Privacy Policy

RasWorx Systems (Pty) Ltd is the responsible party for the personal information processed through Bakelytics, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Privacy questions and requests go to the Information Officer at bakelytics@rasworx.com.

Legal name

RasWorx Systems (Pty) Ltd

Legal status

Private company registered in the Republic of South Africa

Company registration number

2026/535657/07

Physical address

Gardenia Park, Bloemfontein, Free State, 9301, South Africa

Telephone

+27 61 324 1058

Email

bakelytics@rasworx.com

Website

bakelytics.rasworx.com

VAT

Not registered for VAT. No VAT is charged and prices are final amounts.

Account information. Your email address, and a password that is stored only as a cryptographic hash — we never see or hold the password itself. If you choose to sign in with Google instead, we receive the email address on that Google account and an account identifier, and nothing else from it.

Business information.The name of your business, your role in it, and the operational records you enter: suppliers, purchases, ingredient prices, stock lots, recipes, production sessions, weights and yields, and the costs and margins computed from them. Most of this is business data rather than personal information, but a sole trader’s business is often identifiable, so we treat it with the same care.

Notification information. If you switch on push notifications, your browser gives us a subscription address, two encryption keys, and a description of the browser and device, so that a notification can be delivered and so you can recognise which device to switch off later.

Technical information. Server and security logs kept by our hosting providers, which include IP addresses and request details, and are used to keep the service running and to investigate abuse.

If you try the demo. The demo bakery is a private copy of a fictional business: its suppliers, recipes and figures are invented and describe no real person or company. You do not give an email address or password. The demo signs you in anonymously, which creates an anonymous identifier, a copy of the fictional business, and whatever you change inside it. Please do not type real personal or business information into a demo.

The bot check. To keep automated sign-ups out, the demo entry and the sign-in, sign-up and password reset pages ask your browser to pass a bot check run by Cloudflare. Cloudflare sees your IP address and browser details and may keep a small amount of data in your browser for the check. We use it only to tell people from automated requests.

What we do not collect. We do not use advertising or analytics tracking, we do not build behavioural profiles, and we do not run automated decision-making that produces a legal effect for you. We never receive your card number: payment details are entered with our payment provider, not with us.

• To give you the service you subscribed to — creating your account, keeping your records, and computing your costs and margins. This is processing necessary to perform our contract with you.
• To take payment and keep the account in good standing, through our payment provider. Also contractual.
• To send you transactional messages: email confirmation, password reset, billing notices, and service announcements that affect you. Contractual, and in our legitimate interest in operating the service.
• To send push notifications you have explicitly switched on. Consent, which you can withdraw at any time in your browser or by asking us.
• To keep the service secure and investigate misuse. Our legitimate interest in protecting the service and its customers.
• To meet legal obligations, such as retaining records we are required by law to keep.

We do not send marketing email unless you ask for it, and there is no marketing list to be added to by using the product.

We use a small number of operators, each processing your information only to provide their part of the service and under their own obligations of confidentiality:

• Supabase — database, authentication and the transactional emails the sign-up and password-reset flows send.
• Vercel — application hosting and delivery.
• Payfast by Network (Pty) Ltd — subscription payments. Card details are given to the payment provider directly and are never held by us.
• Your browser vendor’s push service — only if you switch push notifications on. A notification is routed through the push service run by the maker of your browser (for example Google, Mozilla or Apple), which sees the delivery address but not your account records.

We do not sell your information, and we do not share it for anyone else’s marketing. We disclose it outside this list only where the law requires it, or where it is necessary to establish or defend a legal claim.

Our hosting and payment providers operate internationally, so your information may be stored or processed outside South Africa. Where that happens we rely on the transfer conditions in section 72 of POPIA, which require the recipient to be bound by protections substantially similar to those in the Act.

Bakelytics sets only the cookies it needs to work. They hold your signed-in session so that you are not asked to log in on every page, and they carry the security tokens that protect a request from being forged. There are no advertising cookies, no analytics cookies and no third-party trackers, so there is no consent banner to click through.

