Culltron API Privacy Policy

Effective date: 14 October 2026

This policy explains how Culltron (Pty) Ltd (reg. no. 2026/455284/07, South Africa) processes personal information in connection with the Culltron APIs on RapidAPI, under the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who we are and contact

• Responsible party: Culltron (Pty) Ltd, 32 Lapwing Avenue, Arena Park, Chatsworth, 4092, KwaZulu-Natal, South Africa
• Information Officer: Ashveer Ramlukan, registered with the Information Regulator (registration no. 2026-063244)
• Privacy contact: support@culltron.app

2. Two roles

• API request content (the data you send to an endpoint): you are the responsible party, and Culltron acts as your operator (POPIA s20–21), processing it only to return the response.
• Account and operational data (RapidAPI username, plan, request metadata, support emails): Culltron is the responsible party.

3. What we process

• Request content: processed in memory for the duration of the call and not intentionally stored in application storage. It is not used for training, profiling or marketing.
• Operational metadata: request ID, route, status, latency, response size, RapidAPI username and plan headers, and IP-related metadata handled by Azure and RapidAPI. Application logs are designed to exclude request bodies, keys and authentication headers.
• Usage counters: where a daily cap is enabled, per-user daily request counts stored in Azure Table Storage (South Africa North) under a one-way hash of your RapidAPI username and plan, together with the day and the count. Your username is not stored in readable form.
• Support correspondence: the emails you send us.

We do not receive your payment card details. RapidAPI processes payments.

4. Purposes and lawful basis (POPIA s11)

Providing the service you requested (contract), security, abuse and fraud prevention, quota enforcement, cost control and troubleshooting (legitimate interest), and meeting legal obligations.

5. Sharing and operators

• Microsoft Azure (hosting, logs and monitoring; region South Africa North)
• RapidAPI (marketplace gateway, billing and consumer accounts)
• For specific endpoints only, and only with the data the endpoint needs: Cloudflare DNS-over-HTTPS (DNS endpoint), the target URL you ask us to scan, and the Have I Been Pwned range API (5-character SHA-1 prefix only, for the password endpoint)
• Authorities, where required by law

We do not sell personal information.

6. Cross-border transfers (POPIA s72)

RapidAPI and some network services operate outside South Africa. Transfers take place under the provider terms, which give protection substantially similar to POPIA, or because the transfer is necessary to perform the contract you requested.

7. Retention

• Request content: not retained after the call, except transient platform copies.
• Application logs and telemetry: 30 days (the configured Log Analytics retention).
• Usage counters: 30 days, after which they are deleted automatically.
• Support emails: for as long as needed to resolve the matter, and kept for no longer than 24 months, after which they are deleted.
• Billing records: held by RapidAPI under its own terms.

8. Security (POPIA s19)

Measures include TLS only, proxy-secret origin authentication, managed identity with no shared storage keys, Key Vault-held secrets, input size and depth limits, SSRF protection on outbound fetches, rate and quota limits, and a no-payload logging policy. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by POPIA s22.

9. Your rights

You may ask for access to, correction of or deletion of your personal information, object to processing, and complain to the Information Regulator (https://inforegulator.org.za, POPIAComplaints@inforegulator.org.za). Access requests are handled under our PAIA manual (PAIA manual). Email support@culltron.app.

10. Children and special information

The APIs are not intended for children. Do not submit special personal information or children's information unless you have a lawful basis.

11. Cookies and AI features

The website uses no third-party tracking cookies; see the Cookie and Local Storage Policy. How AI requests are handled is described in the AI Disclaimer.

12. Changes

We will publish updates here with a new effective date.