Skip to content
Crypti

Privacy policy

Version 2026-11-06 · Last updated 6 November 2026

This policy explains what personal information Crypti (Pty) Ltd collects when you use this site and AppSmith (appsmith.crypti.co.za) — First Pass, your AppSmith account and your team, your projects and their documents, sign-offs, invoices and payments, and the calls you book with us — why we collect it, the lawful basis we rely on, how long we keep it, who else handles it, and how you delete it. It is written to meet our obligations under South Africa's Protection of Personal Information Act, 4 of 2013 ("POPIA").

The short version

  • We keep your First Pass results indefinitely, so you can come back to a scoping brief and so whoever takes your call has the full picture.
  • You can delete a scoping result, or close your account, whenever you like.
  • Once your business works with us, some records are business records we have to keep — invoices, payments and specification sign-offs among them — even after you close your account.
  • First Pass uses Anthropic's Claude to score your project and draft your scoping brief. Anthropic processes it in the United States and does not train its models on it.
  • We do not sell your information. We use Google Analytics only if you say yes when we ask, and never for advertising.

Who is responsible

Crypti (Pty) Ltd is the responsible party for the personal information described here. Our Information Officer can be reached at [email protected].

What we collect, and when

When you run First Pass

You do not need an account to run First Pass, and we keep what follows whether or not you go on to unlock your scoping brief.

  • Your description and answers — the way in you chose, what you wrote about your project and your answers to its questions. Before we store them or send them to the AI, we strip out email addresses, phone numbers, South African ID numbers and card numbers. The stripping catches the usual formats, not everything, so please leave those details out in the first place.
  • What First Pass makes of it — how your project was classified (for example its industry), the scores and the reasons for them, the verdict, and your scoping brief. For build and automate verdicts we also write an internal engineering document once the scoping brief is in an AppSmith account; that one is for Crypti only.
  • A record of how it was made — when each step happened, which versions of our instructions and settings were used, which AI model ran, and what it cost.
  • Technical information — a one-way hash of your IP address, used only to limit how often First Pass can be run and to stop abuse, and the result of a check that you are a person rather than a bot (run by Cloudflare Turnstile). If you arrived from a Google ad, the ad click identifier (the "gclid") in the link, used only to tell which ads bring people in.

The hourly rate you type into the savings box on an automate brief never leaves your browser. The figure is worked out on your device and we never see it.

When you unlock your scoping brief or register

  • Your details — first name, surname, business name and email address.
  • Your acceptance of our terms — which version of the terms of use you accepted, and when. Acceptance we cannot evidence is acceptance we do not have.

Unlocking a scoping brief does not create an account. We email the brief to the address you give and keep your details with it, so that we can offer it to you when you sign in to AppSmith with that address. Nothing is added to an account until you sign in and add the brief yourself, and you can tell us it is not yours instead. If no account has that address yet, asking for a sign-in link with it creates one for you and a prospect record for your business, with you as its Client owner — as registering on AppSmith directly does.

When you use your AppSmith account

  • Whether your email is confirmed — it is confirmed the first time you sign in with a link we email you, and when that was is recorded.
  • How you sign in — by link. You sign in to AppSmith with a link we email you, which you ask for on its sign-in page. There is no password. Each link works once and only for a short time, and we keep only a one-way hash of it, so nobody at Crypti can read it. When you first sign in is recorded.
  • Share links — the links you create to show a scoping brief to your team, and how many times each has been opened.

Your team and its roles

A business's AppSmith account can have several people on it. For each one we keep their name, email address, role, the projects they may see if their access is limited to some, who invited them and when, and whether they accepted. The roles are:

  • Client owner — sees everything on the account, including invoices, and manages the team.
  • Finance — sees invoices and what has been paid on them, and the names of projects, but not their documents.
  • Member — sees projects and their documents, scopes new work, books calls and signs off specifications.
  • Viewer — reads projects and their documents, and nothing more.

So the people on your team see your information as far as their role allows: for example, your name on a sign-off you gave, or on a scoping request you made. A Client owner, or Crypti, can invite you by email; we keep the invitation until it is used or withdrawn.

