Privacy Policy

Policy version 2026-08-03-3. This is the version you agree to when you create a ClearPath Justice account, and the version recorded against your account at that time.

1. Who we are

ClearPath Justice aims to help people determine whether they qualify for criminal record expungement in South Africa, and to assist with preparing the paperwork. We are the responsible party for the personal information described below, as defined under POPIA. Our registered legal entity name and registration number will be published here before this moves out of early access — see our Contact page if you need this information sooner.

2. What we collect

• Account information: full name, email address, phone number, password (stored as a salted hash, never in plain text).
• Special personal information (POPIA section 26): criminal record details you tell us about directly (for example, through our Quick Screener or when contacting our team), including offence descriptions, dates, courts, and sentences, and your ID number where you provide one. Automated extraction of this information from an uploaded document is planned but not live yet — see below.
• Uploaded documents: you can upload your SAPS criminal record and supporting documents (PDF, JPG, or PNG) today. We currently record only metadata about the upload (file type, a checksum, and a virus-scan status) — the file content itself is not retained after the upload request completes, because encrypted long-term document storage is still in development. Do not treat ClearPath Justice as your only copy of any document.
• Usage information: login timestamps, IP address, and device/browser information, kept for security and audit purposes.
• Chat history with the AI Assistant, kept for support and audit purposes.

3. Why we collect it (lawful basis and purpose limitation)

We process your information only for the purpose you gave it to us for: assessing your eligibility for expungement and preparing your application and supporting documents. We do not use your criminal record data for marketing, advertising, or analytics, and we do not sell your information to anyone. Our lawful basis is your explicit, informed consent, captured and timestamped when you register, and re-confirmed if this policy changes in a material way.

4. How your information is protected

Special personal information — your ID number and offence details — is encrypted at the field level (AES-256-GCM) in addition to standard database encryption, so that even a raw backup does not expose it in plain text. All traffic to and from ClearPath is encrypted in transit (TLS). Access to your case is restricted to you and the reviewer(s) assigned to your case, enforced on every request, not just hidden in the interface. Every access to your documents, every AI eligibility check, and every reviewer decision on your case is logged in a tamper-evident audit trail. Full technical detail on our security architecture is available on request — see our Contact page.

5. Human review of eligibility results

No eligibility result is ever your final legal outcome without human involvement. Today, this happens in one of two ways: our Quick Screener applies a fixed, published decision tree for cannabis-related convictions and tells you directly that its result is an estimate, not a final decision; for every other type of case, a member of our team reviews your situation directly once you contact us. We are building an automated eligibility-analysis step (extracting offence details from an uploaded document and checking them against expungement law) to run ahead of human review — it is not live yet, and no eligibility decision is currently generated by that automated step. This policy will be updated the day it goes live.

6. Who we share information with

We do not share your information with third parties except: (a) service providers who process data on our behalf (for example, our cloud hosting provider); (b) a partner attorney, paralegal, or ClearPath team member directly assigned to your case, where applicable; or (c) where required by law. We do not share your criminal record information with employers, credit bureaus, or any other party without your explicit instruction. Messages you send through our Contact form are currently delivered to a monitored ClearPath team inbox so we can respond quickly during early access; this will move to a dedicated support mailbox before general availability.

7. How long we keep your information

We intend to retain your case data only for as long as needed to complete your case, plus a limited period afterward in case you need to follow up or as required by law. An automated job runs daily to purge expired or used login-session and password-reset records once they are no longer needed (currently 30 days). You can also request deletion of your own account and its data at any time — see section 8 — which takes effect immediately rather than waiting for the scheduled job.

8. Your rights

Under POPIA, you have the right to:

• Access the personal information we hold about you.
• Request a copy of your data in a portable format.
• Correct inaccurate information.
• Request deletion of your account and associated data ("right to erasure").
• Object to processing, or withdraw consent, though this may mean we can no longer assist with your case.
• Lodge a complaint with the Information Regulator of South Africa if you believe we have mishandled your information.

Self-service tools are available now: from your dashboard's Account & Data page you can download a full export of your data (JSON) and permanently delete your account at any time — both take effect immediately, with no need to contact us first. Correction of inaccurate information, objection to processing, and complaints to the Information Regulator can still be exercised by contacting us — see our Contact page. We aim to respond to any such request within the timeframe required by POPIA.

9. Where your data is stored

Our infrastructure is currently hosted with a general-purpose hosting provider; we have not yet completed a data-residency review to confirm which country its servers are physically located in. We will update this section with a confirmed answer, and complete any cross-border transfer safeguards POPIA section 72 requires if the answer is outside South Africa, before this moves out of early access.

10. Security incidents

If a security incident occurs that compromises your personal information, we will notify the Information Regulator and affected users as required under POPIA section 22, as soon as reasonably possible.

11. Children and diversion records

Our platform is intended for adults managing their own criminal records. Where a record relates to a diversion order made when you were under 18, we handle that information with the same protections described above, for the sole purpose of assisting you (now an adult) with your own record.

12. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you logged in securely and to remember your display preferences (such as light or dark mode). We do not use third-party advertising or tracking cookies.

13. Changes to this policy

The version number at the top of this page identifies which version applied when you registered. If we make a material change, we will post the update here and note the new version date; an automatic re-consent prompt on login is planned but not built yet, so please check back periodically or contact us if you want to confirm which version currently applies to you.

14. Contact us

For any privacy question, or a data access/export/deletion request, please use our Contact page. We will name our registered Information Officer here before this moves out of early access.