Privacy Policy
This explains what personal information FlockTrial holds, why, and what you can ask us to do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).
FlockTrial is a FarmBind product. It is operated by FarmBind (Pty) Ltd (registration number 2026/788176/07), a South African company ("we", "us").
1. Who is responsible for what
FlockTrial is used by organisations (a consultancy, a university, a research unit) to capture and analyse animal feeding trials. Each organisation contracts with us.
- Trial data. For everything captured or uploaded in a trial — the trial's setup, treatments, feeds, pens and birds, daily captures, costs, methodology, objectives, results files and exports — your organisation is the responsible party and we are its operator. We process that data only on your organisation's instruction. The Data Processing Agreement sets out how. Questions about trial data, including any request to see or correct it, go to your organisation first; we will help it answer.
- Your account and our own records. For your user account and login details, and for our own records (invoices, the audit trail, security and error logs), we are the responsible party. This policy is mainly about those.
POPIA also protects information about companies and other juristic persons, so the same split applies to information about your organisation and about a trial's sponsor.
2. What we hold about you
Given to us by your organisation's administrator, or by us when we set up your organisation:
- your name, your email address (used as your login name, not to send you mail), your role (client admin, researcher or capturer) and the trials you are assigned to;
- for the organisation: its name, and a contact person's name and email address, which we keep for our own records.
Created when you sign in and use FlockTrial:
- your password, which our authentication provider stores only in hashed form — we never see it;
- if you set up two-factor authentication (an authenticator app), that enrolment, held by our authentication provider, and the date you enrolled;
- sign-in records: whether a password or code step passed or failed, and when. We use these to lock an email address out after repeated failures. We store a keyed hash of the email address for this, not the address itself;
- session and sign-in information that our authentication provider records, including your IP address and browser details;
- the audit trail: every change made in FlockTrial is recorded with who made it, their role, when, what changed (old value → new value) and the reason given;
- error reports when something breaks: the time, the page or action, a reference code and technical detail, and your user and organisation identifier. Error reports do not contain what you typed or captured.
On your device: FlockTrial uses only the cookies it needs to keep you signed in (the authentication session cookie). It also remembers a few screen preferences in your browser's own storage, such as which capture groups are open or whether a side panel is collapsed. We use no analytics, advertising or tracking cookies, and no third-party tracking scripts.
We do not send email from the platform. A new user receives a one-time setup link from the person who created their account; password and two-factor resets work the same way.
3. Why we hold it
- To let you sign in securely and show you your organisation's trials, and nothing else.
- To keep an honest record of who changed what, so a trial's data can be relied on by a sponsor, an ethics committee or a reviewer.
- To keep the platform working, secure and free of abuse (sign-in lockout, error investigation).
- To support you when you or your organisation ask us.
- To invoice your organisation and keep the records tax law requires.
- To tell you about changes to these policies.
We do not sell personal information, use it to advertise to you, or use trial data for our own purposes.
4. Who can see your information
- People in your organisation, according to their role. Your name appears in the audit trail and next to the entries you make, so anyone who can see a trial and its audit trail can see that you made a change.
- Us, as the people who run the platform. Through the admin screens we see organisations, users, trial setup and status, the audit trail and error reports, and we can produce a trial's export when your organisation asks us to. We do not capture data in your trials. We reach data directly only to fix a problem or to do what your organisation has asked, and that access is itself logged.
- Our suppliers, listed below, who host or process data on our behalf.
- Anyone the law requires us to disclose it to. We will tell your organisation first unless the law forbids it.
5. Our suppliers
| Who | What they do | Where |
|---|---|---|
| Supabase | Holds the database (including uploaded files and its backups), sign-in and two-factor authentication | Sweden (EU) |
| Vercel | Runs the web application | EU region (Sweden) |
| Domains.co.za | Hosts the support@farmbind.com mailbox, which carries email you send us | South Africa |
Some of these suppliers may store or process information outside South Africa. POPIA (section 72) allows this where the recipient is bound by law, binding rules or an agreement that gives protection comparable to POPIA. Each supplier we use is bound by terms that require it.
6. How long we keep it
- Your user account — while your organisation uses FlockTrial. When a user is deactivated the account stays (deactivated) because the audit trail must keep showing who made each entry. It cannot sign in.
- The audit trail — as long as the trial it belongs to. It cannot be edited or deleted through the platform, by anyone, including us.
- Trial data — as set by your organisation and the Data Processing Agreement: kept for one year after a trial is locked, or until your organisation asks us to remove it after it has exported everything. Your organisation should keep its own copy of the final export for as long as its ethics or publication rules require.
- Sign-in records and error reports — as long as we need them to keep the platform secure and to investigate problems, and no longer than 12 months.
- Invoices and payment records — five years, as tax law requires.
- Backups — our database provider's daily backups roll off as newer ones replace them, within 30 days. Something removed from the live platform can therefore remain in an encrypted backup until that copy expires.
7. Your rights
You may ask us to:
- tell you whether we hold information about you, and show you what it is;
- correct anything that is wrong;
- delete what we no longer need to keep;
- object to how we process it, where the law gives you that right;
- stop sending you anything that is not a service message.
Some things cannot be deleted while a trial exists: your name in the audit trail is part of that trial's record. For trial data, we pass your request to your organisation, which decides as responsible party, and we help it.
Email support@farmbind.com. If you think we have handled your information badly, tell us first. You may also complain to the Information Regulator of South Africa (www.inforegulator.org.za).
8. Keeping it safe
- Every user signs in with a password. Each user can add an authenticator app code as a second step, and we recommend it; once set up, it is asked for at every sign-in. Our own platform-owner account always uses it.
- One organisation's login cannot reach another organisation's data. All data is read and written by our server, never directly from your browser, and every query is limited to your organisation; the database refuses writes that cross organisations. These limits are covered by automated tests.
- Repeated failed sign-ins lock the email address out for a while.
- Traffic is encrypted, and the database and its backups are encrypted at rest by our database provider.
No system is perfect. If personal information is accessed or acquired by someone who should not have it, we will tell the people affected (or the organisation that is responsible for it) and the Information Regulator as soon as reasonably possible, as POPIA (section 22) requires.
9. Children
FlockTrial is for organisations and their staff and students. It is not for children, and we do not knowingly collect a child's information.
10. Changes
We may update this policy. If a change is material we will tell your organisation's administrators before it takes effect. The version and its effective date are shown at the top of this page.
11. Contact
FarmBind (Pty) Ltd, registration number 2026/788176/07.
Our Information Officer can be reached at support@farmbind.com.
We answer privacy requests ourselves.