Projects and documents

When your business works with us, we keep its projects — each one's name, code and status, and the scoping request it started from — and the documents we write for them, such as the project specification. Every published version of a specification is kept unchanged, so that everyone can see exactly which version was agreed. Documents and notes may mention you by name, for example as the person we spoke to. Some of them, and the reason we give ourselves for declining a scoping request, are internal to Crypti and are not shown in AppSmith.

When you sign off a specification

A Client owner or Member can sign off a published version of a project specification. For each sign-off we keep which version it was, the name you type, your account, the date and time, a one-way hash of your IP address and the name of the browser you used, so the sign-off can be shown to be yours. When we email your Client owners to ask for a sign-off, we keep a record of when we asked and how many people we asked.

Invoices and payments

  • Billing details — your business's billing email addresses (yours, if you are one of them), its invoice and payment settings, and anything it asks us to show on its invoices.
  • Invoices and statements — the invoices we issue, with their lines, amounts, dates and status, their PDFs, and statements of account produced for your business.
  • Payments — each payment we record against an invoice: the date, the amount, how it was paid and the bank or transaction reference.
  • Email records — a record of each email we send about an invoice, reminders included: when it went, to which addresses, and the reference our email provider gave it.

When you pay in crypto

If you pay us in crypto, we see the transfer on the public blockchain. Once a day we read the transfers into Crypti's own wallets through block explorer services, and keep each one: the transaction, the amount, when it happened and the wallet address it was sent from. A wallet address is public, but together with an invoice it can identify you. We use these records only to match payments to invoices; a transfer only counts as a payment once a person at Crypti has checked it and recorded it.

When we discuss work with your business

We keep a sales record (a "deal") for work we are discussing with a business: a title, the stage it has reached, an estimated value, the next step and follow-up date, our notes, and the contact's name and email address. A deal can start from a First Pass result or a prospect record, or from a conversation with us. Deals are internal to Crypti.

The audit log

AppSmith and our admin system keep an audit log: which account did what and when — for example signing in, inviting a colleague, signing off a specification or recording a payment — what changed, and a one-way hash of the IP address it came from. Values that are sensitive are hidden in the log. We keep it to protect your account and ours and to show what happened if a question comes up.

When you book a call

Calls are booked through Cal.com. We receive the booking — your name, email address, the time, and anything you add to the notes — and when it is rescheduled or cancelled. We fill in the notes for you with your project in a line, your verdict and a link to your scoping brief, so the person who calls you has read it first. If someone books from a scoping brief you shared with them, we add them as a contact of your business, without an account.

When you email us

Replies to our emails are read by a person at Crypti and kept with your record.

Please do not put passwords, identity numbers, banking details or anyone else's personal information into First Pass. We do not need them to understand what you want built.

Why we collect it, and the lawful basis

POPIA allows us to process personal information only on a lawful basis (section 11). This is what we use each kind of information for, and the basis we rely on.

  • First Pass and your scoping brief — to give you an honest verdict and a brief, to let you come back to it, and to prepare for the call you book. We also look at results across many sessions to check and adjust how First Pass scores projects. Basis: your consent, given when you accept the terms, and our legitimate interest in understanding what people want built.
  • Your account and your team — to run AppSmith for you and to let your Client owner decide who on your team sees what. Basis: the agreement between you and us that the terms of use set out.
  • Projects, documents and sign-offs — to do the work your business asks us to do, and to keep a reliable record of what was agreed. Basis: the agreement with your business, and our legitimate interest in being able to show what was agreed.
  • Invoices, payments, crypto receipts and their email records — to bill your business, to know what has been paid, and to keep the accounting records the law requires. Basis: the agreement with your business, and our legal obligations under tax and company law.
  • Deals — to keep track of work we are discussing with your business and to follow up when we said we would. Basis: our legitimate interest in running our business.
  • The audit log — to keep accounts secure and to show what happened. Basis: our legitimate interest in security, and our duty under POPIA to keep personal information secure.

