Privacy notice

Who we are

Cambrian is a web-form submission platform operated by Matogen, a company incorporated in the Republic of South Africa. Throughout this notice, "we", "us" and "our" mean Cambrian.

What information we collect

We collect three categories of information:

• Account information — your name, email address, team name and authentication details when you sign up for Cambrian.
• Form submissions our customers receive — when you submit a form built by one of our customers, that submission is processed and stored by Cambrian on the customer's behalf. Under POPIA we act as the operator, and our customer (the form owner) is the responsible party. Questions about how your submission is used should be directed to the form owner in the first instance.
• Analytics cookies — only if you opt in via the cookie banner. If you decline, no analytics scripts are loaded.

How we use it

• To operate the platform — authenticating you, displaying your forms, delivering submissions to form owners.
• To send you account-related emails — verification, password resets, billing notices, important service announcements.
• To understand aggregate usage via analytics, only where you have consented.

Who we share it with

We only share data with the essential processors needed to run the service:

• Resend — outbound transactional email.
• Google Cloud — OAuth sign-in and Google Sheets sync for customers who enable it.
• PayFast — payment processing for paid plans.
• Cloudflare — CDN and DDoS protection.
• Xneelo — South African hosting infrastructure.

We do not sell personal information.

How long we keep it

• Account information — while your account is active, plus 90 days after closure to allow for recovery and to meet our record-keeping obligations.
• Form submissions — for the retention period set by the form owner. The form owner controls deletion.
• Application and access logs — 30 days, then automatically purged.

Your rights under POPIA

As a data subject under the Protection of Personal Information Act, 2013, you have the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information, subject to legal retention requirements;
• lodge a complaint with the Information Regulator at inforegulator.org.za.

For submissions you made through a Cambrian-hosted form, you can use the subject-access link the form owner provided to view and delete your submission directly.

How to contact us

Privacy questions, requests or complaints can be sent to [email protected]. We aim to respond within 30 days.