Privacy Policy

ArkFlow is a trading name of Solarmente (Pty) Ltd (Reg. 2022/654500/07) (the “Company”, “we”, “us”, “our”), a private company incorporated in South Africa with its registered office at Silo, 4 S Arm Rd, Waterfront, Cape Town, 8001, South Africa. We operate the website arkflow.co.za and the ArkFlow solar & water finance platform, used by customers (homeowners and businesses financing solar through the client portal) and by EPCs, installers, suppliers, brokers and their end clients across SADC.

For the purposes of the Protection of Personal Information Act, 2013 (“POPIA”), Solarmente (Pty) Ltd is the responsible party for the personal information described in this policy, except where section 8 says otherwise (information an installer captures about its own client). Our Information Officer can be reached at hello@arkflow.co.za (mark the subject “Information Officer”) or at the address above.

When you interact with ArkFlow — through this website, our communication channels, or the platform — we may collect:

• Identity & contact data — name, email address, mobile number, role/title, country, and, where you sign a consent or resolution on the platform, your South African ID number or passport number.
• Business data — company name, originator type (EPC, installer, supplier, broker), registration details, VAT number, directors and shareholders where a finance application requires them.
• Deal & finance application data — CapEx, system size, yield, consumption, proposal selections, your answers to the ownership-preference questionnaire (which decides which lenders you want to see your application), and the supporting documents required for a finance application.
• Document contents — the fields our document reader extracts from what you upload (for example the account holder, balances and transactions on a bank statement, or the directors on a company registration), together with a confidence score and your confirmation or correction of each field.
• Customer account data submitted directly — where you create a client-portal account and prepare your own finance application: your account details, quotes, consumption information, financial statements and the supporting documents you choose to upload.
• End-client data submitted by installers — where an EPC, installer, supplier or broker captures your details or collects documents from you on the platform (see section 8).
• Consent & signature records — for every consent, resolution or agreement you sign electronically: the version of the text you accepted, the date and time, your name and ID/passport number, the IP address and browser (user agent) you signed from.
• Messaging preferences — whether and when you opted in to, or out of, WhatsApp updates; delivery status of the messages we send you.
• Communications — messages sent via the contact form, email, SMS, WhatsApp (including conversations with our WhatsApp assistant), or in-platform chat.
• Technical & usage data — IP address, browser, device type, registered devices on a seat, pages viewed, login times, feature use, and session recordings (see section 11).

We process personal information for the following purposes:

• To respond to enquiries and onboard new business users (EPCs, installers, suppliers, brokers, lenders).
• To create and manage your ArkFlow account, client portal or CRM dashboard, and to register the devices used on a seat.
• To read the documents you upload, pre-fill your application from them, and ask you to confirm anything the reader is unsure about (section 9).
• To generate finance proposals, run prequalification and underwriting screening, and package your finance application for the lenders you choose.
• To share an underwriting summary with those lenders once you submit, so they can assess your application (section 5).
• To send you the service messages your application needs — a welcome message with your secure links, document requests, status updates, lender updates, signature requests, receipts and account notices — by email, SMS or, if you have opted in, WhatsApp (section 6).
• To record and evidence the consents, resolutions and agreements you sign on the platform (section 10).
• To answer questions you send our WhatsApp assistant and, where needed, hand the conversation to a person.
• To process payments and issue invoices where a fee or partner arrangement applies.
• To secure, monitor, troubleshoot and improve the platform.
• To comply with legal, regulatory, anti-money-laundering, FICA and tax obligations.

POPIA requires a lawful justification for each kind of processing. Ours are:

• Performance of a contract (POPIA s11(1)(b)) — creating and running your account, reading your documents, producing proposals and prequalification, packaging your application, sending the transactional messages the process requires, and recording the consents and signatures the application depends on. This applies to the emails and SMSs we send about your own application: they are service messages, not marketing.
• Consent (s11(1)(a)) — where you have explicitly agreed to something optional: WhatsApp updates about your application (a separate, unticked checkbox), the POPIA consent that releases your application to the lenders you chose, and any marketing communication. You can withdraw consent at any time (section 12) without affecting processing that happened before you withdrew.
• Legal obligation (s11(1)(c)) — KYC, FICA, tax and record-keeping duties.
• Legitimate interest (s11(1)(f)) — fraud prevention, platform security, device registration, audit logging, and product analytics that do not override your rights. You may object to processing on this basis (section 12).

