How we handle your information

This notice explains how Thaw collects, uses, shares and protects personal information under the Protection of Personal Information Act, 2013 (POPIA). Thaw is a trading name of K2026682407 (South Africa) (Pty) Ltd, registration number 2026/682407/07, a South African company run by Danio Harmse. In this notice “we” and “us” means that company.

We play two roles. For people who visit this website, contact us, use a Thaw login or buy from us, we are the responsible party: we decide what we collect and why. For the records our clients keep in Thaw (their leads, customers and appointments), the client is the responsible party and we are their operator: we process those records only on the client’s instructions, under a written agreement.

What we collect

When you contact us. What you type into the inquiry form or the revival calculator: your name, company, role, email, phone or WhatsApp number, industry, team size, the service you’re interested in and your message, plus whether you asked for a call or for occasional emails. To slow down spam we keep a scrambled fingerprint of your internet address, not the address itself. If you email or WhatsApp us, we keep that conversation.

When you visit the website. We count visits with Vercel Web Analytics. It uses no cookies, doesn’t identify you, and only tells us which pages are read and roughly where visitors come from.

When you use a Thaw login. Your name, work email, role and workspace, and a phone number if you add one for call alerts. Your password is stored only as a one-way hash. If you switch on two-step sign-in we keep its secret encrypted. To stop break-ins we record each sign-in attempt (the email typed, your internet address and whether it worked) and delete those records after about 30 days. We keep a log of important actions in the system, such as imports, approvals, messages sent and changes to team access, so a client can see who did what. If you choose to sign in with Google, Microsoft or Apple, we receive and store only that provider’s account identifier for you, never your password there, and we never use the provider to find or merge accounts. Team invitations hold the invited email address and expire after 72 hours.

When your business buys from us. Your company’s name and contact people, the package you agreed, quotes, invoices, payments we recorded and the status of your software licence. Software access is suspended seven days after an unpaid invoice is due; your records are kept, not deleted.

We don’t ask for special personal information (such as health, religion or biometrics) or information about children, and we ask clients not to store it in Thaw.

Cookies and browser storage

The public website sets no cookies. Signing in uses cookies to keep you signed in, and Google, Microsoft or Apple sign-in sets short-lived cookies that protect the sign-in step. Your browser also remembers your light or dark theme choice and, inside the app, whether the hot-lead sound is on. That stays on your device and isn’t sent to us.

Why we use it

• To reply to your inquiry or arrange a call you asked for (your consent, and steps towards a contract).
• To deliver work and software you’ve bought, run your account and bill you (our contract with you).
• To keep Thaw secure, prevent abuse and show who did what in a workspace (our legitimate interest).
• To keep financial records that tax and company law require (a legal obligation).
• To send occasional tips, only if you ticked the optional box. Every email has a way to unsubscribe.

We don’t sell or rent your information, and we don’t add you to marketing lists without your consent.

Client records in Thaw (Revival, Automate and CRM)

Clients use Thaw to keep their own contacts, companies, opportunities, tasks, appointments, invoices, messages and call outcomes. Those records belong to the client. As their operator we use them only to provide the service, keep them confidential and secure, never use them to contact anyone for ourselves, never share them or add them to anyone else’s list, and tell the client straight away if we believe they have been accessed without permission.

The client decides who is contacted and must have a lawful basis for it, including consent where POPIA requires it for direct marketing. Thaw helps them follow the rules: it records consent, honours opt-outs on every channel straight away, checks the national opt-out register, sends only within permitted contact hours and keeps people out of campaigns when there’s no basis to contact them.

If a client connects Thaw to their own tools (for example an n8n, Zapier or Make workflow, or a lead form), Thaw sends events to the address the client chose. Names, phone numbers and email addresses are only included if the client switches that on. Clients can download their records and calendar from Thaw at any time. When a contract ends, we delete or return the client’s records as our agreement with them sets out.

