Privacy
How AdvannoSmart (Pty) Ltd handles personal information in the VantageID portal and licensing service. This note is written to answer POPIA and GDPR questions from customers and their information officers.
The short version
The VantageID SDK decodes documents on the device. No document or barcode data is ever sent to us. The portal holds what it needs to sell licences, enforce them and support you, and nothing more.
What we store
- Account data: the names and email addresses of the people in your organisation who use the portal, their role, and whether two-factor authentication is on.
- Organisation billing details: legal and trading name, country, VAT number, billing address and billing email, plus your orders, invoices and credit notes.
- Licence and seat records: your licences, how many seats each has, and which seats are in use.
- Device fingerprints, as hashes only: for each activated device, the salted SHA-256 hashes of hardware identifiers that the SDK computes on the device (section 3 of the licensing protocol). The salt includes your licence key, so the same device has unrelated hashes under different keys, and the raw values cannot be recovered from them.
- Device metadata: platform, manufacturer, model, OS version, app ID and app version, SDK version, when the device was first activated and last seen, and the IP address of activation calls, which is kept in the audit log.
What we never receive
- Document or barcode data: no names, ID numbers, licence numbers, photos or any other field decoded from a document.
- Raw hardware identifiers, MAC addresses or IMEI numbers.
- Card numbers or other payment card data.
Why we hold it
- Licence enforcement: to bind each seat to one device and stop a key being used on more devices than were bought.
- Billing: to issue quotes, pro-formas, tax invoices and credit notes, which we must keep under South African tax law.
- Support: to help you find a device, move a seat or diagnose an activation problem.
- Fraud prevention: to spot leaked keys and unusual activation patterns.
Service providers
- Payfast processes card payments. You enter card details on Payfast's pages; the portal never sees them and only receives the payment result.
- Resend sends our emails (verification, invoices, release notices).
- Cloudflare R2 holds files: SDK releases, invoices, credit notes and pro-formas.
Your rights and contact
You can ask to see, correct or delete personal information we hold about you. Some records, such as tax invoices and the audit log, must be kept for legal and security reasons. Write to privacy@advannosmart.co.za.
See also the SDK documentation.