We send one email when you unlock a scoping brief, plus the emails your account and your business's work need: the sign-in links you ask for, word that you have been added to a team, invoices and payment reminders to billing addresses, requests to sign off a specification, confirming that you closed your account, and telling you the terms have changed. We do not send marketing email. We do not sell your information and we do not use it to build a marketing list.

How long we keep it

We keep First Pass results indefinitely — every session, including ones that were never unlocked, with its description, answers, scores, verdict and scoping brief, the internal engineering document, your details, your bookings and your share links. We do this so a scoping brief is still there when you come back to it, and so we have the full context when you do. It stays until you delete it, as set out below.

Four things from First Pass are not kept that way:

  • The IP address hash is deleted after 7 days.
  • The ad click identifier (gclid) is deleted after 90 days.
  • Your details on a scoping brief you unlocked — your name, business name and email address — are kept for at most thirty days while the brief waits for you to add it in AppSmith. They are erased when you add it or tell us it is not yours, and after thirty days if you never sign in, when the brief is no longer offered to you.
  • The hourly rate you type into the savings box is never sent to us, so there is nothing to keep.

Everything else is kept as follows:

  • Your account and team membership — while your account is open. Single-use sign-in links are deleted within thirty days of being used or expiring.
  • Projects and documents — while we work with your business, and afterwards as the record of the work.
  • Sign-offs — permanently, as the record of what was agreed: the name you typed, the version, the date and the IP address hash stay even if your account is later closed.
  • Invoices, statements, payments, crypto receipts and invoice email records — as accounting records, for as long as the law requires us to keep them.
  • Billing email addresses — while your business is billed by us. Yours is removed when your account is erased.
  • Deals — while we are discussing the work, and afterwards as our sales record.
  • The audit log — kept, never deleted, except that entries naming a person whose information we erase are scrubbed of it.

Our test systems can write emails to a log file instead of sending them; our live system never does.

How to delete it

  • Delete this scoping request (or Delete this scoping result, for a result that did not become a request) — on its page in AppSmith, for the person who ran it and the Client owner. The same thing is the Delete this scoping brief link in your scoping brief email and at the foot of its PDF, which works without signing in. It erases that First Pass session and everything that came from it: the answers, scores, scoping brief, the internal engineering document, share links and the record of the AI calls, and the scoping request made from it if that request is still waiting or was declined. A project Crypti has already accepted stays, without the link to the scoping brief. Your account stays. Bookings made from a shared scoping brief by someone else stay theirs, marked as belonging to a deleted brief.
  • Close my account — under Settings in AppSmith, for anyone on the team, whatever their role. We ask you to confirm, then erase you as a contact, your scoping results, any scoping briefs still waiting for you to add, any scoping request made from them that is still waiting or was declined, your own bookings, and your address as a billing email address; your name and email address are removed from any deal; and audit log entries that named you are scrubbed. We email you to say it is done. A colleague who booked a call from a scoping brief you shared keeps their own contact and booking, because that information is theirs. If nobody is left on your business's prospect record, it is erased too, with its remaining waiting or declined scoping requests and its deals.
  • If your business already works with us — if it is a client, has invoices or contracts with us, or has a project we accepted, closing your account cannot wipe the record. Instead, your sign-in is switched off at once and we receive an erasure request, which a person at Crypti deals with, removing what we are not required to keep.

You can also ask for any of this by writing to [email protected].

What erasure keeps

Some records are not erased, by any route, because we need them for legal and accounting reasons: invoices, payments, statements of account, crypto receipts and the records of invoice emails, and the projects we accepted with their documents and sign-offs. When the person who signed off a specification is erased, the sign-off keeps the name they typed, the date and the IP address hash, but no longer points to their account. The audit log keeps that something happened, without the details that named the person.

Who else processes it

These providers act as our operators: they process your information on our instructions and for no purpose of their own.