If you were contacted by a business that uses Thaw and want to know what they hold about you, or want it corrected or deleted, ask that business. Tell us too and we’ll pass your request on and help them act on it.

Client data in audits

Lead and customer data you share for a Lead Audit is used only for that audit, kept to the minimum we need, never used to contact your customers, and deleted or returned when the work ends, as set out in our agreement with you.

Client data in Cold-Lead Revival

For a revival, you ask us in writing to contact your past enquiries on your behalf. We act as your operator: we use those leads only to run your rounds, leave out anyone who opted out, is on the national opt-out register or can’t be shown to be contactable, honour every opt-out straight away, never share the leads or add them to anyone else’s list, and delete or return them when the work ends.

Client data in the Pipeline Engine

For the Pipeline Engine, ads and lead forms run in your own Meta ad account and the people who fill them in are your leads: you are responsible for them and we act as your operator. Each form shows your privacy notice and says that you will contact them. We use those leads only to follow them up for you, including later warm-up rounds, leave out anyone who opted out or is on the national opt-out register, honour every opt-out straight away, never share the leads or add them to anyone else’s list, and delete or return them when the work ends. Meta processes form entries under its own terms.

How we use AI

Thaw can use Anthropic, an AI provider, to help draft messages and sort replies. To draft a message we send only what the step needs, such as a first name and what the person enquired about; we never send surnames, phone numbers or email addresses. To sort a reply we send our message and the reply as written, so it includes anything the person chose to type. Anthropic does not use this data to train its models under its commercial terms. AI doesn’t decide on its own: a person approves messages before they’re sent, and AI can’t change consent, payments or access.

Some clients run an optional AI model on their own computer instead. That data stays on that computer and isn’t sent to us or to an AI provider. The “Ask Thaw” helper in the CRM answers from totals (such as how many calls are due) and doesn’t send names, numbers or messages to any AI.

Who we share it with

We share personal information only with service providers that help us run Thaw, each bound by its own data protection terms, and only what each one needs:

• Vercel (hosting, website analytics) and Neon (database), running in the European Union (Frankfurt).
• Google (Gmail, Calendar) for our own email and bookings.
• Brevo for sending email, and Meta (WhatsApp Business Platform) for WhatsApp messages.
• Anthropic for the AI steps described above.
• Google, Microsoft or Apple, only if you choose to sign in with them.

These providers may store or process data outside South Africa, mainly in the European Union and the United States. We only use providers bound by data protection terms that give protection substantially similar to POPIA, as section 72 requires. We may also disclose information when the law requires it.

How we protect it

Everything travels over encrypted connections. Passwords are hashed, two-step sign-in is available, repeated wrong passwords lock an account for 15 minutes, and each person only sees their own workspace and what their role allows. Password-reset links, invitations and access keys are stored only as one-way hashes. If we believe your information has been accessed without permission, we will tell you and the Information Regulator as POPIA requires.

How long we keep it

• Inquiries: while we’re in touch about them, and no longer than 24 months after our last contact unless you become a client.
• Sign-in attempt records: about 30 days.
• Accounts, workspace records and activity logs: while the client’s contract runs, then deleted or returned as agreed.
• Quotes, invoices and payment records: as long as tax and company law require (up to seven years).
• Tips emails: until you unsubscribe.

Your rights

Under POPIA you can, at any time:

• ask whether we hold information about you and get a copy of it;
• ask us to correct, update or delete it;
• object to us using it, and withdraw consent you gave;
• refuse direct marketing, which we’ll stop straight away.

Email harmseofficial888@gmail.com. We may ask you to confirm who you are before we act, and we’ll reply within 30 days. If you’re unhappy with how we’ve handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Thaw is not meant for children, and we don’t knowingly collect information about anyone under 18.

Changes to this notice

When Thaw changes in a way that affects your information, we update this page and the date below. If the change is significant and we have your email, we’ll tell you.

Information officer

Danio Harmse, harmseofficial888@gmail.com.

Last updated: 19 October 2026