1. Responsible party and scope
NULL ORIGIN (PTY) LTD, registration number 2026/801266/07, with its registered office at 5826 Neli Mokele Street, Tshepiso, Vanderbijlpark, Gauteng, 1901, South Africa, is the responsible party for the processing described here. Our website is https://nullorigin.tech. Send privacy questions and requests to [email protected].
This policy covers the corporate website, contact enquiries, project applications and partner portal. Null Origin’s products have their own service-specific privacy notices. External services have notices from their respective operators. Consult the notice for the particular service you use to understand the processing it covers.
Our Information Officer can be contacted at [email protected]. General support is available at [email protected].
Telephone: +27 84 689 1445 (084 689 1445 within South Africa; tel:+27846891445).
2. Information you provide
The contact form requires your name, email address and message so we can understand and respond to an enquiry. Email account registration requires an email address and password; Google sign-in supplies account identity information through Google and our authentication provider. We process account identifiers, confirmation and session information, display names, roles and assigned permissions.
Application drafts require a title and relationship model. Submission also requires your preferred relationship model, name, email, project description, problem, market, customers, stage, requested technical support and contribution. Phone, organization, existing assets or prototype, available funding and additional notes are optional. Uploads include document title, file content and type, and project access classification where applicable.
During an engagement we may receive organization and membership details, correspondence, project records, agreements, signing identity and authority evidence, financial records and payment evidence. We record submission-term acceptance, publicity permissions, approvals, restrictions, withdrawal and privacy requests. Provide other people’s information only with appropriate authority and avoid unnecessary sensitive information.
Withholding required details prevents the related form, account or submission from being completed; you can still browse public pages or discuss alternatives with support. Optional details are your choice.
3. Other sources and technical information
Authorized project participants and staff may supply records about shared projects, invitations, agreements, payments and approvals. Google supplies identity information when you choose its sign-in option; email providers supply delivery, bounce and failure events for service messages.
Website and authentication requests expose technical information such as IP address, request time, browser or request headers and error information to the services handling them. The contact form checks a hidden abuse field and form timing and temporarily uses IP address, email and message information to limit repeated submissions. Portal audit history records who performed an action, the affected record and time. We do not collect payment-card details through a website checkout.
4. Purposes and lawful grounds
We use enquiry and proposal information to respond, evaluate requests and take steps toward an engagement at your request. Account and project records support authentication, access management, delivery, agreements, accounting and service messages. Security checks and proportionate audit records protect the legitimate interests of the company, users and project participants. We retain or disclose information where necessary to meet applicable legal obligations or address legal claims.
Where processing relies on consent, such as optional project publicity, we ask for a specific choice and respect withdrawal for future processing. We consider the applicable POPIA justification for each purpose, including contractual steps, legal duties and legitimate interests, rather than treating a visit as blanket consent. A privacy notice informs you about processing; it is not a request to consent to every use. Necessary service messages do not depend on marketing permission.
5. Providers and other recipients
Supabase provides this portal’s authentication, database and private file storage. It handles account and session information and the project records and files stored there. Google provides account identity when you choose Google sign-in; its receiving email service is described below. Resend is integrated for contact notifications, acknowledgements and portal service emails, receiving recipients, message content and delivery information. Our hosting services handle website requests and technical logs; Vercel is the hosting platform identified for this website’s deployment.
Authorized staff, relevant applicants and assigned project participants see information within their roles and access permissions. We may share necessary information with professional advisers or authorities for an engagement, legal duty or legal claim, subject to appropriate confidentiality and lawful grounds. Approved showcase content is public; private applications and documents are not.
ImprovMX provides the domain’s incoming email routing and can process incoming correspondence and addressing information. Cloudflare provides domain/network services and the web analytics observed on this website; it handles relevant technical request and performance information. Incoming support and privacy correspondence is forwarded through ImprovMX to a Google Gmail mailbox, so Google also processes message content, attachments and addressing information under its consumer service terms and privacy policy. The receiving account address is kept private; use our published domain email contacts. We do not sell personal information or automatically add enquiry senders to a marketing list.
6. Processing outside South Africa
Our corporate Supabase database is hosted in Ireland. Supabase Pte. Ltd provides the configured authentication, database and storage service; its support and subprocessors can involve Singapore, the United States and other locations identified in its provider information. Vercel Inc hosts the website and describes primary processing facilities in the United States and processing wherever its subprocessors operate. Plus Five Five, Inc. (Resend) processes service-email data primarily in the United States. Cloudflare provides network services and deployed web analytics through its international infrastructure. Incoming correspondence uses ImprovMX routing and Google consumer Gmail, which describes worldwide processing under its general service terms and privacy policy. These processing routes mean information is not confined to South Africa or to the database region.
Supabase, Vercel and Resend incorporate data-processing addenda into their standard service terms. These address processing instructions, confidentiality, security, subprocessor controls and international transfers; the transfer clauses apply within their stated legal and geographic scope. The relevant terms are at https://supabase.com/legal/customer-resources/data-processing-addendum, https://vercel.com/legal/dpa and https://resend.com/legal/dpa. Cloudflare publishes its processing terms at https://www.cloudflare.com/cloudflare-customer-dpa/. The receiving Gmail mailbox uses consumer terms at https://policies.google.com/terms and https://policies.google.com/privacy. Google states that consumer Gmail has no processor DPA; Google Workspace or Cloud data-processing terms are not relied on for this mailbox. These contractual protections must be assessed for the relevant recipient and transfer under POPIA section 72; the existence of European transfer clauses is not by itself a determination that every South African transfer is authorised.
Contact [email protected] for the transfer arrangements and safeguards applying to your records. We assess requests and disclosures against the actual provider arrangement rather than treating optional publicity or marketing consent as permission for every international transfer.
