Privacy policy

Who we are

Terrain is a product of MYE Investments Pty Ltd, a company registered in South Africa (“we”). You can reach us at privacy@terrainhq.net.

Our role

Terrain is used by organisations that run projects on inhabited land, such as a road or a mine, to manage resettlement, compensation, livelihoods, grievances, engagement and training. Each of these organisations, our client, decides what information its project collects and why, and is responsible for it. We process that information on the client’s behalf, only on its instructions and under a written agreement.

If you are a person affected by a project, the best first contact is that project’s community liaison or grievance office. You can also write to us, and we will pass your request on to the project.

Information about people affected by a project

Depending on the project’s procedures, its staff may record:

• names, dates of birth, sex, household members, and relationships such as spouses and representatives;
• identity document numbers and photos of identity documents, including voter cards;
• photos of people, structures, land and other assets, and where those assets are;
• details of land, structures, crops and other assets, and their values;
• agreements, entitlements, payments, and bank or mobile-money details;
• grievances and how they were handled, including whether a complainant asked for confidentiality;
• attendance at meetings and training sessions.

This information is collected to establish who is affected and what they are entitled to, and to show that the commitments made to them are kept, as the law and the project’s lenders require. Children may be recorded as members of a household.

Information about people who use Terrain

For project staff who sign in, we hold their name, email address, organisation, role and the areas they work in; when they sign in; and a record of the changes they make and of each sensitive item they reveal. We use it to give each person the access their role allows and to keep an audit trail.

The field app on your device

The Terrain field app asks only for what it needs:

• Camera: to read the QR codes on tokens and voter cards, and to take photos for the record. The text on a card is read on the device.
• Location, only while the app is in use: to record where a token is issued and where an asset is.
• Photos: the app saves a copy of each photo it takes in a Terrain album on the device, as a backup. It cannot see your other photos.
• Face ID or fingerprint, if you choose: to open the app instead of typing the PIN. The app never receives your biometric data.

Records waiting to be sent are kept in an encrypted store on the device, behind a 6-digit PIN, and are erased when you sign out or after 10 wrong PINs.

The app has no advertising, no analytics and no tracking, and shares nothing with advertisers or data brokers. Demo mode uses invented data that stays on the device.

Where information is kept and who processes it

Each client has its own database, placed in the region the client requires; one client cannot see another’s data. We use these service providers to run Terrain, each bound by contract to protect the information:

• Supabase: the database, sign-in and file storage;
• Vercel: hosting of the web app and of this website;
• Google: Cloud Run for checking uploaded files for viruses, and AppSheet and Google Drive where a project still uses AppSheet in the field;
• Resend: sending emails, such as sign-in and password messages;
• Anthropic: translating catalogue names, and an AI assistant only where the client has agreed in writing, never with restricted information;
• Expo: building the field app; it receives no personal information.

Information may be stored or processed outside the country where it was collected. Where it is, it stays under the client’s agreements and the safeguards the applicable law requires. We do not sell personal information.

How we protect it

Every connection is encrypted, and so is storage. Identity numbers are encrypted inside the database, shown masked, and each reveal is recorded. Access is limited by module, role and area. Uploaded files are checked for viruses before they are attached. A staff account can be switched off at once.

How long we keep it

For as long as the client’s agreement with us and the project require. When a project closes, its data is handed over to the client and deleted from Terrain.

Your rights

Depending on the law that applies to you, you may ask to see the information held about you, to have it corrected, to object to its use, or to have it deleted where the project does not need to keep it. Write to the project or to privacy@terrainhq.net; we will answer, or pass your request to the client and tell you we have.

You can also complain to the data protection authority in your country. In South Africa, this is the Information Regulator.

This website

terrainhq.net sets no cookies and uses no analytics. Our hosting provider keeps short-lived technical logs, including IP addresses, to keep the site secure.

Changes to this policy

When our practices change, we update this page and the date at its top.

Contact

privacy@terrainhq.net
MYE Investments Pty Ltd