Privacy Policy — POPIA Section 18 Notice
1. Who we are
Responsible Party: Ventrique, operated by Jaco Louw (registration as a formal entity with the CIPC is pending — this notice will be updated with the registered entity name and number once incorporation completes).
Information Officer: Jaco Louw — privacy@ventrique-za.com. Registration of the Information Officer with the Information Regulator is in progress.
2. What personal information we collect
| Category | Examples | Source |
|---|---|---|
| Intake / idea content | The business-idea description and related free text you submit | You, directly |
| Contact details | Your email address | You, directly |
| Payment / deposit data | Records of your deposit and the Validate fee, transaction status, processor references. We never see or store full card numbers. | You + payment processor |
| Consent records | Whether you accepted this notice and whether you opted in to marketing, with a timestamp | You, directly |
| Technical / usage data | PII-minimised analytics needed to run and secure the service | Automatically |
Please do not include other people's personal information in your idea text unless necessary.
3. Why we process it
- To run the AI consulting-panel and research over your idea and produce your assessment.
- To take and reconcile your payment (deposit and Validate fee) and issue refunds where due.
- To communicate with you about your request, deposit, and deliverables.
- To comply with our legal obligations (tax, consumer-protection, record-keeping).
- To secure and improve the service using PII-minimised analytics.
- Direct marketing — only if you have separately opted in (section 7).
4. Lawful basis (POPIA s11)
We process your information under one or more of: performance of a contract at your request; compliance with a legal obligation; our legitimate interests (balanced against your rights); or your consent (for direct marketing, and for this processing itself).
5. Who we share it with
| Operator | Role | What it processes |
|---|---|---|
| Anthropic (Claude AI) | AI consulting-panel + synthesis | Sanitised idea text |
| Perplexity | Evidence research | Sanitised idea / query text |
| PayFast | Payment / deposit processing | Payment data (card data handled by PayFast, not us) |
| Amazon Web Services (af-south-1, Cape Town) | Hosting, storage, delivery | Application data at rest and in transit |
We do not sell your personal information or share it with third parties for their own marketing.
6. Cross-border processing (POPIA s72)
Some operators (Anthropic, Perplexity) process data outside South Africa. We rely on their contractual data-protection commitments and on the transfer being necessary to perform the service you requested. Our primary hosting and data residency stays in AWS af-south-1 (South Africa), and we minimise/sanitise what we send to offshore processors.
7. Direct marketing — separate consent (POPIA s69)
Marketing consent is a separate, optional checkbox. It is never a condition of using the Validate service. We only send marketing if you separately opt in. Every marketing message carries our identity and a working opt-out; opting out adds you to a suppression list. We keep timestamped proof of your marketing consent, since the onus of proving consent is ours.
8. Your rights (POPIA s23–s25, s11, s5)
- Access the personal information we hold about you (s23).
- Correction or deletion of information that is inaccurate, irrelevant, or unlawfully obtained (s24).
- Object to processing, and to direct marketing at any time (s11(3), s69).
- Withdraw consent where processing is based on it.
- Request deletion of your consent record and any associated report — email privacy@ventrique-za.com or use the deletion link included in your verdict email.
- Complain to the Information Regulator (section 10).
9. Retention
We keep your information only as long as necessary for the purposes above, or as required by law. When you request deletion under section 8, we remove your consent record and the linked report immediately; payment records are retained for the period required by tax law.
10. Security (POPIA s19)
We apply encryption in transit and at rest, access control and least-privilege access, data residency in AWS af-south-1, tenant isolation, and sanitisation of idea text before it reaches third-party AI processing. If a security compromise affects your personal information, we will notify the Information Regulator and you as soon as reasonably possible (s22).
11. How to complain
You may complain to the Information Regulator (South Africa): inforegulator.org.za, inforeg@justice.gov.za. Please raise it with us first at privacy@ventrique-za.com so we can try to resolve it.
12. Changes to this notice
We may update this notice; the version and this page will change when we do.