Privacy notice

Version 1.7, published 27 October 2026. Not yet reviewed by counsel. It replaces versions 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 and 1.6 and is written to be read: what we do, why, where your information goes and how long we keep it.

1. Who we are

Splice Computers (Pty) Ltd, trading as Venuo, a product of Yielde (reg. 2019/272712/07), 55 York Street, George, Western Cape, 6529 ("we"). This notice explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Information Officer: Maria Cornelia Magrieta Botha, sole director, reachable at [email protected] or 063 611 2952. Signing for Venuo: Chris Botha, authorised representative.

2. Our two roles

• For our clients (the venues that use the desk, and the people who sign in for them), for visitors to our website and demo pages and for anyone who writes to us, we are the responsible party: sections 3 to 6 cover that.
• For the people who enquire with a venue, the venue is the responsible party and we are its operator, under a written operator agreement: section 7 covers that.

3. This website

venuo.co.za has no forms and runs no analytics of its own. Its fonts and files are served from venuo.co.za itself, except Meta's pixel if you allow it (below). If you choose light or dark mode, your browser remembers that choice on your device; it isn't sent to us. If you arrive from one of our ads, the campaign labels in the link (for example "test-week-1"), and Meta's click identifier if you pressed Allow, are kept in your browser until you close the tab and added to the links to our dashboard, so that we can count sign-ups per ad; they contain no personal information. The site is served by Cloudflare, which processes technical data such as your IP address and browser details to deliver and protect it.

Measuring our ads. We advertise on Facebook and Instagram, and a card on venuo.co.za asks whether you allow us to measure those ads. Nothing goes to Meta unless you press Allow; your answer is kept in one cookie, venuo_consent (section 10).

• What we collect, if you allow it. On venuo.co.za, Meta's pixel loads and tells Meta which of our pages your browser visited (and the other browsing events the pixel records by itself), with Meta's cookie identifiers (_fbp, _fbc) and your IP address and browser details. On our dashboard (app.venuo.co.za) we send Meta three events through its Conversions API: when you send the sign-up form (with Meta's identifiers and your IP address and browser details, but no email address), when you first sign in to your new account, and when your first payment is confirmed (with the amount and the plan). The last two carry your email address and our account number for you, each hashed (SHA-256), and Meta's identifiers. Meta can match a hashed address to its own accounts, so hashing does not make it anonymous. After the sign-up form, the page also asks Meta's server for a tiny image that records the same event. We keep Meta's click and browser identifiers on your account.
• What we keep without it. The campaign labels of the ad you came from, on your account and on your payments. They contain no personal information and nothing goes to Meta.
• Why. To see which of our ads lead to sign-ups and payments, and so that Meta can show our ads to people like those who signed up. Our basis is your consent (POPIA s.11(1)(a)).
• Your choice. Press No thanks and the pixel doesn't load, nothing is sent to Meta and the site works the same. You can withdraw at any time. On venuo.co.za, Ad measurement settings in the footer stops the pixel and removes Meta's cookies in that browser. To stop the events about your account as well, use Settings → Ad measurement in the dashboard, which deletes the Meta identifiers we stored and stops every further event, or email [email protected]. Withdrawing doesn't undo what was already sent.
• Where it goes. Meta Platforms Ireland Ltd and Meta Platforms, Inc. (United States) receive it, outside South Africa (section 9).

4. What we collect about our clients

• Your account: your name and email address, and the venue you sign in for. The name you type when you sign up is kept with your sign-in record (the token) until that record is deleted (section 12).
• Signing in: when you ask for a sign-in link or code, we store your email address, a hash of the link and of the 6-digit code, the number of wrong tries and a keyed hash of your IP address (to stop abuse). A link or code is valid for 15 minutes and works once.
• Your session: when you are signed in, your browser keeps a random value in a cookie (section 10); we store only its hash, with the times it was created and last used. A session ends after 30 days without use and 90 days after sign-in at the latest.
• Your venue's profile and settings: what you enter during onboarding and afterwards, such as the business name, legal address, answers, prices, viewing times, blocked dates, contact addresses and settings.
• Payments: the payment reference, plan, amount, status and dates (monthly payments, automatic renewals and packs of extra enquiries), the numbers of your tax invoices and credit notes, with what they said when they were issued, any referral code you used, and the campaign labels of the ad you came from (section 3). Paystack processes the payment itself as its own responsible party, under its own privacy policy; we never see or store your card number.
• Automatic renewal: if you pay by card, Paystack gives us a token for your card so that we can charge it each month; we store the token, the card brand, the last 4 digits and the expiry date, and a record of the renewal wording you were shown when you paid (its fingerprint, the time, your IP address and browser).
• Acceptances of our terms and operator agreement: the document, its version and the fingerprint (sha256) of the exact text, the time, your IP address and your browser's user agent (the first 256 characters). For the operator agreement we also keep the name and capacity you typed and the company name. You accept both on the payment page, before you pay, while signed in; the record is tied to your account.
• Your choices: whether your venue receives News from Venuo (section 11), and whether you allowed ad measurement (section 3).
• An audit log of sign-ins, acceptances, payments, stops and setting changes, with times and no message text. If you switch automatic replies on during your desk's first days, it records who did so, when, and which warning you were shown.
• The Ask box: we keep the time, the size and the cost of each question, never the question or the answer.
• If you email or phone us: your name, contact details and what you tell us. Our own email ([email protected]) is hosted by Google, outside South Africa.

5. Why we use it

• To run the service you signed up for: sign you in, keep your desk working, renew your plan if you pay by card, answer you and support you (performing our contract with you, POPIA s.11(1)(b)).
• To invoice you and keep tax records (the law requires it, s.11(1)(c)).
• To keep the service secure and to keep evidence of what was agreed, including the renewal wording you were shown (our legitimate interest, s.11(1)(f)).
• To count sign-ups per ad from the campaign labels (our legitimate interest, s.11(1)(f)), and to measure our ads with Meta only if you allow it (your consent, s.11(1)(a); section 3).
• To tell you about the service (section 11).

We don't sell personal information, and we don't use it to train AI models.

6. If we asked your venue for permission to contact it

We may write once to a business's published address only to ask, in the form the POPIA Regulations prescribe, whether it agrees to hear from us about Venuo (POPIA s.69(2)). We keep a do-not-contact list of the businesses that said no or asked us to stop, so that we never contact them again, and a note of who we asked and when, so that we don't ask twice. If a business does not answer, says no, or asks us to stop, we never write to it again, and we send nothing else to it until it agrees. You can ask us to take your address off that list, or to tell you what we hold about you, at [email protected].

7. People who enquire with a venue that uses Venuo

The venue is responsible for your enquiry. We process it for the venue, only to answer you: your enquiry and the later messages in the same conversation, the replies, the venue's record of you as a lead (status, history and a short note of any special request) and any viewing you agree to. Replies ask you to answer to the venue's desk address, so your answers come back to the desk, which answers them the same way: from the venue's own words, prices and viewing times.

An AI reads your message. An AI model reads each message to sort it: what you ask, your dates and guest numbers. It doesn't write the replies. Each reply is built from the venue's own words; the only words the AI supplies are your name and your event date as it read them from your message, checked by fixed rules. A reply says whether it was sent automatically or checked by the venue. No decision with legal effect on you, or that significantly affects you, is made by automated means alone: the desk only decides whether an enquiry gets an automatic reply or goes to the venue, and wherever it is unsure the venue decides. The venue can switch automatic replies off at any time.

Special and children's information. The desk doesn't ask for health, religion, race, sex life, biometric, political, union or criminal information, or for a child's information, and the AI is told not to note it. If you volunteer something like that in your own words, for example an access, dietary or religious need, the desk doesn't interpret it: the venue gets it as a request and decides, and the text is deleted on the schedule in section 12.

Your requests. If you ask to see, correct or delete your information, object, or ask for no more messages (STOP), the desk never answers that automatically: the venue gets it as a draft to answer, and we are alerted, whether it is your first message or a reply. Please read the venue's own privacy notice, and send your requests to the venue. If a request reaches us, we pass it to the venue within 2 working days. You never get marketing from us, and nothing about you goes to Meta.

The stop record. When you ask the desk to stop, object or delete, it keeps a short record so that it never answers you automatically again: a fingerprint (a SHA-256 hash) of the venue's identifier and your address, what you asked and when. It is not your address, but addresses are guessable, so we treat it as personal information. It is kept only when the desk could verify that the message really came from your address (it must arrive by email and Cloudflare must have verified the sender; a web-form notification is not kept). It survives the 90-day purge and a request to delete your enquiry, because it is the proof that your request was honoured (the venue's duty under POPIA s.11(4) and, for marketing, s.11(3)(b) and s.69, and your own interest in being left alone), and it is deleted when the venue is deleted. Each such request is also emailed to Venuo's operator mailbox as one line with your address in encrypted form, which only we can decrypt, so that after a database restore we can apply it again; that line stays in the mailbox. If you want to be taken off it, for example to be answered again, ask the venue, or write to [email protected] and we take it to the venue; once the venue asks us in writing, we remove it within 5 working days.

8. Service providers and where they are

Each is bound by written data-processing terms that cover security, confidentiality and onward transfer. All are outside South Africa:

• Cloudflare, Inc. runs the website, the desk and the dashboard, receives enquiries and stores the desk's database (in the European Union). Its technical logs of the desk hold codes and counts only.
• Resend, Inc. sends the desk's emails, including sign-in emails and replies, from its Ireland region, and keeps delivery logs for up to 30 days. Resend is a United States company.
• OpenRouter, Inc. (United States) routes each AI call. Anthropic's Claude models (Claude Haiku 5.5 for every venue, and Claude Sonnet 5.5 when Haiku 5.5 fails twice on one message; but for a venue whose desk started before 27 October 2026 and that we keep on its earlier models, Claude Haiku 4.5, and Claude Sonnet 5 when Haiku 4.5 fails twice) run on Amazon Web Services (Amazon Bedrock) or Google Cloud (Vertex AI), under zero data retention: they keep no copy and don't train on it. We don't choose the region within these hosts; we expect the United States.
• Google hosts our own email ([email protected] and the mailbox that receives our operational alerts, which carry codes, venue names and counts, never an enquirer's name or message).

Paystack processes payments as its own responsible party, under its own terms and privacy policy; if you pay by card, it keeps your card and charges it for each automatic renewal. Meta (Meta Platforms Ireland Ltd and Meta Platforms, Inc.) receives the ad-measurement data in section 3, and only if you allowed it.

9. Transfers outside South Africa

Your information is processed in the United States and the European Union. We transfer it because it is necessary to perform our contract with you, or the steps you asked for before it (POPIA s.72(1)(c)), and because each provider is bound by written terms that give adequate protection, including limits on onward transfer (s.72(1)(a)). Ad-measurement data goes to Meta only on your consent (s.72(1)(b)), which you can withdraw (section 3). For enquirers, the venue's operator agreement sets out the same basis.

10. Cookies

The dashboard (app.venuo.co.za) uses two strictly necessary cookies. One keeps you signed in: it lasts 30 days from when you last used the dashboard and ends at the latest 90 days after you signed in; your browser keeps only a random value, and we store only its hash. The other is set on the sign-up and sign-in pages for 2 hours, to protect those forms from forgery. Two more are set only when the link you followed carries them: __Host-venuo_ref, on the sign-up and sign-in pages for 3 days, holds a referral code so that the payment page can fill it in; and __Host-venuo_ad, on the sign-up, sign-in and "try the desk" pages for 30 days, holds our campaign labels, and Meta's click identifier only if you pressed Allow. The dashboard also reads venuo_consent, below, and if you withdraw under Settings → Ad measurement it sets venuo_consent to "denied" and removes Meta's cookies. It sets no other cookie.

The website venuo.co.za sets one cookie, venuo_consent, when you press Allow or No thanks on the "Measuring our ads" card. It holds only your answer, lasts 180 days, and is shared with the dashboard so that both follow the same choice. Only after you press Allow does Meta's pixel load and set Meta's own cookies (_fbp, _fbc); withdrawing removes them.

