Velorax ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect the information you provide when you use our website at velorax.org and our services.
We comply with the Protection of Personal Information Act (POPIA) of South Africa and respect the data protection rights of all users, including those protected under the General Data Protection Regulation (GDPR) for users in the European Economic Area.
Who We Are
Velorax is the trading name of Shawn Mbule, a sole proprietor in South Africa, who is the responsible party for your personal information under POPIA and our Information Officer. Velorax is an online business: we work remotely and have no public office. The way to reach us about anything in this policy is shawnbussa9@gmail.com.
1. Information We Collect
Information you provide directly
When you use our contact form or engage with our services, we may collect:
- Full name
- Email address
- Company name (optional)
- Company website URL (optional)
- Monthly ad spend range (optional)
- Service interest selection
- Message content
Information collected automatically
When you visit our website, we may automatically collect:
- IP address (used for rate limiting and security; stored in our leads database)
- Browser type and user agent string (stored with form submissions)
- Pages visited and time spent
- Referring website
- Device type and screen resolution
We use PostHog (product analytics) to see which pages and forms people use, and when you submit a form we record that event in PostHog against your email address, so we can see which page led to the enquiry. PostHog sets a first-party cookie; if you choose Decline in the cookie banner, analytics is switched off on your device. We also use Vercel Analytics for performance monitoring, which does not use cookies or track individual users across websites.
If we contacted you before you contacted us, section 11 explains what we hold about you, where it came from, and how long we keep it.
2. How We Use Your Information
We use the information we collect to:
- Respond to your enquiries and provide requested services
- Send you a confirmation email when you submit our contact form
- Prepare audit reports, proposals, and project documentation
- Improve our website and services
- Protect against spam, abuse, and security threats
- Comply with legal obligations
We do not sell, rent, or share your personal information with third parties for marketing purposes.
3. Legal Basis for Processing
We process your personal information based on:
- Consent: When you submit our contact form, you consent to us processing your data to respond to your enquiry.
- Legitimate interest: Website analytics and security measures to protect our services.
- Legitimate interest: Researching businesses that may benefit from our services, and contacting the people who run them (see section 11).
- Contractual necessity: When you engage our services, we process data necessary to fulfil the agreement.
4. Data Storage and Security
Contact form and audit request submissions are processed and stored as follows:
- Database: Form submissions are stored in a secure Supabase (PostgreSQL) database. Each record includes the form data you submitted, your IP address, browser user agent, whether a confirmation email was sent, and a timestamp. This data is used to manage and respond to enquiries.
- Email: A copy of your submission is delivered to our team via Resend (our email provider). You also receive an automated confirmation email acknowledging your submission.
We implement appropriate technical and organisational measures to protect your data, including:
- HTTPS encryption on all pages
- Content Security Policy (CSP) headers
- Rate limiting on API endpoints (IP-based, with standard rate-limit headers)
- Schema-based input validation (type checks, length limits, allowed values)
- Input sanitisation to prevent injection attacks (HTML stripping)
- Bot detection (honeypot fields)
- Row-level security on database tables
- Environment-based secret management (API keys are never exposed client-side)
5. Third-Party Services
We use the following third-party services that may process your data:
- Vercel — Website hosting and analytics (USA). Privacy Policy
- Resend — Transactional email delivery (USA). Privacy Policy
- PostHog — Product analytics (USA). Privacy Policy
- Cal.com — Call booking, only if you choose to book a call (USA). Privacy Policy
- Supabase — Database hosting and storage (USA). Privacy Policy
- Google Workspace — Our business email (USA). Privacy Policy
- Apple iCloud — Storage and backup of our working files, including our records of the businesses we contact (USA). Privacy Policy
- Anthropic — AI assistance we use to research businesses and draft messages; a person reads and sends every message (USA). Privacy Policy
- LinkedIn — Where we message most of the people we contact, under LinkedIn's own terms. Privacy Policy
These providers are selected for their strong privacy practices and data protection measures. Your data may be transferred to and processed in the United States, where these providers operate.
6. Data Retention
Contact form and audit request submissions stored in our database are retained for up to 24 months from the date of submission. After this period, records are deleted unless you have become a client, in which case data is retained for the duration of the engagement plus any legally required retention period.
If we contacted you first, the retention rules in section 11 apply instead.
Email copies of submissions are retained in our inbox in accordance with our email provider's retention policies.
You may request deletion of your personal data at any time by contacting us at shawnbussa9@gmail.com. Upon request, we will delete your data from both our database and email records within 30 days.
7. Your Rights
Under POPIA (and GDPR where applicable), you have the right to:
- Access — Request a copy of the personal data we hold about you
- Correction — Request that we correct inaccurate data
- Deletion — Request that we delete your personal data
- Objection — Object to the processing of your data
- Portability — Request your data in a structured, machine-readable format
- Withdraw consent — Withdraw your consent at any time
- Stop direct marketing — Tell us to stop contacting you, and we will
To exercise any of these rights, please contact us at shawnbussa9@gmail.com. We will respond within 30 days.
We do not use advertising cookies. PostHog sets one first-party analytics cookie so we can see which pages help people; choose Decline in the cookie banner and analytics stays off on your device. Vercel Analytics is cookie-free. Essential cookies may be set by our hosting provider for security and performance.
9. Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.
We research businesses that may benefit from our services and contact the people who run them, mostly by LinkedIn message. If that is how you heard from us, this is what we hold.
- What: your name, your business, your role, your business website, your public LinkedIn profile address, a business email address or phone number where your website publishes one, notes on what we found on your business's public website, and the messages we exchanged.
- Where it came from: your business's own website, your public LinkedIn profile, and public business directories. We do not buy lists, and we do not collect special personal information.
- Why: to judge whether our services could help your business, and to tell you about them.
- Who else sees it: only the services listed in section 5, which process it on our behalf. We never sell it or pass it to anyone else.
How long we keep it
- If you never reply, we delete your details 12 months after our last message, keeping only your business's web address so that we do not contact you again.
- If you reply, we keep the conversation for 24 months after our last contact, the same as a website enquiry.
- If you ask us to stop, we stop, and we keep a note that you asked so that it stays that way. If you also want your details deleted, say so and we delete them within 30 days, keeping only that note.
To see what we hold about you, correct it, have it deleted, or stop hearing from us, reply to our message or write to shawnbussa9@gmail.com.
12. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.