Skip to the content

Privacy policy

Adiabat (Pty) Ltd, registration number 2026/726535/07. Last updated 25 October 2026.

This policy explains how Adiabat (Pty) Ltd (“Adiabat”, “we”) collects, uses, shares and protects personal information when you visit adiabat.co.za, send a request on its form, apply for or use DraftSolver at app.adiabat.co.za, buy a plan, or write to us. It is written to meet South Africa’s Protection of Personal Information Act, 2013 (POPIA), and the EU and UK General Data Protection Regulation (GDPR) where they apply to us.

1. Who we are

Adiabat (Pty) Ltd is a private company registered in South Africa under registration number 2026/726535/07. We are the responsible party for the personal information this policy describes (the controller, in the GDPR’s terms).

  • Address: 6 Lingfield Way, Edgemead, Cape Town, 7441, South Africa
  • Email: admin@adiabat.co.za
  • Telephone: +27 62 299 0106
  • Information Officer: Dr Wian Strydom, reachable at admin@adiabat.co.za

2. What this policy covers

It covers the personal information we decide how to use: what you give us on this website and in your account, what we record when you use DraftSolver, and what we receive when you buy.

The engineering data you put into DraftSolver (cases, inputs, runs, results and files) belongs to your organisation. If it holds personal information, for example a colleague’s name in a case title, we process it only as your operator (processor) to run the service, under section 19 of the terms of service. How we handle your data describes that processing.

3. What we collect

When you send a request on this website or write to us

  • Your name, work email address, company or university, country, role and intended use.
  • Your answers to the optional survey on the form, if you give them.
  • Whether you asked to be told when DraftSolver opens.
  • Anything you write in your message.
  • A one-way, salted hash of your IP address, used to limit repeated submissions. The address itself is not stored.

When you apply for and use an account

  • The application: your name, work email address, organisation, job title, country and intended use, and the decision on it with who made it. Applications from free-mail addresses are not accepted.
  • For a student seat or a teaching licence: the course or degree you are enrolled for, and the name and work email address of your supervisor or lecturer. We write to them to confirm your enrolment and the use, and tell them why.
  • Your account: your name, email address, your role in your organisation (owner or member) and when you last signed in.
  • Sign-in: DraftSolver uses Auth0 (Okta) to sign you in. Auth0 holds your password and your second factor; DraftSolver never receives or stores your password.
  • Sessions and tokens: a session token and any personal API tokens you make, stored only as hashes.
  • Usage records: which analysis ran, on which system, whether it succeeded, how long it took, the compute it used and who ran it. They never contain your inputs or results.
  • Problem reports you send from the app: your message, and your case’s inputs and a screenshot only if you choose to include them.
  • The emails the app sends you, such as approvals, invitations and notices, with their content.

When you buy

Paddle, our online reseller, collects your billing name and address, your payment details and your tax details at checkout. Paddle tells us what was bought, by which organisation, and whether the payment succeeded. We never receive your card number.

If Adiabat invoices your organisation itself, we hold the billing contact’s name and email address, the organisation’s billing address and tax numbers, the invoice, and the record of the payment to our bank.

When you visit this website

This website sets no cookies. Cloudflare, which hosts it, processes your IP address and the details of each request to deliver the page and to protect the site from abuse. Cloudflare Web Analytics counts visits without cookies and without identifying you. If the request form uses Cloudflare Turnstile to tell people from automated submissions, Turnstile processes signals from your browser for that purpose alone.

When you use the app

The app’s servers log each request’s IP address, method, path (without its query), status and time, for security and troubleshooting. If the app meets an error, it sends a report to Sentry with the error’s type and where in the code it happened; numbers, quoted text, addresses and identifiers are removed from its message first, and no inputs, request bodies, cookies or account details are sent.

4. Why we use it

What we do Our basis under POPIA (section 11) and the GDPR (article 6)
Answer your request, read your application and open your account Steps you asked for before a contract, and our legitimate interest in answering enquiries
Provide DraftSolver: sign-in, runs, results, support and the emails the service needs Performance of the contract with you or your organisation
Take payment, through Paddle or on our own invoice, and keep tax and accounting records The contract, and our obligations under tax and company law
Keep the service secure, prevent abuse and find faults Our legitimate interest in protecting the service and the people who use it
Set our plans and prices from the survey, and improve DraftSolver from usage records that hold no inputs Your consent for the survey; our legitimate interest in improving the product
Tell you when DraftSolver opens, and send product news Your consent, given on the form; for customers, our legitimate interest in telling you about our own similar services (POPIA section 69(3))
Comply with the law and enforce our terms Legal obligation, and our legitimate interest

Giving us personal information is voluntary. Without a name, a work email address and an organisation we cannot answer a request or open an account, and without billing details Paddle cannot complete a purchase.

We do not sell personal information. We make no decision about you by automated means alone: every application is read by a person.

5. Who receives it

We share personal information only with the operators (sub-processors) that run parts of the service for us, under written agreements that require them to keep it secure and confidential and to use it only on our instructions.

Operator What it does for us Where
Cloudflare, Inc. Hosts this website, stores the requests sent on its form and delivers them by email, runs the DNS, counts visits and checks for automated submissions Its global network; a US company
Hetzner Online GmbH Runs the app’s servers and database The European Union
Backblaze, Inc. Keeps the app’s backups, which are encrypted before they leave our server The European Union (Netherlands)
Amazon Web Services EMEA SARL Runs CFD jobs on compute started for the job; receives the case being solved The European Union (Sweden)
Okta, Inc. (Auth0) Signs you in and holds your password and second factor Its EU region
Migadu-Mail GmbH Sends and receives our email Switzerland, with servers in the European Union
Functional Software, Inc. (Sentry) Receives the app’s error reports, cleaned as described in section 3 Its EU region
Paddle.com Market Ltd Sells DraftSolver plans as our reseller and Merchant of Record: checkout, invoices, tax and refunds The United Kingdom

When you run an annual analysis on a “PVGIS typical year”, the app sends the latitude and longitude you entered to the European Commission’s Joint Research Centre to fetch the weather. Nothing else about you or your case is sent.

We may also disclose personal information to our professional advisers, who are bound to keep it confidential, to a court, regulator or other authority where the law requires it, and to the buyer of our business if it is sold, under the same protections as this policy.

6. Transfers outside South Africa

Most of the processing takes place in the European Union, whose GDPR gives protection substantially similar to POPIA’s, as section 72(1)(a) of POPIA requires. Paddle processes in the United Kingdom under the UK GDPR, and Migadu in Switzerland under the Swiss Federal Act on Data Protection. Cloudflare and the other US companies above process under data processing agreements that bind them to protection of the same standard, including the European Commission’s standard contractual clauses where the GDPR applies.

POPIA also protects information about juristic persons, which the GDPR does not; our agreements with operators cover it by contract.

If you are in the European Economic Area or the United Kingdom, the GDPR applies to our processing because we offer DraftSolver to you. You can ask us for a copy of the safeguards that apply to a transfer by writing to admin@adiabat.co.za.

7. How long we keep it

Information How long
Requests sent on this website’s form, and enquiries 24 months after we last corresponded, unless you become a customer; then deleted
The salted hash of your IP address on a request One day, then removed from the request
Applications that were not accepted 24 months after the decision
Accounts and the organisation’s data While the account exists. When an organisation’s owner asks for its deletion, it is deleted 14 days later (the owner can cancel until then), and leaves our backups as they roll over, within 12 months
An organisation whose plan has ended Readable and exportable for 12 months, then deleted after 30 days’ notice by email
Usage records 395 days
Problem reports and the record of emails the app sent 24 months
Server logs A few days, as they rotate
Error reports at Sentry Up to 90 days
Billing, tax and accounting records As long as tax and company law require, currently up to seven years

8. How we protect it

  • All traffic to this website and to the app is encrypted in transit with TLS.
  • The app’s backups are encrypted before they leave the server.
  • Our servers accept only web traffic from the internet. Administration is done over a private network, with keys, by Adiabat’s administrators alone.
  • Passwords and second factors are held by Auth0, not by DraftSolver. Session and API tokens are stored only as hashes.
  • Each organisation’s data is kept apart from every other’s, and automated tests check every route of the app for it.
  • Error reports are cleaned of personal and engineering data before they leave the server.

No system is perfectly secure. If personal information is accessed or acquired by someone without authority, we will notify the Information Regulator and the people affected as section 22 of POPIA requires, and, where the GDPR applies, the supervisory authority within 72 hours.

9. Your rights

Under POPIA you may:

  • ask whether we hold personal information about you, and for a record of it (section 23);
  • ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we may no longer keep (section 24);
  • object to our processing it on the ground of a legitimate interest (section 11(3)), and withdraw a consent you gave;
  • object to direct marketing at any time; every marketing email we send tells you how (section 69);
  • complain to the Information Regulator (section 74).

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to the supervisory authority where you live or work.

To use a right, write to admin@adiabat.co.za with “Privacy” in the subject. We may ask you to confirm who you are. We reply within 30 days. A request for access to a record may also be made under the Promotion of Access to Information Act, 2000, as our PAIA manual explains.

10. Cookies

This website sets no cookies.

The app sets three cookies, all strictly necessary to run it, and none for advertising or tracking:

  • ds_session keeps you signed in. It ends after 12 hours, or after two hours unused.
  • ds_csrf protects the app’s forms against cross-site request forgery.
  • ds_sign_in protects the sign-in step and lasts ten minutes.

Auth0 sets its own cookies on its sign-in pages to sign you in.

11. Children

DraftSolver is for professionals, researchers and university students. We do not knowingly collect personal information of children, who under POPIA are people under 18. If you believe we have, write to us and we will delete it.

12. Changes to this policy

We publish every change on this page with a new date. If a change is material, we tell account holders by email before it takes effect. Until DraftSolver opens, this policy applies to this website and its request form; it applies to the app from the day it opens.

13. Contact and complaints

Write to our Information Officer at admin@adiabat.co.za. If you are not satisfied with our answer, you may complain to the Information Regulator of South Africa: