Privacy

Virda is a South African business providing NFC tags and the software behind them. For anything on this page, including a request to see or delete your information, write to hello@virda.online.

There are two different relationships here, and they matter for what follows. Our customers are businesses who use Virda tags. The public are the people who tap those tags — a homeowner at their geyser, a guest in a rental, a technician on site.

When you tap a customer's tag, that customer decides what is asked of you and what happens to it. Virda provides and runs the system on their behalf. In data-protection terms they are the responsible party and we are the operator.

You do not need an account, and you are not asked to make one. We record:

• That a tag was tapped — which tag, when, and the browser and device type your phone reports. This is how a customer knows their tags are being used.
• Anything you deliberately send — if you fill in a fault report, a form or attach a photograph, we store what you typed and the file you chose, along with your name and contact details if you gave them. Those two fields are optional on every form.

What you send goes to the business whose tag you tapped. They may email themselves a copy of it. It is not sold, shared with advertisers, or used to build a profile of you.

To run your account we hold:

• Your email address and name, and a securely hashed password. We never see your password.
• Your workspace settings — business name, logo, where alerts should go.
• Everything you configure on your tags: names, information, actions, floor plans you upload, and the service records you build up.
• Everything the public sends to your tags, so you can read and act on it.

We create customer accounts ourselves; there is no public sign-up. If you did not ask us for an account, you do not have one.

The enquiry form on our home page sends us your name, email, and whatever else you chose to type. We use it to reply to you and to keep track of the conversation. It is not added to a mailing list and you will not receive marketing you did not ask for. As with tag submissions, your IP address is hashed for rate limiting and never stored in full.

Our database, file storage and authentication run on Supabase, hosted in Amazon Web Services' eu-west-1 region in Ireland. This means information collected in South Africa is stored outside the country. Ireland is subject to the EU General Data Protection Regulation, which provides protection comparable to POPIA.

Transactional email — alerts about a new fault report, sign-in links — is sent through Resend. The website itself is served from our hosting provider.

These three are the only outside parties who process information on our behalf. We do not use advertising networks or data brokers.

• A business sees its own data and nothing else. This is enforced by the database itself, not merely by the interface, so one customer cannot reach another's information even by crafting a request.
• The public sees only what a customer has published. Every piece of a tag's page is marked public or internal. Submissions sent to a tag are never readable by other members of the public — not even by the person who sent them.
• Virda staff can access customer accounts for support. We are telling you this rather than leaving it in the small print: to fix a tag that is not working, we can see a customer's tags and what has been sent to them. We do this to answer support requests, not routinely.

Virda uses no analytics, no advertising pixels and no tracking cookies. Not Google Analytics, not Meta, not anything else. The public scan pages set nothing at all.

When a customer signs in, their browser stores a session so they stay signed in. That is the only thing kept in your browser, and signing out removes it.

Tag submissions and service records are kept for as long as the customer's account is open, because their usefulness is precisely that they accumulate. A customer can delete any individual submission, photograph or record entry at any time, and can ask us to delete their account and everything in it.

Enquiries sent to us through this website are kept while we are in contact and for a reasonable period afterwards.

Under POPIA, and under GDPR where it applies, you may ask what information is held about you, ask for it to be corrected, ask for it to be deleted, and object to how it is being used. You may also complain to the Information Regulator of South Africa.

If you tapped a business's tag and want something you sent removed, the fastest route is to ask that business directly, since it is theirs. If you cannot reach them, write to us and we will help.

Virda is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 18.

If this page changes in a way that materially affects our customers, we will tell them rather than quietly updating the date at the top. Related: our terms.