Legal
Privacy policy
Last updated 11 November 2026
This policy explains what personal information HelioFleet collects, why, who we share it with and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
HelioFleet is run by NCloud Ltd, registration number 2021/340237/07, 85 Cattle Egret Road, Centurion, Gauteng, 0157.
Our Information Officer is Jacques Tredoux. Contact them at privacy@heliofleet.co.za about anything in this policy.
2. Our two roles
- We are the responsible party for information about the installers who hold HelioFleet accounts, their staff, and visitors to our website. We decide why and how that information is used.
- We are an operator for information about an installer's customers and their solar systems. The installer decides why that information is processed and is the responsible party for it. If you are an installer's customer, your installer is your first point of contact; we will help them answer your requests.
3. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, phone number, company name, role | You, when you sign up or are invited |
| Billing details | Company registration and VAT numbers, billing contact, invoices and payments | You |
| Customer and site details | Customer name and email, site name, street address and GPS location | The installer |
| Inverter brand logins | Usernames, passwords, access tokens and API keys for brand platforms | The installer |
| System data | Inverter models and serial numbers, solar, battery, load and grid readings, faults | Inverter brand platforms |
| Camera feeds | Stream details for site cameras, if the installer connects them | The installer |
| Usage and technical data | IP address, browser and device, sign-in times, error logs | Your device, automatically |
| Messages | Support emails and what you tell us in them | You |
We do not knowingly collect special personal information, such as health or religious information, or information about children. HelioFleet is meant for adults.
You do not have to give us your information, but without account and billing details we cannot provide HelioFleet, and without brand logins we cannot show your sites.
4. Why we use it
| Purpose | Lawful basis under POPIA (section 11) |
|---|---|
| Providing HelioFleet: showing sites, raising alerts, creating and emailing reports | Performing our contract with the installer |
| Billing and keeping financial records | Contract, and complying with tax and company law |
| Support and service emails, such as alerts, invites and notices of changes | Contract and legitimate interest |
| AI analysis of a site's readings, when an installer asks for it | Performing our contract with the installer |
| Keeping HelioFleet secure, preventing fraud and fixing errors | Legitimate interest |
| Improving HelioFleet using combined data that does not identify anyone | Legitimate interest |
| Product news and offers to installers | Consent, or as an existing customer under section 69; you can opt out at any time |
5. Who we share it with
We never sell personal information. We share it only with:
- The installer who manages your site, and the customers they invite, each seeing only what their role allows;
- Inverter brand platforms (such as Victron, Sunsynk, Deye and WatchPower), which receive the brand logins when we sign in to read your sites' data;
- Our cloud hosting provider, which runs our servers and databases;
- Our email delivery provider, which sends invites, alerts and reports;
- Google, whose Maps service suggests addresses when sites are added;
- Anthropic, whose Claude AI analyses a site's readings when an installer presses "Analyse with AI". We send only the system's readings, equipment details, alerts and a location rounded to about 10 km, never customer names, contact details or street addresses. Anthropic does not use this data to train its models;
- Professional advisers, such as our auditors and lawyers, under a duty of confidentiality;
- Authorities, where the law requires it.
Our service providers may only use the information to provide their service to us and must keep it secure.
6. Information sent outside South Africa
Some of the providers above, including inverter brand platforms, Google and Anthropic (in the United States), store or process information outside South Africa. We only send information abroad as section 72 of POPIA allows: where the recipient is bound by law, binding rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you.
7. How we protect it
- Data travels over encrypted connections (HTTPS).
- Inverter brand logins are encrypted at rest and only used by our servers.
- Passwords are stored as one-way hashes, and weak or common passwords are refused.
- Access is limited by role, so customers only see their own sites and installers only see their own fleet.
- Our staff only access customer data when needed to provide support.
If we believe personal information has been accessed or acquired by someone who should not have it, we will notify the Information Regulator and the people affected as required by section 22 of POPIA, or, where we are the operator, tell the installer straight away so they can do so.
8. How long we keep it
| Information | How long |
|---|---|
| Detailed live readings | 365 days |
| Raw responses from brand platforms, kept for troubleshooting | 14 days |
| Monthly reports and account information | While the account is active |
| Data in a closed account | Available for export for 30 days, then deleted within 90 days |
| Invoices and financial records | 5 years, or longer where tax or company law requires |
| Backups | Overwritten in their normal cycle |
9. Your rights
Under POPIA you can:
- ask whether we hold information about you and for a copy of it (see our PAIA manual);
- ask us to correct or delete information that is wrong, out of date, excessive or unlawfully held;
- object to processing based on our legitimate interests;
- withdraw consent you have given, and opt out of marketing at any time using the link in our emails;
- complain to the Information Regulator.
To use these rights, email privacy@heliofleet.co.za. We may ask you to prove who you are first. If you are an installer's customer, we will pass your request to your installer and help them answer it.
10. Cookies and local storage
HelioFleet does not use advertising or tracking cookies. Your browser stores your sign-in session so you stay signed in, and your light or dark mode choice. Google Maps may set its own cookies when the address search is used.
11. Changes to this policy
We will post any changes here and update the date at the top. We will email account owners about important changes.
12. Complaints
Please contact our Information Officer first so we can try to put things right. You can also complain to the Information Regulator:
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Email: enquiries@inforegulator.org.za
- Phone: 010 023 5200
- Website: https://inforegulator.org.za