Privacy Policy — CorVali

1. Introduction

CorVali (corvali.ai) is a spa and wellness business management platform operated in South Africa. This Privacy Policy explains how we collect, use, store, and share your personal information when you use any CorVali-powered service, including online booking, WhatsApp messaging, and client portal features.

2. Governing Law

Your personal information is processed in accordance with the Protection of Personal Information Act (POPIA), Act 4 of 2013. We are committed to lawful, fair, and transparent processing of personal information.

3. Information We Collect

We collect the following categories of personal information:

• Identity — your full name.
• Contact — phone number, email address.
• Transactional — booking history, appointment details, payment records.
• Technical — device type, IP address (collected automatically by Vercel/Next.js infrastructure for security and performance).
• Communication — WhatsApp messages sent to and received from our booking assistant.

4. How We Use Your Information

We process your information on the following lawful bases:

• Name, phone, email — to perform your booking contract with us.
• Payment and invoice records — legal obligation (South African tax and financial record-keeping requirements).
• Appointment history, WhatsApp logs — legitimate interest (delivering and improving our services, managing scheduling, providing customer support).
• Marketing messages — if you are an existing client, we may send you marketing about our own similar services under section 69(3) of POPIA. You may object at any time, free of charge — reply STOP to any marketing message, or contact us, and we will stop immediately. If you are not an existing client, we send marketing only with your consent.

5. How We Share Your Information

We share personal information only with the following third-party processors, strictly to deliver our service. We do not sell your personal information.

• Supabase — database hosting (servers in US/EU).
• Anthropic — AI assistant processing (United States).
• Meta Platforms — WhatsApp messaging infrastructure (United States).
• PayStack South Africa (Pty) Ltd — payment processing.
• Resend — transactional email delivery (United States).

6. Cross-Border Transfers

Some of the processors listed above are located outside South Africa. By using CorVali-powered services, you consent to your personal information being transferred to these processors under appropriate safeguards. We take reasonable steps to ensure these processors maintain adequate data protection standards.

7. Data Retention

We retain personal information for the following periods:

• Financial and invoice records — 5 years, as required by South African tax law.
• Appointment history and personal contact data — deleted after 3 years of account inactivity, or sooner upon request.
• WhatsApp conversation logs — 12 months, then deleted automatically.
• Payment transaction records — 5 years, as required by South African financial regulations.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate or incomplete information be corrected.
• Deletion — request that your personal information be deleted, subject to our legal retention obligations.
• Objection — object to processing based on legitimate interest.
• Complaint — lodge a complaint with the Information Regulator of South Africa.

To exercise your rights, see our Data & Privacy Rights page or contact us directly (section 11 below).

9. Cookies and Tracking

CorVali uses minimal tracking. Vercel (our hosting provider) may collect anonymised usage data for performance monitoring. We do not use advertising cookies, remarketing pixels, or cross-site tracking technologies.

10. Children

Our services are not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at philip.vantonder@gmail.com.

11. How to Contact Us

For any privacy-related enquiries, to exercise your rights, or to report a concern:

• Email: philip.vantonder@gmail.com
• Subject line: “Privacy Enquiry”

We will acknowledge your request within 48 hours and respond within 30 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of any CorVali-powered service constitutes acceptance of the updated policy. The current version is always available at corvali.ai/privacy. Last updated: May 2026.