Privacy Policy — CorVali
Effective: 11 October 2026 · Last updated: 11 October 2026
1. Who we are, and our two roles
CorVali is a booking and business-management platform for salons, spas and wellness businesses in South Africa. It is operated by:
CorVali (Pty) Ltd, registration number 2026/403426/07, 187 Sir Lowry Road, Woodstock, 7915, Cape Town, South Africa (“CorVali”, “we”). Information Officer: Philip van Tonder. Privacy contact: info@corvali.ai.
We play two different roles, and this policy says which one applies.
A. Business-client data: we process it on a business’s behalf. When you book or visit a salon or spa that uses CorVali (a “Business”), the Business decides why and how your personal information is used. The Business is the responsible party and CorVali is its operator. This page is not a Business’s privacy notice and does not replace the Business’s own privacy notice, which governs that information. CorVali processes it only to run the Business’s bookings, payments, messaging and records.
B. Our own information: we decide. For the information we collect about Business owners and staff who hold CorVali accounts, about people who write to us, and about visitors to corvali.ai, CorVali is the responsible party.
When you book through a CorVali booking page, your details are saved to the Business’s client records, and we treat that as Business-client data (role A). CorVali does not currently hold separate guest accounts for those pages.
2. What we collect
Role B: name, email address, phone number, role, sign-in details (including Google or Facebook sign-in where you choose it), the billing and payout details a Business gives us, messages you send us, and technical data such as IP address and device type that our hosting records.
Role A (collected by the Business through CorVali): client name and contact details, booking and appointment history, payment records, messages with the Business’s WhatsApp booking assistant, and anything the Business chooses to record, which can include health-related information.
Whether supplying it is voluntary or mandatory: for role B, the details needed to create and run an account are required to use CorVali. For role A, the Business tells you what it needs for your booking.
3. Why we use it
Role B: to create and secure accounts, provide and support the platform, take payments from Businesses, and answer people who write to us. Role A: to deliver the Business’s bookings, payments, reminders and customer support on the Business’s instructions.
4. Who we share it with
We share personal information with the service providers below, which we need in order to run CorVali, and we do not sell it. We also disclose information where the law requires it. A Business also chooses which of its own tools to connect.
- Supabase — Database, sign-in and file storage.
Where: London, United Kingdom (our project runs in AWS region eu-west-2, which Supabase lists as "West Europe (London)"). - Vercel — Application hosting and scheduled jobs.
Where: Washington, D.C., USA (our application functions run in region iad1, which Vercel lists as "Washington, D.C., USA"; requests also pass through its network edge, for example Cape Town). - PayStack South Africa (Pty) Ltd — Card payments: we send the amount, currency, the payer's email address and the Business's payout account reference.
Where: Country of processing not established by us; to be confirmed by counsel. - Meta Platforms — WhatsApp message delivery, and Facebook sign-in or WhatsApp sign-up where a person chooses it.
Where: Country of processing not established by us; to be confirmed by counsel. - Anthropic — The language model behind the booking assistant. It receives the text of booking conversations and documents a Business uploads for reading (for example invoices, bank letters and spreadsheet rows).
Where: Country of processing not established by us; to be confirmed by counsel. - Resend — Transactional email (confirmations, payslips, reports).
Where: Country of processing not established by us; to be confirmed by counsel. - Google — Sign-in where chosen; and, only where a Business connects them, Google Calendar, Google Business Profile and Google Maps address search.
Where: Country of processing not established by us; to be confirmed by counsel.
5. Transfers outside South Africa
The table above states, for each provider, only what we have been able to establish. Supabase processes in the United Kingdom and Vercel runs our application in the United States. For the other providers we have not established the country or countries in which they process information.
Basis for transfers: to be confirmed by counsel.
6. How long we keep it
- We do not currently delete appointment, contact or WhatsApp message records automatically after a fixed period. They are kept while the Business uses CorVali, and are removed or anonymised only when a deletion request is carried out or when a Business is closed and its data is purged by CorVali.
- When a Business owner or manager erases a client in CorVali, the client record is anonymised (name and contact details are removed and the client notes are deleted) and invoices are kept without their link to that client. WhatsApp message history and appointment records are not changed by that step.
What the two laws we rely on say about keeping records, quoted:
“(1) Subject to subsections (2) and (3), records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless— (a) retention of the record is required or authorised by law; (b) the responsible party reasonably requires the record for lawful purposes related to its functions or activities; (c) retention of the record is required by a contract between the parties thereto; or (d) the data subject or a competent person where the data subject is a child has consented to the retention of the record.”
“(4) A responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorised to retain the record in terms of subsection (1) or (2).”
“(3) Records, books of account or documents need not be retained by the person described in— (a) subsection (2)(a), after a period of five years from the date of the submission of the return; and (b) subsection (2)(c), after a period of five years from the end of the relevant tax period.”
7. Keeping it safe
- Each Business’s data is separated from every other Business’s by row-level security, which is switched on for every table in the application schema of our main database.
- Connections to corvali.ai use HTTPS, and plain-HTTP requests are redirected to HTTPS.
- Credentials for connected services are kept in database tables that signed-in users and the public cannot read.
8. Your rights and how to use them
The Protection of Personal Information Act lists, among what a notice may tell you:
“the existence of the right of access to and the right to rectify the information collected; the existence of the right to object to the processing of personal information as referred to in section 11(3); and right to lodge a complaint to the Information Regulator and the contact details of the Information Regulator”
- Business-client data (role A): ask the Business first. A Business owner or manager can erase a client in CorVali. See Data & Privacy Rights.
- Our own information (role B): write to our Information Officer, Philip van Tonder, at info@corvali.ai.
9. Cookies and similar storage
The public pages of corvali.ai do not set cookies and do not load third-party scripts. When you sign in at app.corvali.ai, our authentication provider sets a sign-in session cookie. Short-lived state cookies are set while a Business connects Google Calendar or Google Business Profile, and your browser keeps a few interface preferences (for example your selected location and calendar view). During setup, a Business may load Facebook’s WhatsApp sign-up script and Google Maps address search. A Business’s own website has its own notice.
10. Children
CorVali is not directed at anyone under 18, and we do not knowingly collect their information as a business customer.
11. Changes
We will update this page and its date when this policy changes.
12. Contact
CorVali (Pty) Ltd, registration number 2026/403426/07, 187 Sir Lowry Road, Woodstock, 7915, Cape Town, South Africa (“CorVali”, “we”). Information Officer: Philip van Tonder. Privacy contact: info@corvali.ai.
Last updated: 11 October 2026.