11. News from Venuo

Your venue's 07:00 email may carry one short line of News from Venuo about the service (new features, changes, tips). Every such email has a link to switch it off, and when you sign up you can tick “Don’t send me News from Venuo” on the payment page; we store that choice for your venue. If we send our clients a separate marketing email about the service, as POPIA s.69(3) allows for existing customers, it carries a way to opt out and we honour that choice. Messages about your account (sign-in, billing, renewal notices, security, changes to our documents) are not marketing. The people who enquire with a venue never get marketing from us.

12. How long we keep it

• Each enquiry, later message and reply: 90 days after it was received or sent, then deleted by a daily purge. A lead's record, its history and viewings: 90 days after the latest message in the conversation or, if later, after the latest viewing that is booked, moved, held or missed (a cancelled viewing does not count). Metadata with no message text (times, counts, keyed hashes): 13 months.
• Sign-in links and codes: deleted 2 days after they expire. Sessions: deleted 2 days after they expire.
• An account that never started a desk and is unused for 90 days: deleted, with its onboarding draft.
• When a venue is deleted (the client asks, or the service ends): its accounts, settings, leads, history, viewings, availability and opt-outs are deleted. The one exception is the encrypted ledger line of each stop or deletion request (section 7), which stays in our operator mailbox.
• Payments (reference, plan, amount, status, dates, invoice and credit-note numbers, and the campaign labels): 7 years after the latest of the payment, refund and billing-period end dates, as accounting and tax records (Companies Act, VAT Act, Tax Administration Act), and longer while an audit or objection is open, then deleted.
• Acceptances of our terms and operator agreement (as in section 4), and the record of the renewal wording you were shown: 5 years after the contract ends (the day the venue is deleted), as evidence of the contract, then deleted.
• Card token: deleted when automatic renewal is switched off or ends (after the last failed charge, or when the card has expired), and when your venue or account is deleted. The card brand, last 4 digits and expiry go when your venue or account is deleted.
• Meta identifiers on your account: deleted when you withdraw consent (section 3) or when your account is deleted. The campaign labels on your account go with your account.
• Backups. We keep no copies of the database ourselves. Cloudflare keeps restore points for a limited time, and we use one only to repair corruption; afterwards we re-apply every deletion made since.
• Emails with us: as long as we need them to deal with what they are about.

13. Security

Everything is sent over HTTPS. We store only hashes of sign-in links, codes and session cookies, limit wrong codes and mail volumes, sign and expire the links in our emails, check the sender before the desk answers automatically, keep secrets out of our code, and log sign-ins and changes without message text. Every dashboard query is limited to the signed-in person's own venue. If personal information is compromised we tell the affected clients immediately and within 24 hours, and the Information Regulator and the people affected as soon as reasonably possible, as POPIA s.22 requires.

14. Your rights

• You may ask to see the personal information we hold about you, ask us to correct or delete it, or object to our use of it, and you may withdraw a consent at any time. We don't charge for an ordinary request, and we may ask you to prove who you are before we give anything out.
• Write to [email protected] or call 063 611 2952. We answer within 30 days. If you enquired with a venue, write to the venue first (section 7).
• You may complain to the Information Regulator: inforegulator.org.za. We would like the chance to put it right first, but you don't have to wait.
• Our PAIA manual (section 51 of the Promotion of Access to Information Act 2 of 2000) says what records we hold and how to ask for one. Ask for a copy at [email protected]; it is free.

15. The demo pages

If you try the demo on our site, what you type is read once by an AI service (Claude Haiku 5.5, through OpenRouter, in the United States, under zero data retention) to sort it, and a sample reply is built from a made-up venue's own wording. Nothing is emailed, and we don't keep what you type. To limit abuse we keep a keyed hash of your IP address, never the address itself, with the time of each call, for 2 days.

16. Changes

If this notice changes, we publish the new version at venuo.co.za/privacy with a new version number and date, and we email our clients about any important change.