Data & Privacy Rights — CorVali
Last updated: 11 October 2026
1. Who this page is from
CorVali (Pty) Ltd, registration number 2026/403426/07, 187 Sir Lowry Road, Woodstock, 7915, Cape Town, South Africa (“CorVali”, “we”). Information Officer: Philip van Tonder. Privacy contact: info@corvali.ai.
Our Privacy Policy explains our two roles. In short: for the information a salon or spa (a “Business”) collects about its clients, the Business is the responsible party and CorVali is its operator; for information about CorVali account holders, people who write to us and visitors to corvali.ai, CorVali is the responsible party. This page is not a Business’s privacy notice and does not replace the Business’s own privacy notice.
2. How to ask
The Protection of Personal Information Act lists, among what a notice may tell you:
“the existence of the right of access to and the right to rectify the information collected; the existence of the right to object to the processing of personal information as referred to in section 11(3); and right to lodge a complaint to the Information Regulator and the contact details of the Information Regulator”
- Information held by a Business (your bookings, messages, payments): ask the Business. A Business owner or manager can erase a client from the client’s page in CorVali.
- Information CorVali holds about you as an account holder or as someone who wrote to us: email our Information Officer, Philip van Tonder, at info@corvali.ai, say what you are asking for (for example “Data Access Request” or “Data Deletion Request”) and which email address or phone number your account or messages use.
3. What a deletion does and does not do
- We do not currently delete appointment, contact or WhatsApp message records automatically after a fixed period. They are kept while the Business uses CorVali, and are removed or anonymised only when a deletion request is carried out or when a Business is closed and its data is purged by CorVali.
- When a Business owner or manager erases a client in CorVali, the client record is anonymised (name and contact details are removed and the client notes are deleted) and invoices are kept without their link to that client. WhatsApp message history and appointment records are not changed by that step.
What the two laws we rely on say about keeping records, quoted:
“(1) Subject to subsections (2) and (3), records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless— (a) retention of the record is required or authorised by law; (b) the responsible party reasonably requires the record for lawful purposes related to its functions or activities; (c) retention of the record is required by a contract between the parties thereto; or (d) the data subject or a competent person where the data subject is a child has consented to the retention of the record.”
“(4) A responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorised to retain the record in terms of subsection (1) or (2).”
“(3) Records, books of account or documents need not be retained by the person described in— (a) subsection (2)(a), after a period of five years from the date of the submission of the return; and (b) subsection (2)(c), after a period of five years from the end of the relevant tax period.”
4. Who processes the information, and where
- Supabase — Database, sign-in and file storage.
Where: London, United Kingdom (our project runs in AWS region eu-west-2, which Supabase lists as "West Europe (London)"). - Vercel — Application hosting and scheduled jobs.
Where: Washington, D.C., USA (our application functions run in region iad1, which Vercel lists as "Washington, D.C., USA"; requests also pass through its network edge, for example Cape Town). - PayStack South Africa (Pty) Ltd — Card payments: we send the amount, currency, the payer's email address and the Business's payout account reference.
Where: Country of processing not established by us; to be confirmed by counsel. - Meta Platforms — WhatsApp message delivery, and Facebook sign-in or WhatsApp sign-up where a person chooses it.
Where: Country of processing not established by us; to be confirmed by counsel. - Anthropic — The language model behind the booking assistant. It receives the text of booking conversations and documents a Business uploads for reading (for example invoices, bank letters and spreadsheet rows).
Where: Country of processing not established by us; to be confirmed by counsel. - Resend — Transactional email (confirmations, payslips, reports).
Where: Country of processing not established by us; to be confirmed by counsel. - Google — Sign-in where chosen; and, only where a Business connects them, Google Calendar, Google Business Profile and Google Maps address search.
Where: Country of processing not established by us; to be confirmed by counsel.
The table above states, for each provider, only what we have been able to establish. Supabase processes in the United Kingdom and Vercel runs our application in the United States. For the other providers we have not established the country or countries in which they process information.
Basis for transfers: to be confirmed by counsel.
5. If you are not satisfied
Last updated: 11 October 2026.