1. Who we are

M+ Labs is operated by M+ Labs (Pty) Ltd in South Africa. In this policy, “M+ Labs”, “we”, and “us” refer to that business when it handles your personal information.

We handle personal information in line with applicable privacy law, including South Africa’s Protection of Personal Information Act (POPIA). The Act requires responsible parties to tell people what information is collected, why it is collected, and how it is used. Read POPIA.

2. Information we handle

Depending on how you interact with us, we may handle:

• Enquiries: your name, email address, phone number, company, requested service, budget range, project message, and any marketing consent you give.
• Client accounts: your email address, name, phone number, company details, password hash, profile photo, and account activity needed to authenticate and protect your account. We do not store your plain-text password.
• Project and meeting records: project information, client-visible updates, booking preferences, meeting details, and messages or feedback you submit through the portal.
• Files and billing records: documents or invoices shared through the portal and records needed to administer a service or transaction.
• Technical information: information generated by essential site functions and hosting security logs, which may include IP address, browser/device details, and request timestamps.

Information marked as required on a form is needed to respond to that request or provide the related account feature. If you do not provide it, we may be unable to complete that task.

3. How we use information

We use personal information to respond to enquiries, prepare proposals, provide and support projects, administer client accounts, arrange meetings, send service notices, process payments and refunds, maintain security, and meet legal or accounting obligations.

We send marketing messages only where you have opted in or where applicable law otherwise permits them. You can withdraw marketing consent by contacting us or using an unsubscribe option when one is provided. This does not affect service or account messages.

4. Sharing and service providers

We share information only when it is needed to run the service, complete your request, protect our rights, or meet the law. This may include access by authorised M+ Labs personnel and service providers that host the website or database, deliver email, provide technical support, or process payments.

For purchases made through Paddle checkout, Paddle handles the transaction as the Merchant of Record. Paddle receives the information needed to process and support that purchase under its own terms and privacy notices. M+ Labs does not receive or store your full payment-card number through that checkout.

We may also disclose information to a regulator, court, law-enforcement authority, or professional adviser when legally required or reasonably necessary to protect people, services, or rights. We do not sell personal information.

5. Cookies and session settings

The client portal uses essential cookies for security and sign-in, including session and CSRF protection. These are needed for core site functions. We do not use this policy to promise that third-party services never set their own cookies; their own notices apply when you use those services.

If you select “Remember me” at sign-in, the portal asks the browser to retain your sign-in session for up to 14 days. If you leave it unchecked, the session is intended to end when you close the browser. You can also sign out to end an active session.

6. Retention and security

We keep information for as long as needed for the purposes described here, including providing services, maintaining account and project history, resolving disputes, and meeting legal, tax, or accounting requirements. Retention periods depend on the type of record and the reason it was collected.

We use access controls and reasonable technical and organisational safeguards to protect personal information. No website or transmission method can be guaranteed completely secure. Please use a unique password and contact us promptly if you suspect unauthorised access to your account.

7. International processing

Some website, email, or payment providers may process information in countries outside South Africa. Where personal information is transferred across borders, we take steps intended to use an appropriate basis and safeguards required by applicable law. Paddle’s own privacy information applies to information it handles for a Paddle transaction.

8. Your choices and rights

Subject to applicable law, you may ask us to confirm whether we hold your personal information, request access to it, ask us to correct or delete inaccurate or no-longer-needed information, object to certain processing, or withdraw consent where processing relies on consent. We may need to verify your identity and may retain records we are legally required to keep.

To exercise a right, email hello@mpluslabs.co.za with “Privacy request” in the subject line. You may also lodge a complaint with the Information Regulator of South Africa.

9. Children

Our services are intended for businesses and adults. We do not knowingly invite children to create client accounts. If you believe a child has provided personal information to us, contact us so we can review and address it.

10. Contact and updates

For privacy questions or requests, contact M+ Labs (Pty) Ltd at hello@mpluslabs.co.za or WhatsApp +27 66 491 0234.

We may update this policy when our services or legal requirements change. The latest version and revision date will appear on this page.