Privacy
policy

We believe in transparency. This policy explains exactly what data we collect, how we use it, and the rights you have over your information.

Last updated: September 6, 2026

1. Who We Are

Logable is an IoT monitoring and telemetry platform operated by TipThing (Pty) Ltd, a company registered in South Africa under registration number 2025/400138/07.

We provide tools that allow you to connect devices, visualize real-time data on customizable dashboards, configure automated alerts, and manage multi-tenant organizations.

Information Officer (POPIA)

Email: privacy@logable.app

Address: Pretoria, South Africa

2. Information We Collect

2.1 Account Information (provided by you)

Full name (required for account creation)
Email address (required, used for login and notifications)
Username (optional)
Profile image URL (optional)
Company name (via contact form, optional)
Password (hashed using industry-standard algorithms, never stored in plaintext)

2.2 Device and Telemetry Data (provided by your devices)

Device metadata: name, type, description, physical location, serial number
Device configuration: capacity settings, units, custom metadata
Telemetry metrics: JSON key-value pairs (e.g., temperature, pressure, fill level). The specific data depends entirely on what you configure your devices to send.
Device status: online, offline, or error state with timestamps
Data streams: named data channels with typed field schemas and JSON event payloads

2.3 Organization Data (provided by team administrators)

Organization name and logo
Team member email addresses (via invitations)
Member roles (owner, admin, member)
Organization settings and limits

2.4 Data Collected Automatically

IP address (stored with auth sessions for security)
Browser user agent (stored with auth sessions)
Session tokens (encrypted, httpOnly cookies)
Sidebar preference cookie (sidebar_state, 7-day expiry, UI preference only)
Organization branding cookie (logable.branding, session expiry, appearance only; see section 6.2)

2.5 Payment Information

When you subscribe, your card details are entered on Paddle's hosted checkout and never reach Logable. Paddle.com Market Ltd is the merchant of record for card payments. They hold your card details, your billing address and the tax information required for the sale. We receive the outcome of each payment, the invoice amounts and the last four digits of the card, and nothing else.

2.6 Product Analytics

We record how the product is used so we can see where people get stuck. These records carry identifiers and settings only, never your name, email address or device serial numbers. We store them in our own database and mirror them to PostHog Inc, on their European Union cloud. Analytics respect your browser's Do Not Track setting, and we never load third-party advertising trackers. These analytics set no cookie and no local storage: the identifier lives only in memory for as long as the page is open.

2.7 Data We Do NOT Collect

We do not use error tracking services (no Sentry, Bugsnag, etc.)
We do not use advertising pixels or tracking cookies
We do not collect browsing behavior, heatmaps, or session recordings
We do not store your payment card details. They are entered directly on Paddle's hosted checkout and never reach us (see Payment Information above)
We do not collect geolocation data from your browser
We do not use fingerprinting or cross-site tracking

3. How We Use Your Information

3.1 Account Management

To create and manage your account, authenticate you, and communicate with you about your account.

3.2 Service Delivery

To receive, store, process, and display your device telemetry data on dashboards and charts.

3.3 Alerts and Notifications

To evaluate trigger conditions against your device metrics and send alerts via email and web inbox when thresholds are exceeded or device status changes.

3.4 Real-Time Streaming

To deliver live device metrics and status updates to your dashboard via Server-Sent Events (SSE).

3.5 Organization Management

To manage multi-tenant workspaces, team invitations, role-based access, and organizational settings.

3.6 Security

To protect your account via two-factor authentication (TOTP), passkeys (WebAuthn), rate limiting, and audit logging of authentication events.

3.7 Communication

To send transactional emails (verification, password reset, OTP codes, team invitations, alert notifications).

3.8 Service Improvement

We record product events against your user id and organization id to see which features are used and where onboarding stalls. No email address, name or free text is attached to these events. There is no session recording, and analytics respect your browser's Do Not Track setting.

Legal Basis (GDPR)

Contract performance: account management, service delivery, alerts, streaming, organization management
Legitimate interests: security, service improvement (with balancing test: minimal data, high security benefit)
Consent: marketing communications (if ever introduced)
Legal obligation: responding to lawful requests, audit logs

4.1 Third-Party Service Providers (Sub-Processors)

Operator	Purpose	Data Shared	Location
Paddle	Payment processing	Payment outcome, invoice amounts, last four card digits	United Kingdom and European Union
PostHog EU	Product analytics	User id, organization id, product usage events	European Union
Amazon Web Services SES	Email delivery	Recipient email, notification content	Ireland
Cloudflare R2	File storage	Organization branding assets, generated report files	Cloudflare global network (region not pinned)
Hetzner	Infrastructure hosting	All data (encrypted at rest)	Germany

We do not sell, rent, or trade your personal information.

4.2 Within Your Organization

If you belong to an organization, other members with appropriate roles can see devices, dashboards, streams, and alerts owned by that organization. They cannot see your personal devices or account credentials.

4.3 Legal Requirements

We may disclose information if required by law, court order, or government request. We will notify you before disclosure unless legally prohibited from doing so.

4.4 Business Transfers

If TipThing (Pty) Ltd is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is subject to a different privacy policy.

5. Data Retention

If your subscription ends, whether the trial expires, a payment fails after every retry, or you cancel, your organization becomes read-only after your access ends. Your dashboards, alerts and history stay visible, but ingestion stops 14 days later, so new readings are no longer stored. The organization and all its data are deleted 90 days after your access ends. We email you 30 days, 7 days and 1 day before that happens. Subscribing again at any point before the deletion restores everything.

6. Cookies and Local Storage

6.1 Essential Cookies

Session cookie (auth): Contains encrypted session token. HttpOnly, Secure, SameSite=Lax. Expires after 7 days. Required for authentication.

6.2 Functional Cookies

sidebar_state: Stores sidebar open/closed preference. 7-day expiry. Not transmitted to any server.
logable.branding: Stores your organization's branding so the application renders in its colours and logo immediately, without an unstyled flash on first paint. Contains the brand colour, neutral tint, corner radius, logo URLs, display name and your organization's identifier. Readable by scripts on this site by design, because the page must apply it before it renders. Expires with your session (7 days) and is removed when you sign out or when branding is switched off. It contains no personal information: no name, email or user identifier.
logable_currency: Stores your chosen pricing currency, set from the currency selector in the site footer, on any page, before you ever sign in. Read by our server to route you to the matching priced page. Contains a currency code only, nothing that identifies you. Expires after one year.

6.3 Analytics (no cookie)

Product analytics set no cookie and no local storage. The analytics identifier lives only in memory for as long as the page is open, and it is gone when you close the tab. We honour your browser's Do Not Track setting.

6.4 Local Storage (browser-only, never sent to us)

activeOrganizationId: Your currently selected organization. Cleared when you sign out.
dashboard-view-mode: Grid or table view preference. Cleared when you sign out.
Form draft data: Temporarily saves form inputs to prevent data loss. Cleared when you sign out.
theme: Your light or dark appearance choice. Set on any page, including before you sign in, and kept until you change it.
content-tabs:<group>: Which tab you last opened in a documentation code sample, so the same choice is shown next time. Kept until you change it.

6.5 Session Storage (cleared when tab closes)

Temporary email addresses during password reset and OTP verification flows

We do not use advertising cookies or third-party tracking cookies. Our product analytics (section 2.6) respect your browser's Do Not Track setting.

6.6 Google Fonts

We use Plus Jakarta Sans and Geist Mono fonts. These are self-hosted by our application via Next.js, so no requests are made to Google's servers, and Google does not receive any data about your visits.

7. International Data Transfers

Your data is stored on Hetzner servers in the European Union. TipThing (Pty) Ltd is based in South Africa.