Where an installer captures your details on your behalf, that installer relies on its own relationship with you; see section 8.

We do not sell your personal information. We share information only where it is necessary to deliver the service or comply with the law:

• Lenders and funders — a lender receives an underwriting summary of your application only after you submit it, and only the lenders selected through your ownership-preference questionnaire (and the POPIA consent you accept at submission) receive it. What is shared is limited to what the lender needs for the finance structure you chose. Each lender is a separate responsible party for what it receives and processes it under its own privacy notice and the National Credit Act where applicable.
• Your nominated lenders — where you or your installer elect to submit to your own bank or existing lender relationships, the pack is forwarded at your instruction.
• Installers (EPCs, suppliers, brokers) — where you are an end client of an installer using the platform, that installer sees the information and documents you submit on the deal it originated.
• Operators (service providers processing on our instructions):

• Google Cloud — hosting, database (Cloud SQL) and document storage in the africa-south1 (Johannesburg) region, and document reading through Vertex AI (Gemini and Document AI; see section 9).
• Google Workspace (Gmail API) — sending and receiving transactional email from hello@arkflow.co.za.
• Meta Platforms (WhatsApp Business Platform) — delivering WhatsApp messages you opted in to, and receiving messages you send our WhatsApp number. Meta processes message metadata under its own terms.
• SMS provider (SMSPortal or Clickatell) — delivering transactional SMS.
• PayFast — card and debit-order processing where a payment applies.
• Cloudflare — site delivery, security and performance.
• Microsoft Clarity and PostHog — usage analytics (section 11).

• Authorities — where required by South African law, a regulator, or a court order.

Each operator is bound by a written agreement to process personal information only on our instructions and to keep it secure, as POPIA s20 and s21 require.

• Email — every account receives transactional email from hello@arkflow.co.za: the welcome message with your secure links, document and signature requests, status and lender updates, receipts and account notices. These are needed to run your application and cannot be switched off while your application is open.
• SMS — if you have not opted in to WhatsApp, we send an SMS twin of the welcome email to the mobile number you or your installer provided, so your links reach you even if the email is missed. SMS is used for service messages only.
• WhatsApp updates — only if you tick the separate box “Send me WhatsApp updates about my application” on the installer capture form or on client signup. We then send status updates about your own application from ArkFlow's WhatsApp Business number, using message templates approved by Meta. We record the date and time you opted in. You can opt out at any time by replying STOP to that number or through the profile menu in your portal; we record the date and time you opted out and stop sending. Opting out does not affect your application.
• WhatsApp assistant — if you message our WhatsApp number, an automated assistant answers questions about ArkFlow using our published content, and hands over to a person where it cannot help. Those conversations are stored so we can follow up and improve the assistant.

Direct marketing. The messages above are service messages about your own application, not direct marketing under POPIA s69. We will not use your email, mobile number or WhatsApp opt-in to market other products or services to you unless you separately agree to that, and every marketing message will carry a way to opt out. Existing customers may object to marketing at any time at no cost.

The welcome email and SMS contain personal, passwordless links to your prequalification, proposal and quick application. Each link carries a personal access token, expires 30 days after issue, and should not be forwarded: anyone holding the link can open the page it points to until it expires. If you suspect a link has been shared, email hello@arkflow.co.za and we will revoke it.

A solar installer (EPC) using ArkFlow may enter your name, contact details and quote on its capture form and choose whether to tick WhatsApp updates on your behalf only where you have asked for that. When this happens:

• The installer is the responsible party for having collected your details lawfully, and ArkFlow acts as its operator for that capture.
• ArkFlow immediately sends you a welcome email (and SMS, or WhatsApp if you consented) so you know your details are on the platform, who entered them, and how to take control of your own application.
• From the moment you open your links or create your account, ArkFlow processes your finance application as responsible party under this policy, and the installer sees the deal it originated.
• If you did not ask the installer to submit your details, reply to the welcome message or email us and we will close the lead and delete what was captured, subject to section 13.

Documents you upload are stored in Google Cloud's africa-south1 (Johannesburg) region and read by optical character recognition and large-language-model extraction (Google Gemini and Google Document AI, run through Google Cloud Vertex AI under Google Cloud's enterprise terms, which prohibit Google from using your documents to train its models). The reader pre-fills your application and scores its own confidence; you are asked to confirm or correct anything below the confidence threshold before the field is used.

