POPIA Information

1. Overview & Responsible Party

In terms of the Protection of Personal Information Act 4 of 2013 (POPIA), ThreadNode is registered as a Responsible Party. This statutory disclosure outlines how personal data and Special Personal Information (including Fit Profile measurements) are processed lawfully, minimally, and transparently.

2. The 8 Conditions for Lawful Processing

ThreadNode adheres to the eight statutory core principles established under Chapter 3 of POPIA:

• 1. Accountability: We ensure that all processing measures conform fully to statutory POPIA requirements from ingestion to deletion.
• 2. Processing Limitation: Data is collected only with informed consent and processed directly for wardrobe organization and virtual fitting.
• 3. Purpose Specification: Data is gathered exclusively for explicit, defined fashion styling functions and is never repurposed without notice.
• 4. Further Processing Limitation: We never sell, lease, or conduct secondary exploitation on your private measurements or photos.
• 5. Information Quality: Users have continuous real-time tools inside their profile to correct and maintain accurate wardrobe records.
• 6. Openness: Transparent privacy notifications, terms of service, and direct access to our Information Officer.
• 7. Security Safeguards: AES-256 database encryption, Row Level Security (RLS), and zero unencrypted raw photo persistence.
• 8. Data Subject Participation: Free and uninhibited access to request data exports, corrections, or total account destruction.

3. Special Personal Information & Measurements

Under Section 26 of POPIA, biometric information constitutes Special Personal Information. ThreadNode adheres to strict protective standards:

• Zero Raw Biometrics Retention: We do not store raw photographs or facial templates in public storage buckets.
• Derived Mathematical Scalars: Fit Profile measurements (e.g., chest, waist, height) are converted into numerical scalars used purely for sizing and proportion simulation.
• Ephemeral Ingestion: Temporary upload links expire within 15 minutes and all intermediate image caches are automatically wiped.

4. Exercising Your Section 23 & 24 Rights

As a data subject in South Africa, you have the statutory right to:

• Section 23 (Right of Access): Request confirmation of what personal information we hold, along with a free digital copy of your data records.
• Section 24 (Right of Correction or Deletion): Request the correction, completion, or total destruction of records that are inaccurate, irrelevant, or obsolete.

You can trigger an automated data export or permanent account wipe directly from the app's Profile Settings, or by emailing our Information Officer with the subject line "POPIA Section 23/24 Request".

5. Transborder Information Flows (Section 72)

Where image processing requires high-performance cloud servers located outside South Africa, ThreadNode ensures that international cloud partners operate under data protection agreements providing equivalent or superior privacy standards to POPIA.

6. Regulatory Complaints

If you believe that your personal data has been handled in breach of POPIA, you have the right to lodge a formal complaint with the Information Regulator of South Africa: