Privacy Policy

ClientBrief is a software-as-a-service product owned and operated by Kyvane (Pty) Ltd (registration number 2026/729355/07), a company incorporated in South Africa with its registered address at 3 Niagara Way, Bellville, Cape Town, Western Cape, 7530. In this policy “we”, “us” and “ClientBrief” mean that company.

ClientBrief is software used by insurance brokers to collect information from their clients, populate insurer documents, and capture an electronic signature. That means two different kinds of personal information flow through the service, and our obligations are different for each.

“Responsible party” and “operator” are POPIA’s terms for what other laws call a controller and a processor.

Broker account information, which you give us when you register:

• Your name, email address and mobile number
• Your brokerage name and, where you provide it, your FSCA licence number
• Your uploaded brokerage logo, if you add one
• Authentication data — a hashed password, or an identifier from Google or Microsoft if you use single sign-on. We never receive or store your Google or Microsoft password.
• Records of your use of the service: forms created, submissions sent, and when you signed in

Client information, which a broker’s client enters into a form the broker built. The broker chooses which fields to ask for, so the exact set varies, but it commonly includes:

• Name, contact details, physical address and date of birth
• South African identity number
• Information relevant to the cover being applied for, which may include financial, employment, vehicle, property or household details
• A handwritten signature captured on the client’s device
• The date, time and IP address at the moment of signing, together with the client’s POPIA consent declaration — retained as evidence that the signature is attributable to that person

Payment information. We do not collect or store card details. Payments are handled by Paddle, which is the merchant of record for every ClientBrief subscription. We receive only a customer reference, your plan, and your subscription status.

We process broker account information in order to:

• Create and secure your account and authenticate you (necessary to perform our contract with you)
• Provide the service — building forms, sending client links, generating documents (contract)
• Bill you and manage your subscription (contract, and our legal obligations)
• Send you service messages, such as a notice that a client has signed (contract)
• Keep the service secure and diagnose faults (our legitimate interests)

We process client information solely to perform the service for the broker who collected it. We do not decide what is collected, we do not use it for our own purposes, and we do not profile clients. The broker is responsible for having a lawful basis — normally the client’s consent, captured in the signing flow, together with the necessity of processing to conclude an insurance contract.

We never sell personal information, and we do not use it to train machine learning models.

We use the service providers below to help deliver ClientBrief. Their services may process the limited personal information needed for their stated purpose:

We will also disclose information where the law requires it, or to establish or defend a legal claim.

Before production launch, Kyvane must complete and maintain a vendor review for each provider, including its data-protection terms, security measures and cross-border transfer position. We do not represent that Kyvane has signed a separate data processing agreement with every provider while that operational work remains incomplete.

Client information, including signed documents, is stored in a database and object store operated by Supabase in Ireland (European Union). It therefore leaves South Africa. Other supporting services — email delivery, payment processing and application hosting — operate from the countries listed in section 5, and limited personal information is transferred to them as described there.

Section 72 of POPIA permits transfers where the relevant safeguards or another lawful basis apply. Kyvane will assess the applicable provider terms and transfer safeguards as part of its pre-launch vendor review; the broker remains the responsible party for its clients’ information.

• Broker account information: while your account is active. Deactivation blocks login but does not start an automatic deletion period; account information remains until reactivation or until we can lawfully process a verified request.
• Client submissions and signed documents: deactivation does not automatically delete them. They remain broker-controlled business records until the broker deletes an individual submission or asks us to return or delete records, in each case subject to applicable retention duties.
• Signing evidence (timestamp, IP address, consent declaration): kept with the signed document, since it is what makes the signature defensible.
• Billing records: five years, as required by South African tax law.

Brokers should be aware that their own retention obligations under FAIS and FICA may be longer than the periods above, and that they remain responsible for meeting them.

To request access, export, correction, reactivation, or lawful deletion after deactivation, the brokerage owner can contact hello@myclientbrief.com. We will verify the requester’s authority and work with the broker on the request. We do not promise immediate deletion where a broker’s FAIS, FICA, insurer, tax, or other retention duty applies.

• All traffic is encrypted in transit using TLS, and data is encrypted at rest by our hosting provider.
• Every broker’s data is isolated at the database level by row-level security, so one broker’s queries cannot reach another broker’s records.
• Client signing links are single-use, expire, and carry an unguessable token. A link that has been used or has expired shows a notice rather than the form.
• Signed documents are held in private storage that is not publicly reachable and is served only through authenticated, time-limited links.
• Access to production systems is limited to personnel who need it.

No system is perfectly secure. If a breach occurs that creates a real risk to your information, we will notify you and the Information Regulator as POPIA section 22 requires.

Under POPIA you may:

• Ask what personal information we hold about you, and request a copy
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, or obtained unlawfully
• Object to processing based on legitimate interests
• Withdraw consent where our processing relies on it, without affecting what was done before you withdrew it
• Complain to the Information Regulator

To exercise any of these, email Jacques Pieterse at jacquespieterse2000@gmail.com. We respond within 30 days. We may ask you to verify your identity first — we are not going to hand someone’s ID number to a stranger who asked nicely.

If you are a client rather than a broker, please contact the broker who sent you the form. They decide what happens to your information, and we act on their instruction.

We use only what the service needs to function: a session cookie that keeps a broker signed in, and a preference cookie that remembers dismissed notices. We do not use advertising cookies, and we do not run third-party analytics that track you across other websites. Clients completing a form are not tracked.

Our Information Officer is Jacques Pieterse, reachable at jacquespieterse2000@gmail.com, or by post at 3 Niagara Way, Bellville, Cape Town, Western Cape, 7530.

If we have not resolved your concern, you may complain to the Information Regulator (South Africa) at complaints.IR@justice.gov.za or via inforegulator.org.za.

We will update this policy as the service changes. If a change materially affects how we handle your information, we will tell brokers by email before it takes effect. The date at the top of this page always reflects the current version.

Questions about anything here: hello@myclientbrief.com. See also our Terms of Service and our Data Processing Addendum.