§ I — Security & privacy, stated plainly —

Your members'
data, and what
protects it.

our members trust you with their ID numbers, photographs and signatures. Kultiflo's database and file storage run on Google's infrastructure, which encrypts that data in transit and at rest. This page sets out what protects it today, and says plainly where club separation stands.

See where it stands

Built on Google Cloud.
POPIA-aligned by design.

— What that protection rests on —
01Firebase sign-in
for every account
02AES-256 at rest
on Google Cloud
03Google Cloud,
ISO 27001
04No card numbers
held by Kultiflo
§ II — Where club separation stands —

Many clubs, one platform.
Not yet isolated — said plainly.

Each club's memberships, sales, stock and settlements are recorded against that club, and the apps are organised around the club you are signed in to. Kultiflo does not yet enforce that separation throughout the database, and some flows in the apps still reach across clubs. Until both are fixed, we don't claim that one club's data is isolated from another's — and this page will say so when they are.

§ III — Where the data lives, and how it's locked —

Built on the infrastructure
that runs Google.

Kultiflo runs on Google Cloud — Firebase and Firestore — the same platform behind Google Workspace, with automatic redundancy and failover across multiple data centres. We don't run our own servers, and we don't ask you to trust ours.

N° 01

Google Cloud, independently certified.

Your members' data sits in Google Cloud, which is independently audited and certified against the standards below. These certifications are held by Google Cloud as Kultiflo's infrastructure provider — the same security posture that protects billions of users worldwide.

SOC 2 ISO 27001 ISO 27017 ISO 27018 Held by Google Cloud, Kultiflo's infrastructure provider — not by Kultiflo itself.
Held by Google
Cloud
N° 02

Encrypted in transit
and at rest.

Every connection between the apps and the backend travels over TLS 1.2+ (HTTPS) — the same standard that protects online banking. Data stored on Google Cloud is encrypted at rest with AES-256, with keys managed by Google's Key Management Service and held separately from the data they unlock.

In transit TLS 1.2+

At rest AES-256
§ IV — Who can get in —

Who signs in,
and what gets recorded.

Identity is verified by Firebase Authentication, not a home-grown login, and the apps are built around the role each person holds in their club.

N° 01

Verified sign-in through Firebase.

Members and staff sign in through Firebase Authentication — Google's identity service, not a home-grown login — so the password each person signs in with is checked by Google.

Avoids home-grown
login flaws
N° 02

Roles, and a record.

Each person works in a role — club owner, admin, POS operator, farmer — and the apps show each role the screens its work needs. POS voids, stock removals and settlement payments are each written to an audit trail that records who did what, and when.

Records who did
what, and when
§ V — Lines we don't cross —

What we never do.

Some protections are technical. These are commitments.

  • We never sell your members' data.
  • We never use it for advertising.
  • We never train AI models on it.
  • We never open your data out of curiosity.
§ VI — What the data subject is owed —

The data belongs to
your members.

POPIA gives every member rights over their personal information. Kultiflo is built to honour them — not to hold data hostage.

N° 01

Consent, recorded at registration.

When a member registers, four consents are recorded against their profile — terms, privacy, data processing, and (optionally) marketing. The registration screen links each one to the notice it refers to.

POPIA lawful
processing
N° 02

Access, correction, deletion.

Members may ask to see, correct, or delete the personal information held about them, and those requests are honoured under POPIA. Deletion is handled on request through your club — not buried behind a form designed to make you give up.

POPIA data-subject
rights
N° 03

Restricted internal access.

Within Kultiflo, production data is reached only by approved staff — super administrators running club approvals, accounts and billing, and engineers fixing faults, whether reported by a club or flagged by the apps' automated error reports. The system is built so that we rarely need to look at a member's data at all.

Internal access,
approved staff
§ VII — Still have a question —

Bring us your hardest
data-protection question.

POPIA-aligned Google Cloud Encrypted Stated plainly

On candourWe'd rather show you how the system is built than quote a track record. Kultiflo is young — our case for your trust is the architecture on this page, and every layer of it reflects how the apps actually work. If something here matters to your members, ask us to walk you through it.

Email our team → Read the full Privacy & POPIA policy →