PAIA & POPIA Compliance Manual

Vault of Time (Pty) Ltd · Reg No 2025/875420/07 · Version 4.0 — August 2026
Prepared in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 and the Protection of Personal Information Act 4 of 2013.

A copy of this manual is available on request from the Information Officer at hello@vaultoftime.com, and for inspection at the registered office during normal business hours.

1. Company Overview & Contact Details

Vault of Time is an AI-native product studio. At the date of this version it operates the following products, each with its own data footprint described in this manual: TillTap (a grocery budgeting application, tilltap.co.za); HiyaLater (a small, chronological social network, hiyalater.com); and MilliScoop (a digital generative-art service, milli.vaultoftime.com).

This manual is published on the company’s website and on the website of each product, and is available at the registered office for public inspection during normal business hours. A copy will be provided to any person on request to the Information Officer, and to the Information Regulator on request.

2. The Guide on How to Use PAIA

The Information Regulator has compiled a guide on how to use the Promotion of Access to Information Act, as contemplated in section 10 of the Act. The guide is available from the Information Regulator at www.inforegulator.org.za, and a copy is available for public inspection at the company’s registered office during normal business hours. No fee is charged for inspecting the guide.

3. Records Held in Terms of Other Legislation

Vault of Time maintains records in accordance with the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value Added Tax Act 89 of 1991; the Consumer Protection Act 68 of 2008; the Electronic Communications and Transactions Act 25 of 2002; the Protection of Personal Information Act 4 of 2013; and the Promotion of Access to Information Act 2 of 2000.

4. Schedule of Records Held by the Company

5. Processing of Personal Information (POPIA)

5.1 Purpose of Processing

Personal information is collected and processed solely to:

• provide and operate the company’s products — maintaining TillTap accounts and features; operating HiyaLater accounts, walls, communes and their moderation; and honouring MilliScoop scoop credits and artwork records;
• allow people to find and recognise one another on HiyaLater by their chosen handle, and to establish who may enter a commune;
• allow commune moderators to look after the rooms they run, including removing content and removing members;
• process payments and maintain transaction records;
• send transactional communications such as sign-in links and legally required notices;
• secure and improve the services through minimal, aggregated analytics; and
• meet legal obligations, including to the South African Revenue Service and the Information Regulator.

5.2 Categories of Data Subjects

TillTap users; HiyaLater account holders, including those who create or moderate communes; MilliScoop purchasers and free-scoop users; directors of Vault of Time (Pty) Ltd; and service providers.

5.3 Recipients and Operators

Personal information is processed internally and by the following operators under POPIA: Google LLC (Firebase hosting, database, authentication, serverless functions and analytics infrastructure for all products); PayPal (payment processing for MilliScoop; PayPal acts under its own privacy policy in respect of payment credentials, which Vault of Time never receives); and Anthropic PBC (AI processing used by TillTap to parse receipt content submitted by users — no HiyaLater content is sent to any AI service). Information may further be disclosed where legally mandated, specifically to the South African Revenue Service upon lawful request.

Disclosure between users. On HiyaLater, a profile and its wall posts are public and readable by anyone. Posts written inside a commune are readable by the members of that commune and by the people who moderate it. A list of favourited accounts is private to the person who made it, and is never disclosed to the accounts on it. Records of a person’s removal from a commune are visible only to that commune’s moderators.

5.4 Information Security Measures

A general description, as contemplated in section 51(1)(c)(iii) of PAIA, sufficient for a preliminary assessment of suitability and no more specific than is prudent to publish:

• Access to records is enforced at the database layer by declarative security rules evaluated on every read and write, rather than only in application code. Rules deny by default; anything not expressly permitted is refused.
• Operations that require privilege — account deletion, commune creation, joining a commune, and all moderation actions — run as server-side functions rather than in the browser, so the checks cannot be bypassed by a modified client.
• Commune entry phrases are never stored. Each is salted with a value unique to that commune and stored only as a SHA-256 digest, which means a phrase cannot be recovered by the company or by anyone reading the database.
• Records that are private to one person — a favourites list, a commune’s contents, a removal record — are unreadable by other users at the database layer, not merely hidden in the interface.
• Authentication is delegated to Google’s identity infrastructure. Vault of Time does not hold user passwords.