Prequalification and underwriting screening (affordability, credit scorecard, KYC and statement analysis) are indicative tools that help prepare your application. They are not the credit decision. No lending decision with legal or similarly significant effect on you is taken by ArkFlow solely by automated means (POPIA s71): the lender you submit to makes its own decision, under its own process.

Consents, resolutions, mandates and agreements on the platform are accepted electronically. Each acceptance is recorded with the exact text and version you accepted, your typed name and ID or passport number, the date and time, and the IP address and browser you used, and is written to an append-only audit trail. We keep these records to evidence what was agreed, as data messages under the Electronic Communications and Transactions Act, 2002, and to meet lender and regulatory requirements. A signed copy is available to you on request.

We use a small number of cookies and analytics tools to keep the website and platform functional, secure and improving:

• Microsoft Clarity — anonymised behavioural analytics, heatmaps and session recordings to help us understand how the site is used.
• PostHog — product analytics, hosted in the European Union, measuring how the platform is used so we can improve it.
• Cloudflare — site delivery, security and performance analytics; may process IP and request metadata.
• Essential cookies — login sessions, security tokens, device registration and preference storage on the platform.

Your choice. You can disable cookies via your browser settings. Disabling essential cookies may prevent parts of the platform from working. We do not run advertising cookies or share data with ad networks.

You have the right to:

• Access the personal information we hold about you (s23).
• Request correction or deletion of inaccurate, irrelevant, excessive, out-of-date or unlawfully obtained information (s24).
• Object, on reasonable grounds, to processing based on legitimate interest (s11(3)), and object at any time to direct marketing (s11(3)(b), s69).
• Withdraw consent at any time where processing relies on consent (s11(2)(b)) — for WhatsApp updates, reply STOP or use your portal profile menu; for anything else, email us.
• Not be subject to a decision with legal or similarly significant effect based solely on automated processing (s71).
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, email hello@arkflow.co.za. We may need to verify your identity first. We respond within a reasonable time, and at the latest within the periods POPIA and the Promotion of Access to Information Act allow.

• Account and deal data: for as long as your account is active or the deal is open, and thereafter for as long as needed to resolve queries and disputes.
• Finance application records, consent and signature records, and the underwriting summaries shared with lenders: for the period required by South African financial regulation, FICA and contract law (generally at least five years after the relationship ends), because they evidence what was submitted and agreed.
• Secure links: tokens expire 30 days after issue and are then unusable.
• WhatsApp and SMS opt-in and opt-out records: for as long as we hold your number, so that an opt-out is honoured indefinitely.
• WhatsApp assistant conversations and support messages: for as long as needed to resolve the query and improve the assistant, and then deleted or anonymised.
• Analytics and session recordings: per the retention settings of the tools in section 11, typically 30 to 90 days.

If you request deletion, we remove or de-identify your information within 30 days, except where retention is legally required or needed to defend a claim, in which case we tell you what we are keeping and why.

We take appropriate technical and organisational measures to protect personal information (POPIA s19), including encrypted transport (TLS), encryption at rest in Google Cloud, role-based access control, per-seat device registration, append-only audit logging, and regular review of our security practices. If a security compromise affects your personal information we will notify you and the Information Regulator as POPIA s22 requires. No method of electronic storage is 100% secure, but we work to a high standard of stewardship — your data is held in trust.

Your finance application and documents are stored and processed in South Africa (Google Cloud africa-south1). Some operators process outside South Africa: document reading on Vertex AI may run in Google data centres outside South Africa, and WhatsApp message delivery (Meta), email delivery (Google Workspace), product analytics (PostHog, EU) and content delivery (Cloudflare) are global services. Where a subscriber or lender is in another SADC country, the pack is transferred at your instruction. In each case we take the steps POPIA s72 requires, so that the recipient is bound by law, binding corporate rules or a contract giving substantially similar protection to POPIA.

The ArkFlow platform is intended for use by businesses and adults applying for finance. We do not knowingly collect personal information from children under 18.

We may update this privacy policy from time to time. Material changes will be highlighted on this page with an updated “Last updated” date, and, where the change affects how we use information you have already given us, we will notify account holders by email.

For questions about this privacy policy, to exercise your POPIA rights, or for any other privacy-related matter:

Email: hello@arkflow.co.za
Address: Solarmente (Pty) Ltd, Silo, 4 S Arm Rd, Waterfront, Cape Town, 8001, South Africa
Information Officer: reachable at the email above, subject “Information Officer”.

Our Terms of Service govern use of the platform and should be read with this policy.