Privacy policy

NovaTrack is a location tracking service for Apple AirTags run by Novasys IT (Pty) LTD (Registration 2018/058452/07) in South Africa (“Novasys”, “we”, “us”). This policy explains what personal information we process, why, and what you can do about it. We have written it in plain language and with the Protection of Personal Information Act, 2013 (POPIA) in mind. It is not legal advice; if you have questions, ask us.

Two roles: our customers and their tags

For your account details (name, email, billing), we decide how the information is used, so we are the responsible party under POPIA.

For the location data of the tags you track, you, our customer, decide what is tracked and why. For that data you are the responsible party and we act as your operator: we process it on your instructions to provide the service, and not for our own purposes.

What we collect

• Account information: names, email addresses, passwords (stored hashed), two-factor and passkey settings, team membership.
• Tag information: the tag names, notes, assignee names and references you enter, and the tag keys needed to decrypt its location reports.
• Location data: positions, accuracy, battery level and timestamps from Apple’s Find My network for the tags on your account.
• Billing information: subscription and payment records. Card details are handled by PayFast; we do not see or store your card number.
• Technical information: server logs such as IP address, browser and request times, used to keep the service secure and working. We also count views on share links.

How we use it

• To run the service: show tags on your map, keep history, evaluate zones, send the alerts and webhooks you set up.
• To bill you and keep financial records we are legally required to keep.
• To support you, and to tell you about important changes to the service.
• To keep the service secure and prevent abuse.

We do not sell personal information and we do not use your tags’ location data for advertising.

How location data works

AirTags broadcast an encrypted Bluetooth signal. Nearby Apple devices pick it up and upload an encrypted location report to Apple. We fetch the reports for your tags and decrypt them with the tag keys on your account. We only ever receive reports for tags on NovaTrack accounts.

Each tag has a privacy mode. In “working hours only” and “only while on a job” modes, reports outside the allowed window are discarded before they are stored.

How long we keep it

• Location history is kept for 90 days and then deleted automatically.
• Each tag’s latest position is kept until the tag is removed or the account is closed.
• Account information is kept while your account is open, and deleted or anonymised within a reasonable time after it is closed.
• Billing records are kept for as long as tax and accounting law requires.

Tracking staff and other people

If a tag travels with a person, such as an employee or a contractor, its location may be personal information about that person. As the responsible party, you are responsible for having a lawful reason to track, telling the people concerned (in writing, for example in a policy or contract), getting consent where needed, and only collecting what you need. Our privacy modes and share links with expiry dates are there to help you do that. Never use NovaTrack to track someone without their knowledge.

Share links

A share link lets anyone with the link see one tag’s name and live position until it expires or is revoked. Only share it with people who should see it.

Who we share it with

• Service providers who help us run NovaTrack: hosting, email delivery, PayFast for payments, and map tile providers (your browser loads map images from them).
• Apple, because location reports are fetched from Apple’s Find My service.
• Your own systems, when you set up webhooks or use the API.
• Authorities, only where the law requires it.

Some providers may process data outside South Africa. Where they do, we rely on the protections POPIA requires for cross-border transfers.

Security

We use encrypted connections, encrypt tag keys at rest, hash passwords, support two-factor authentication and passkeys, and limit who at Novasys can access customer data. No system is perfectly secure; if a breach affects your information we will tell you and the Information Regulator as POPIA requires.

Your rights

You may ask to see, correct or delete personal information we hold about you, and object to processing. If a tag belongs to your employer or another customer, please contact them first, since they control that data; we will help them respond. You can also complain to the Information Regulator of South Africa (inforegulator.org.za).

Changes and contact

We may update this policy and will change the date at the top when we do. For significant changes we will let account owners know by email. Questions or requests: support@novasys.co.za.