5.5 Cross-Border Data Transfers (Section 72, POPIA)

The company’s products are built on infrastructure operated by Google LLC, and, for MilliScoop and TillTap respectively, by PayPal and Anthropic PBC. Where records are held determines whether a transfer out of the Republic occurs, and this differs by service:

Accordingly, the substantive content of HiyaLater — what people write, who is in which commune, and everything held about a person other than their sign-in details — is stored in South Africa and is not transferred abroad in the ordinary course. Account sign-in details, some operational logging, and the payment and receipt-parsing processing described above do involve processing outside the Republic.

In compliance with section 72 of POPIA, those transfers rest on: (a) the operators’ data processing terms, which incorporate standard contractual clauses and commitments providing an adequate level of protection substantially similar to the conditions for lawful processing under POPIA; and (b) where applicable, the consent of the data subject, obtained at the point of collection, with cross-border processing disclosed in the applicable privacy policy before submission. The company relies primarily on (a). Consent is secondary, because consent may be withdrawn while a transfer already made cannot be undone.

5.6 Data Retention Schedule

5.7 Rights of Data Subjects

Data subjects may, by contacting the Information Officer at hello@vaultoftime.com, exercise the following POPIA rights: the right of access (confirmation of what personal information is held, and a copy of it); the right to correction of inaccurate, incomplete, or outdated information; the right to deletion, subject to the company’s legal retention obligations; the right to object to processing in certain circumstances; and the right to complain to the Information Regulator (www.inforegulator.org.za; JD House, 27 Stiemens Street, Braamfontein, Johannesburg; complaints.IR@justice.gov.za) if they believe their rights have been violated.

HiyaLater account holders may delete their own account from within the product at any time, without contacting the Information Officer. Doing so removes their profile, their wall posts, their posts inside communes, their favourites list, their entry in other people’s favourites lists, and their commune memberships. The handle is retained as described in section 5.6.

5.8 HiyaLater — Detail of Personal Information Processed

Provided in the interest of sufficient detail to facilitate a request under section 51(1)(b)(iv) of PAIA.

5.9 Data Breach Notification Procedure

In the event of a data breach, the company acts in accordance with section 22 of POPIA: the Information Officer is notified immediately upon discovery; the Information Regulator is notified as soon as reasonably possible; affected data subjects are notified as soon as reasonably possible unless the Regulator directs otherwise; notifications include the nature of the breach, the information involved, and remedial steps taken; and an internal breach log is maintained for all incidents regardless of severity.

6. How to Request Access to a Record

Requests must be made on the prescribed form (Form 2 — Request for Access to Record of Private Body), available from the Information Regulator (www.inforegulator.org.za), and directed to the Information Officer at hello@vaultoftime.com.

A request fee and access fees may be payable as prescribed in terms of section 54 of PAIA. No request fee is payable where the request is for the requester’s own personal information.

The Information Officer will respond within 30 days of receiving the request, which may be extended by a further 30 days in the circumstances set out in section 57 of PAIA. Where access is refused, reasons will be given together with a statement of the requester’s right to apply to court.

7. Grounds for Refusal of Access

Access to records may be refused on the grounds set out in Part 3 of PAIA, including the mandatory protection of third parties’ personal information; commercial information held in confidence; information that could endanger the safety of individuals; information subject to legal privilege; and records required for ongoing legal proceedings.

Requesters should note in particular that the contents of a commune, and the identities of its members, are the personal information of third parties. A request for those records will be refused under section 63 of PAIA unless the third parties concerned consent or another ground in Part 3 permits disclosure.

8. Records Available Without a Request

The company has not, at the date of this version, published a description of categories of records automatically available in terms of section 52(1) of PAIA. Publicly visible product content — HiyaLater profiles, handles and wall posts — is available to anyone without a PAIA request simply by visiting the product.

This manual is reviewed annually or upon any material change to the company’s data processing activities. Version 4.0 supersedes Version 3.0 (July 2026). It records the introduction of HiyaLater; replaces the previous general statement that personal information may be processed outside South Africa with a per-service account of where records are actually held; adds a description of information security measures; declares the indefinite retention of deleted HiyaLater handles and the reason for it; corrects the attribution of the PAIA Guide to the Information Regulator; and removes references to a closed auction platform and to identity documentation that the company did not in fact hold.