For EU/EEA Users

South Africa does not have an EU adequacy decision. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard your data when it is accessed from South Africa for platform administration purposes.

For South African Users

Your data is processed in the EU, which provides data protection standards that are substantially similar to or exceed POPIA requirements.

We do not transfer your data to any country outside the United Kingdom, the European Union and South Africa, with one exception: object storage, the uploaded and generated files described in section 4, is held on Cloudflare's global network, which does not pin data to a single region today. We rely on section 72 of the Protection of Personal Information Act for this transfer too.

Paddle and PostHog process personal information outside South Africa. We rely on section 72 of the Protection of Personal Information Act: both are bound by contract to a level of protection that upholds principles substantially similar to POPIA, and both operate under the European Union's General Data Protection Regulation.

8. Data Security

We implement the following security measures:

Encryption in transit: All data transmitted via HTTPS/TLS. MQTT connections support TLS encryption.
Password hashing: Passwords are hashed using industry-standard algorithms and never stored in plaintext. Passwords are redacted from all logs.
Authentication: JWT-based access tokens (15-minute expiry), session tokens with automatic refresh, two-factor authentication (TOTP), passkeys (WebAuthn), email OTP.
Rate limiting: Global rate limiting (100 requests/minute), stricter limits on authentication endpoints (5 requests/minute), per-device ingestion limits.
Access control: Role-based access control at organization and system levels. Strict data isolation between tenants.
Input validation: All API inputs are validated and sanitized. Unknown fields are rejected.
Audit logging: Authentication events, data access, and administrative actions are logged with IP address and user agent.
Session security: Sessions expire after 7 days. Users can revoke individual sessions or all other sessions.
Token security: Device and stream authentication tokens are generated using cryptographic random bytes and are never exposed in list API responses.

9. Your Rights

9.1 Under POPIA (South Africa)

Right to be notified of data collection
Right to access your personal information
Right to request correction or deletion
Right to object to processing
Right to data portability
Right to lodge a complaint with the Information Regulator (inforegulator.org.za)

9.2 Under GDPR (EU/EEA)

Right to access (Article 15)
Right to rectification (Article 16)
Right to erasure / right to be forgotten (Article 17)
Right to restrict processing (Article 18)
Right to data portability (Article 20): export your device metrics as CSV or JSON
Right to object (Article 21)
Right not to be subject to automated decision-making (Article 22)
Right to lodge a complaint with your local supervisory authority

9.3 Under CCPA/CPRA (California)

Right to know what personal information is collected
Right to delete personal information
Right to opt-out of the sale of personal information (we do not sell your data)
Right to non-discrimination for exercising your rights

How to exercise your rights

Email privacy@logable.app. We will respond within 30 days. You can also delete your account, devices, streams, and organizations directly through the platform. Account deletion cascades to remove all associated data including sessions, tokens, memberships, and invitations.

10. Children's Privacy

Logable is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@logable.app.

11. Automated Decision-Making

Logable uses automated processing for the following purposes:

Alert triggers: Automated evaluation of device metrics against user-configured thresholds and conditions. These trigger notifications but do not make decisions about your account or access.
Rate limiting: Automated enforcement of API request limits for security purposes.
Session management: Automatic session expiry and refresh.

None of these automated processes make decisions that produce legal effects or similarly significantly affect you. All alert conditions are configured by you and can be modified or disabled at any time.

12. Data Breach Notification

In the event of a data breach that affects your personal information:

We will notify the South African Information Regulator within 72 hours of becoming aware of the breach.
We will notify affected users as soon as reasonably possible, including: what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
For EU users, we will also notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.

13. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes:

We will update the "Last updated" date at the top of this page.
We will notify you via email or an in-app notification for significant changes.
Continued use of Logable after the effective date constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

14. Contact Us

Information Officer / Data Protection Contact

TipThing (Pty) Ltd (trading as Logable)

Registration: 2025/400138/07

Pretoria, South Africa