8. Service messages and marketing
Contact acknowledgements, account confirmation and project notifications are service messages. They support your request or account and are separate from promotional email. Sending an enquiry or creating an account does not automatically enrol you in marketing. Where optional marketing choices are available, we record those choices separately. You can withdraw a recorded marketing permission through the account marketing-preference page or contact [email protected] to object to promotional use. Withdrawal does not stop messages necessary to administer an ongoing request or engagement. Any future marketing signup must provide an appropriate separate choice and working opt-out under applicable law.
9. Private submissions and optional publicity
Applications and uploaded submission files are private by default and accessible only to their applicant and authorized staff. Project access requires assigned membership or staff permissions. You can choose independent branding instead of a Null Origin showcase. Showcase permission is separate from submission-term acceptance and distribution requests.
The publication process requires recorded permission and approval of the exact content and public assets. Public presentations use selected showcase fields and approved images, rather than exposing application contact details or private submission attachments. Authorised partners can revoke permission through project visibility controls or request withdrawal through support. Within the scope of a valid withdrawal, we stop new uses and remove, disable or update affected showcase material on websites and accounts we control without unnecessary delay. We explain any separate lawful basis or contractual issue affecting the request. Copies independently retained or republished by other people may remain outside our control.
10. Retention and deletion
We keep information only for as long as reasonably necessary for its purpose and applicable obligations. We consider whether an enquiry is resolved, an application or engagement remains active, records are needed for agreements or accounting, a dispute or legal hold exists, and the need for proportionate security history. Withdrawing an application changes its status; it does not automatically erase it.
Privacy and deletion requests receive identity, authority and retention review. The portal does not provide automatic account or file erasure. Agreement, signing, accounting and audit history is preserved where needed for evidence and lawful obligations. We will explain a lawful reason for refusing or limiting deletion and restrict further use where appropriate. Provider backups may retain copies until their applicable backup cycle expires; deletion is not a promise of instant removal from every backup.
When there is no continuing lawful reason to keep personal information, we arrange its deletion, destruction or de-identification as appropriate. Controls that protect agreement, financial and audit history from alteration do not justify keeping personal information indefinitely. Where we retain information after a deletion request, we explain the reason and limit its further use appropriately.
11. Security and compromises
Safeguards include server-side account verification, database row-level access policies, scoped project permissions, private document storage, authorized download checks and audit records. The corporate server configures its session and authentication-verifier cookies as HttpOnly, Secure in production and SameSite=Lax. This describes these application cookies; it is not a claim about cookies set by separately loaded services. Financial and agreement histories have controls against unauthorized alteration. These measures reduce risk but cannot guarantee absolute security.
Report suspected exposure or unauthorized access to [email protected]. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorized person, we will notify the Information Regulator and affected data subjects as required by POPIA, as soon as reasonably possible subject to lawful investigation and notification exceptions. We will provide available information needed to understand the compromise and protective steps.
12. Your rights and complaints
You may ask whether we hold your personal information and request access to it. After appropriate identity verification, confirmation of whether we hold it is free. You may seek correction or deletion of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, and deletion or destruction of records we are no longer authorised to retain. You may also object to applicable processing and withdraw consent for future consent-based uses. Withdrawal does not invalidate earlier lawful processing. Legal retention duties and the rights of others may affect a request; we will explain our response.
Requests to object, correct or delete under the applicable POPIA procedures are free. If a permitted access or copying fee applies, we explain it in advance. We handle requests through the applicable legal procedure and communicate the outcome.
Anyone whose personal information we process may contact [email protected], whether or not they have or can access a portal account. Describe the request and relevant account or project. We may seek proportionate proof of identity or authority; do not send identity documents unless requested through an appropriate channel. Signed-in users may also use portal settings and the downloads available to them.
You may request an eligible export before we complete account deletion. Tell us if you want that opportunity so we can coordinate the request. Portal downloads provide a convenient selection of accessible records; they do not determine the full scope of a statutory access request. Requests involving other people’s information or protected records are assessed under the applicable law.
You may complain about possible unlawful processing to South Africa’s Information Regulator without first resolving the matter with us. See its complaints guidance (https://inforegulator.org.za/complaints/) and eServices portal (https://eservices.inforegulator.org.za/). For assistance, use the Regulator’s official contact page (https://inforegulator.org.za/contact-us/), email [email protected] (mailto:[email protected]) or call 010 023 5200 (tel:+27100235200). Access-to-records requests and related complaints under PAIA follow the applicable PAIA procedure.
Information Regulator complaint instructions · eServices complaint portal · Official contact information · [email protected] · 010 023 5200
13. Children and automated decisions
This corporate portal supports business and software engagements and does not implement an age-verification gate. Where a child’s personal information is involved, the relevant processing requires prior consent from a person legally competent to give it on the child’s behalf, or another applicable authorisation under POPIA section 35. A parent or guardian should contact [email protected] before arranging a child’s account or submission so that we can establish the appropriate authority and safeguards. General permission to use the website does not replace this requirement. If we learn that information was supplied without the required authority, we limit the affected activity while determining the lawful next steps.
This website does not send proposals to an AI evaluation service or make consequential acceptance, contracting or financial decisions solely through automated profiling. Staff review proposals and commercial approvals. Automated validation, abuse limits and agreed accounting calculations support the workflow; they do not replace the required human review. Separate products may have their own AI features and disclosures.
14. Changes and contact
We will show the version and effective date of changes here. Material changes affecting account holders will be communicated through available email or portal notices. If a new use requires consent or another legal step, we will complete that step before the use begins. Contact [email protected] for questions, rights requests or further information about this policy.