  • Anthropic (Claude) — the AI behind First Pass. Your description and answers, after the stripping described above, are sent to Anthropic's API, which processes them in the United States. Under Anthropic's commercial API terms, what we send is not used to train its models, and Anthropic keeps it only for a limited period, longer only where a request is flagged under its usage policy.
  • SendGrid (Twilio) — delivers our emails, so it handles your name, email address and what we send you: your scoping brief, invitations, sign-off requests, and invoices, statements and reminders with their PDFs.
  • Cloudflare — the bot check when you start First Pass (Turnstile), and the file storage that holds invoice and statement PDFs and the files we keep for projects.
  • Cal.com — runs call bookings, so it handles the booking details above.
  • Block explorer services — read public blockchain data for us. We ask them only about Crypti's own wallets; what they return is the public record of transfers into them, including the sending wallet's address.
  • Google LLC — Google Analytics and Google Tag Manager, only on a site where you accepted the cookie banner. Google handles what is described under "Cookies and analytics" below: the pages viewed, buttons clicked and First Pass steps, with the random identifier in its cookie, and never your name or email address. Google LLC processes it in the United States and other countries, which is a transfer outside South Africa under section 72 of POPIA (see below).
  • Hosting and error monitoring — standard services that run the site and AppSmith. Our error monitoring is configured to strip personal information before an error is recorded.

Inside Crypti, staff see your information only as far as their role needs: for example, invoices and payments only for staff with billing access.

Information sent outside South Africa

Some of these providers process information outside South Africa, mainly in the United States. We use them only on terms that limit what they may do with it.

Cookies and analytics

We use Google Analytics, through Google Tag Manager, on this site and AppSmith, but only if you agree. Each site shows a banner that asks first, with Accept and Decline as equal choices. Saying no changes nothing: every page, First Pass and your AppSmith account work the same either way. If you decline, or never answer, nothing from Google loads.

If you accept, we count:

  • the pages viewed. Where a page's address identifies something — a scoping result, an invoice, a share link — we send the kind of page, not its address;
  • the buttons clicked: which button and where on the page, and for a link to another site, only that site's name;
  • the steps of First Pass: that a session started, the question numbers as they are answered and whether you picked an answer or typed one, the outcome, and whether you unlocked your scoping brief or clicked to book a call;
  • in AppSmith, that you signed in, opened an invoice or signed off a document, but not which one.

What we send is never what you type, your name or your email address. Google Analytics sets a cookie holding a random identifier, so that a return visit is not counted as a new visitor. Like any site your browser loads from, Google sees your IP address; Google Analytics uses it to work out a rough location, such as the country and city, and does not store it. There is no advertising or remarketing: the setting that would allow advertising is always off, whatever you choose, and we use no advertising cookies.

Each site asks separately, so a choice on this site does not carry over to AppSmith. Your choice is kept in your browser for 12 months, and then we ask again. You can change it any time with "Cookie settings" at the foot of each site; if you change yes to no, we remove the Google Analytics cookies that site set and reload the page. Google keeps the analytics data for 14 months, the retention we set in Google Analytics, and then deletes it.

Apart from that, AppSmith keeps in your browser only what it needs to keep you signed in and to carry a First Pass session from one step to the next, and each site keeps your cookie choice.

How we protect it

Information is transmitted over encrypted connections, stored in access-controlled systems, and reachable only by the Crypti staff who need it to do their work. Access to it is logged. Links we email you are signed. The only links that sign you in are the single-use ones you ask for on AppSmith's sign-in page. Invoice and statement PDFs are opened through short-lived links. Share links are unguessable, read-only, expire after 90 days, and you can revoke one at any time.

Your rights

Under POPIA you may ask us to confirm what personal information we hold about you and to give you a copy, to correct it, to delete it, and to stop processing it, and you may object to processing we do on the basis of our legitimate interest. You may withdraw your consent at any time — that does not undo processing that already happened lawfully, but it stops what comes next. Where the law requires us to keep a record, we will tell you which record and why instead of deleting it. Write to [email protected] and we will answer.

If you believe we have handled your information badly, you are entitled to complain to the Information Regulator (South Africa). We would rather you told us first, but that right does not depend on it.

Changes to this policy

When this policy changes, the version and date at the top of this page change with it. The version in force is the one published here.

See also our terms of use, or get in touch.