Privacy Policy

Who we are

This Privacy Policy applies to WENBRU, a sole proprietorship operated by Michael Edward Wentzel ("WENBRU", "we", "us", "our"), registered in the Republic of South Africa.

WENBRU is registered with the Information Regulator of South Africa as a Responsible Party and Information Officer in terms of the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy governs how we collect, process, store, and protect personal information collected through:

• The WENBRU web application at www.wenbru.co.za
• The WENBRU Android mobile application
• Demo request forms on our marketing website
• Direct communications by email, telephone, or in person

Information we collect

2.1 Account and identity information

When you register for a WENBRU account or request a demo, we collect:

• Full name
• Email address
• Telephone or mobile number
• Farm or business name
• Physical address (farm address for installation purposes)
• Province / region

2.2 Farm and device information

To operate the irrigation platform, we collect:

• GPS coordinates of your farm / controller installation site (used for weather data and ET₀ calculations — not precise home address)
• Irrigation zone names and configuration (these are operational labels you choose, e.g. "Tomatoes A")
• Device pairing and API credentials (hashed/encrypted — we cannot recover your raw key)
• Irrigation schedule configuration

2.3 Telemetry data

The WENBRU IoT controller sends operational data to our platform approximately every 5 seconds:

• Soil moisture readings (Volumetric Water Content %)
• Zone activation state (on/off)
• Flow rate and pressure readings (where sensors are installed)
• Controller online/offline status
• Firmware version

2.4 Usage and technical data

When you use the WENBRU platform, we automatically collect:

• Login timestamps and session tokens (for security)
• Browser type and version (for technical compatibility)
• IP address (for security, rate limiting, and abuse prevention)
• Pages visited within the application (for performance monitoring)

We do not use third-party analytics services such as Google Analytics. Usage logging is minimal and used solely for platform stability and security.

2.5 Communications

If you contact us by email or through the demo request form, we retain the contents of that communication to respond to your enquiry and follow up appropriately.

How we use your information

Purpose	Information used
Provide the irrigation platform	Account details, device config, telemetry data, GPS coordinates
Authenticate your identity	Email address, hashed password, session tokens
Generate AI water recommendations	GPS coordinates (sent to open weather API — see Section 5), crop configuration
Send service notifications and alerts	Email address, push notification token, alert thresholds you set
Respond to demo requests and sales enquiries	Name, contact details, farm details from the demo form
Issue invoices and process payments	Name, address, email — payment processing handled by third-party providers (see Section 5)
Security monitoring and abuse prevention	IP address, login logs, failed authentication attempts
Legal and regulatory compliance	All categories as required by applicable law

We do not use your personal information for unsolicited marketing, sell it to data brokers, or use it for any purpose other than those listed above without your explicit consent.

Legal basis for processing

We process your personal information on the following lawful grounds under POPIA:

• Contract performance: Processing necessary to provide the service you have signed up for (e.g., storing your account details, operating your controller remotely).
• Legitimate interests: Security monitoring, fraud prevention, and platform improvement — balanced against your privacy interests.
• Consent: For optional communications such as product updates or marketing — you may withdraw consent at any time.
• Legal obligation: Where we are required to retain records by South African law (e.g., tax records under the Income Tax Act).

Data sharing and third parties

We do not sell your personal information. We share it only in the following limited circumstances:

5.1 Weather data service

To calculate ET₀ irrigation recommendations, your farm's GPS coordinates are sent to Open-Meteo (open-meteo.com), a free, open-source weather API. Only latitude and longitude coordinates are shared — no personal identifying information. Open-Meteo's servers are located in the EU. This is the only cross-border data transfer WENBRU makes, and it involves no personal information as defined by POPIA.

5.2 Payment processing

Invoices and payments are processed via third-party invoicing and payment services. When you make a payment, you are subject to that provider's privacy policy. WENBRU does not store credit card numbers or banking details.

5.3 Legal requirements

We may disclose your information where required to do so by a South African court order, statute, or government authority, or where necessary to protect the rights, property, or safety of WENBRU, our users, or the public.

5.4 Business transfer

If WENBRU is sold, merged, or its assets transferred, your information may be transferred to the new owner subject to this Privacy Policy continuing to apply.

Data storage and security

6.1 Where your data is stored

All WENBRU platform data is stored on a dedicated Virtual Private Server (VPS) located in South Africa. We do not use cloud providers such as AWS, Google Cloud, Azure, or Supabase. Your data does not leave South African jurisdiction (except GPS coordinates sent to Open-Meteo, as described in Section 5.1).

6.2 Security measures

We implement the following security measures to protect your personal information:

• Encryption in transit: All connections to the WENBRU platform use HTTPS with TLS encryption (SSL certificate renewed automatically). WebSocket connections use WSS.
• Password security: Passwords are hashed using bcrypt before storage. We never store or transmit plaintext passwords.
• API authentication: Device API keys are issued as cryptographically random tokens. Your dashboard access is protected by JWT tokens with short expiry windows.
• Rate limiting: Login attempts are rate-limited to prevent brute-force attacks.
• Database backups: Daily automated backups retained for 7 days, stored on the same server.
• Access control: Only the WENBRU Information Officer (Michael Edward Wentzel) has administrative access to the production server.

No security system is perfect. In the event of a personal information breach that poses a risk to you, we will notify you and the Information Regulator as required by POPIA.

Data retention

Data type	Retention period	Reason
Account information	Duration of your subscription + 5 years	Legal and tax records
Telemetry data	30 days rolling	Platform performance; automatically pruned
Irrigation event history	90 days rolling	Historical review; automatically pruned
Command history	7 days rolling	Debugging; automatically pruned
Demo / sales enquiries	3 years	Business records
Login security logs	30 days	Security monitoring
Financial records (invoices)	7 years	SARS requirement under Income Tax Act

When your subscription ends and the retention period expires, we will delete or anonymise your personal information.

Your rights under POPIA

As a data subject under the Protection of Personal Information Act 4 of 2013, you have the following rights:

• Right to access: You may request confirmation of whether we hold your personal information and a copy of that information.
• Right to correction: You may request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, or misleading personal information.
• Right to object: You may object to the processing of your personal information in certain circumstances.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time.
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that significantly affects you.
• Right to complain: If you believe your rights have been violated, you may lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact the Information Officer at mchlwentzel@gmail.com. We will respond within 30 days.

Complaints to the Information Regulator

If you are not satisfied with our response, you may contact the Information Regulator:

Cookies and local storage

The WENBRU web application uses the following browser storage mechanisms:

• Session storage: JWT authentication tokens are stored in browser session/local storage to keep you logged in. These are cleared when you log out.
• Service Worker cache: The WENBRU PWA caches application files and recent API responses locally for offline functionality. This data is your own irrigation data and does not leave your device.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies. The marketing website (wenbru.co.za) sets no cookies other than those strictly necessary for functionality.

Children's privacy

The WENBRU platform is a commercial agricultural service intended for use by adults operating commercial or semi-commercial farms. We do not knowingly collect personal information from persons under the age of 18. If you believe a minor's information has been submitted to us, please contact us immediately at mchlwentzel@gmail.com.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be communicated to existing subscribers by email at least 14 days before they take effect. The effective date at the top of this page will be updated with each revision.

Your continued use of the WENBRU platform after the effective date constitutes your acceptance of the revised policy.

Contact us