kept until your sign-in account is closed or your company's workspace is deleted.
  • Records of the days each user was active and of data exports are kept for as long as your company's agreement with us runs.
  • Sign-in protection counters are deleted after about a day.
  • Error reports are kept by Sentry for a limited period and then deleted automatically.

Deleted information can remain in backups for a limited time, until those backups expire.

13. Your rights

Under POPIA you have the right to:

  • ask whether we hold personal information about you, and ask for a copy of it;
  • ask for personal information about you to be corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
  • ask for personal information to be deleted when there is no longer authority to keep it;
  • object, on reasonable grounds relating to your particular situation, to processing based on legitimate interests (POPIA section 11(3));
  • be told if your personal information has been accessed or acquired by someone not authorised to do so;
  • not be subject to a decision based only on automated processing that has legal or similarly significant effects for you (section 71); and
  • complain to the Information Regulator, and start civil proceedings (section 99).

How to make a request

  • Information your company holds about you. Ask your company first, because it decides about that information. If you do not know whom to ask, or your company does not respond, email us and we will pass your request on and help your company answer it.
  • Your sign-in account, and information we hold as responsible party. Email wian@tailormadetech.co.za. We will first confirm your identity, normally by replying to the email address on your account. We reply within 30 days.

Closing your account

Your company's administrator can remove your access to its workspace at any time. To close your sign-in account completely, ask your administrator, or email wian@tailormadetech.co.za from the address you sign in with and tell us the name of your company. We confirm your identity, then close your sign-in account so that it can no longer be used, remove your access to every company and delete your Nutty conversations. We reply within 30 days to confirm what we did.

Some records keep your details because they show what happened:

  • where your company's records show that you did something, such as recording a delivery, your name and email address stay on those records;
  • the audit log keeps a copy of every change for as long as your company's agreement with us runs, and it cannot be edited; and
  • approved remittances and invoices keep the bank and VAT details they were approved with.

Your company decides whether to keep or delete its other records. We tell you what was kept and why.

A copy of your information

Use the same contacts. We pass requests about information a company holds to that company and help it answer. For your sign-in account and information we hold as responsible party, we reply directly within 30 days.

Complaints

If you are not satisfied with how a request was handled, you may complain to the Information Regulator (South Africa):

14. Children

The platform is for business use by adults. It is not intended for anyone under 18, and we do not knowingly process personal information about children. If you believe a child's information is on the platform, please tell us.

15. Contact and Information Officer

16. Changes to this policy

We may update this policy when the platform or the law changes. Each version shows its version number and effective date at the top. The current version is always available at www.tailormadetech.co.za/privacy-policy/tmnuts and on every customer's web address at /privacy-policy. If a change materially affects how personal information is used, we will tell our customers before it takes effect.

Version history

  • Version 1.0, effective 13 October 2026: first published.
  • Version 1.1, 13 October 2026: company registration number and registered address added.

Published by Tailormade Tech (Pty) Ltd, registration number 2022/867626/07, 21 Chief Mgiyeni Khumalo Drive, White River, Mpumalanga, 1240, South Africa.