Terms, licence & privacy

1. Agreement and scope

These terms govern individual access to Compliance Tag. The municipality’s signed quotation, procurement contract and licence govern purchased services; negotiated written terms prevail if they conflict. Accepting as a user does not authorise municipal expenditure or bind a municipality to a new purchase. The service provider trades as Compliance Tag; its registered legal entity must be identified in the signed procurement agreement. Enquiries: support@compliancetag.co.za.

2. Software licence and ownership

The provider retains its software, brand and pre-existing intellectual property. The municipality retains its records, uploaded documents and resulting reports. Subject to the agreed fees, authorised users receive a non-exclusive, non-transferable right to use the service for municipal work during the contracted term. Tenant certificates run for twelve calendar months from activation; renewal, seat allocations, prices, taxes and support scope follow the accepted quotation. No renewal charge is authorised by accepting these user terms. Do not resell access, share credentials, circumvent security, or copy the software except where law permits.

3. Responsibilities and appropriate use

Users must have authority to handle submitted information, keep accounts secure, report suspected compromise, and respect applicable municipal, records and privacy duties. Managers control access and must revoke it when no longer justified. Do not upload unlawful material, malware, unnecessary sensitive information, or information you are not authorised to disclose. Keep independent records and required archives. Two-factor authentication is optional; once activated, an authenticator code is required for protected access.

4. Audit support and AI

The service supports governance workflows; it does not provide legal advice, certify compliance, make statutory decisions or guarantee an unqualified opinion (clean audit). AI can omit information or produce inaccurate statements. Authorised humans must verify facts, calculations, recommendations and legal requirements before approval or reliance. Use AI only with information authorised for that processing; privileged legal, special personal and confidential information requires particular care.

5. Availability, liability and fair remedies

The provider will exercise reasonable care and skill, apply reasonable safeguards and address reported faults. Maintenance and external service failures may interrupt availability. Unless a signed contract provides otherwise and to the extent permitted by law, liability for proven direct loss is capped at fees paid for the affected service during the preceding twelve months; neither party is liable for indirect or consequential loss. These limits do not exclude fraud, intentional misconduct, gross negligence, or liability that cannot lawfully be limited. Nothing waives statutory consumer or privacy rights. Each party remains responsible for its own unlawful conduct; no blanket user indemnity applies.

6. Suspension, ending access and disputes

Access may be restricted where reasonably necessary to protect security, comply with law or address material breach. Give notice and a reasonable opportunity to remedy when practicable; immediate restriction may be necessary for serious security risks. Contract termination, refunds and data return follow the signed agreement and applicable law. Arrange an authorised export before service end. South African law applies, subject to mandatory rights; first raise disputes with the contact above, then use agreed mediation or a competent court. Material changes require fresh acceptance; retrospective changes do not remove accrued rights.

7. POPIA and municipal information

The municipality normally acts as responsible party for records it controls. The provider acts as operator for hosting and processing those records under authorised instructions, and as responsible party for its own account, support and contract administration. An operator agreement should accompany procurement and define security, retention, sub-processors, breach reporting and data return. This notice does not replace that agreement or establish legal compliance.

We process account names, email addresses, municipal memberships, roles, requests, uploaded evidence, reports, acceptance records and access-change logs to provide and secure the service, support users and meet contractual or legal duties. Hosting, authentication, file storage and selected AI services are provided through Lovable Cloud and its service providers. AI receives the information submitted to the requested AI feature. Authorised municipal users see records according to their access rights. External providers may process data outside South Africa; confirm hosting locations, safeguards and POPIA section 72 transfer conditions in procurement before uploading restricted information.

Use is not marketing consent. Request access, correction, authorised deletion or information about retention at the contact above, or through your municipality’s Information Officer. Retention follows municipal records duties and the agreed service schedule; do not assume deleting an account deletes public records or audit history. Notify suspected breaches promptly; the responsible party and operator must fulfil their applicable notification duties. Complaints may be raised with the South African Information Regulator at inforegulator.org.za.

8. Browser storage and visitor analytics

Sign-in uses browser storage for session tokens, selected municipality and update settings. This enables retained sessions; shared-device users should explicitly sign out. Google Fonts receives requests including network and browser information to deliver the fonts. There are no advertising pixels identified in the app.

Lovable’s analytics records pages visited, referral sources, country, browser, operating system, device type, time on page, page speed, errors and clicks on links and buttons. Clicks are identified by page position, not button text. Everything listed is recorded for every visitor on this site. It uses no cookies, stores nothing on the visitor’s device, does not keep IP addresses and does not identify visitors. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it. App error reports may also be sent to help diagnose faults. Page visits, time on page, page speed and errors are recorded without cookies and without identifying anyone.