Blocking these cookies in your browser will stop you from staying signed in. If you install Bakelytics to your phone’s home screen, it stores the same session locally on the device, and signing out clears it.

For as long as the business exists. The records behind a cost — the purchases, the stock movements, the production sessions and the cost snapshots derived from them — are what make a figure auditable. A cost whose evidence has been aged out is a number nobody can check, so we do not trim them on a timer. They belong to the business, not to your sign-in, and how long they live is decided by which of the three ways of closing you choose.

If you leave the business,your sign-in and your personal information are deleted, and the business’s own records stay. With nobody left in it the business becomes dormant: nothing can sign in to it, and it is reachable only by an operator of ours. It is not visible to anyone else and it cannot be reopened from the product.

If you hand the business to somebody else, the records stay and carry on under them; your own sign-in and personal information are deleted as above.

If you delete the business, the business and every record beneath it are deleted along with your account — the purchases, the stock movements, the production sessions, the cost snapshots and the audit history. This one cannot be undone, so export first if you want to keep anything.

A push subscription is deleted when you switch notifications off, when you close your account by any of the three routes, or when the push service tells us the subscription no longer exists. A subscription that has received nothing for 180 days is treated as a browser that is gone and is deleted by a nightly job.

Two technical records are trimmed on a timer. The ledger that stops a retried request from being applied twice is kept for 90 days and then deleted nightly; it carries no cost and no business figure, only the fact that a request was seen. The push subscriptions above are the other.

A demo is deleted after 24 hours.The demo bakery, the anonymous identifier behind it and everything you changed in it are deleted by a scheduled job once they are more than 24 hours old, or sooner if you use “Start over” or sign out of the demo. Nothing from a demo is added to any customer’s records. A short log line may remain with a random identifier to record that a demo was removed; it holds no name, email address or business figure.

After deletion, copies may persist for a time in our hosting providers’ backups, for those providers’ own retention periods, and we may keep the minimum needed to meet a legal obligation or to resolve a dispute.

• All traffic between your browser and the service is encrypted in transit, and data is encrypted at rest by our hosting provider.
• Passwords are stored as hashes, never in a readable form.
• Every table carrying business data is protected by database-level row security, so one business’s records cannot be read from another’s session. This is enforced in the database itself rather than only in the application, and it is covered by an automated test suite.
• Access to production systems is limited to those who need it to operate the service.

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

Two of these you do not have to ask for: the export and the account closure are both on the account page inside the product, and neither needs us. The rest go to the address below. Under POPIA you may ask us to:

• tell you what personal information we hold about you, and give you a copy of it;
• correct anything that is inaccurate or incomplete;
• delete information we no longer have a lawful reason to keep, and close your account — you can do this yourself on the account page, where the three ways of closing are set out with what each one keeps and what it removes;
• give you an export of your business records in a usable file — this too is self-service on the account page, and downloads immediately as a single file;
• stop processing that relies on our legitimate interest, where you object to it;
• withdraw a consent you have given, such as push notifications — which does not affect anything done before you withdrew it.

Write to bakelytics@rasworx.com. We acknowledge within 2 business days and answer within 30 days. We may need to confirm who you are before acting on a request, so that nobody else can make it in your name. Exercising these rights is free unless a request is repetitive or excessive.

Raise it with us first at bakelytics@rasworx.com — most things are settled faster that way. If you are not satisfied, you may complain to the Information Regulator (South Africa), whose details are published at inforegulator.org.za.

Bakelytics is a business tool sold to adults. It is not directed at children and we do not knowingly collect the personal information of anyone under 18. If you believe a child has given us information, tell us and we will delete it.

We may update this policy. The effective date at the top of the page always reflects the current version, and we will tell you by email before a change that materially affects your rights takes effect. This policy should be read with the Terms and Conditions, the Delivery Policy and the Refund and Cancellation Policy.