Legal

Privacy Policy

How Neevo collects, uses, stores and protects your personal information, and the rights you have under POPIA.

On this page

1. Who we are 2. What we collect 3. Why we process it 4. Direct marketing 5. Who we share it with 6. Storage and retention 7. Outside South Africa 8. Cookies 9. Your rights 10. Complaints 11. Security 12. Changes 13. Contact

Last updated: 04 August 2026 · Version: 1.0

In short: We collect the minimum we need to answer your enquiry and do your work. We don’t sell your information to anyone. You can ask us what we hold, ask us to fix it, and ask us to delete it.

The grey summary boxes throughout this policy are there to make it readable. They’re a guide, not the legal position — the numbered clauses are what applies.

1. Who we are

Neevo (Pty) Ltd (registration number 2026/579962/07), trading as Neevo, is the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer: Jacques Botha
Email: privacy@neevo.co.za
Address: 1 Ceretto, Woodhill Golf Estate, Garsfontein, 0081

This policy covers neevo.co.za and the services we provide from it.

It does not cover our products. GGFam, Triply and KinVault are separate applications with their own privacy notices, because they process different information for different reasons. If you use one of them, that product’s notice applies to your use of it.

2. What we collect

In short: What you type into our forms, plus basic technical information your browser sends automatically.

Information you give us

Name, email address, and optionally your phone or WhatsApp number and business name, when you complete a form on this website.
What you tell us about your project, idea, business or process — including anything you choose to put in a free-text field.
Correspondence between us: emails, calls, messages, meeting notes.
Billing information — company details, VAT number, billing address — if you become a client.

Information we collect automatically

IP address, browser type and version, device type, operating system, referring page, pages viewed, and time spent.
Cookies and similar technologies (section 8).

Information from clients’ systems during a project: if we build or maintain software for you, we may have access to personal information belonging to your customers, staff or users. In that situation you are the responsible party and we act as your operator. That relationship is governed by our written agreement with you, not by this policy.

We do not knowingly collect information from children through this website. This is a business website not directed at children. Our products handle children’s information under their own notices, with their own consent mechanisms.

We do not ask for special personal information — health, religious or philosophical beliefs, race, political persuasion, sexual orientation, trade union membership, biometric data, or criminal behaviour — through this website. Please don’t send it to us. If you do, we’ll delete it unless there’s a lawful reason to keep it.

3. Why we process it, and on what basis

In short: To reply to you, to do work you’ve asked for, to get paid, to comply with the law, and to run the site.

POPIA requires a lawful basis for every purpose. Ours are:

What we do	Why	Lawful basis under POPIA
Reply to your enquiry	You asked us to	Consent, and steps taken at your request before entering into a contract
Deliver a Blueprint, Audit, build or Care Plan	To perform our agreement	Necessary to conclude or perform a contract with you
Invoice you and keep accounting records	To get paid, and because the law requires records	Legal obligation, and legitimate interests
Provide support and maintenance	To keep your software working	Necessary to perform a contract
Send you occasional updates by email	You subscribed	Consent, which you can withdraw at any time
Keep the website secure and working	To prevent abuse and fix faults	Legitimate interests
Comply with SARS, CIPC and other legal obligations	Because we must	Legal obligation

We do not use your information to make automated decisions about you, and we don’t profile you.

4. Direct marketing

In short: We only email you marketing if you asked us to, and every one has an unsubscribe link that works.

Section 69 of POPIA restricts electronic direct marketing. Our position:

If you subscribed, we’ll send you occasional updates. Every email has a one-click unsubscribe. Unsubscribing takes effect immediately and doesn’t affect anything else we do for you.
If you’re an existing client, we may email you about services similar to those we’ve already provided. You can opt out at any time, including in your first message from us.
If you’re neither, we won’t send you marketing.
We never sell, rent or share your details with third parties for their marketing. Not now, not later, not as part of any deal.

Replying to your enquiry, sending your invoice, or telling you your app is down is not marketing, and you can’t unsubscribe from those while we’re working together.

6. Where it’s stored, and for how long

In short: Primarily in South Africa. We keep it as long as we need it, then delete it.

We host this website and the applications we build on South African infrastructure. Section 7 sets out the limits of that statement honestly.

What	How long	Why
Enquiries that didn’t become projects	24 months from last contact	So we have context if you come back
Newsletter subscriptions	Until you unsubscribe	Consent-based
Client project records, contracts and correspondence	5 years after the project ends	Prescription periods and warranty claims
Invoices, and accounting and tax records	5 years minimum	Required by the Companies Act and tax legislation
Website server logs	12 months	Security and diagnostics
Backups	Same retention period as the applicable source data	To restore data where needed; deleted data is removed as the relevant retention period ends

Product data retention schedules

The following schedule applies to product data. Backup copies follow the same retention period as the underlying data.

Data	Retention
Entries, photos and activity logs (ongoing use)	Approximately 12 months
Kid’s profile, rules, goals and household settings	Indefinite — until a parent removes the child or deletes the household
Kid removal → permanent erasure	14 days from request
Household deletion → permanent erasure	14 days from request
Consent records, after the data they evidence is gone	Undecided
Billing: lapsed subscription, suspended (read-only) before deletion	12 months

When a retention period ends we delete or de-identify the information. If you ask us to delete something before then, section 9 applies.

7. Sending information outside South Africa

In short: We keep data in South Africa where we can, and we’re specific about where we can’t.

Section 72 of POPIA restricts transferring personal information out of South Africa unless certain conditions are met — most commonly that the recipient is subject to comparable protection, or that you’ve consented.

Our website and client application infrastructure is hosted in South Africa through Xneelo, and our transactional email is delivered through Xneelo. We currently use no analytics tool on this website.

Some services connected to a project may still involve third parties outside South Africa, for example app-store services or other software a project specifically requires. Where information needs to be transferred outside South Africa, we will do so only where the requirements of POPIA section 72 are met and will disclose material third-party services as part of the project scope.

8. Cookies

In short: A few are needed to make the site work. Anything beyond that, we ask first.

Strictly necessary — security, load balancing, remembering your cookie choice. The site doesn’t work properly without these. Performance and caching — set by WP Rocket to make pages load faster. Analytics — none at launch.

You can block or delete cookies in your browser settings. Blocking the strictly necessary ones will break parts of the site.

9. Your rights

In short: Ask us what we hold, tell us to fix it, tell us to delete it, tell us to stop.

Under POPIA you may:

Ask what we hold about you and get a copy. We’ll respond within 30 days. A formal request under the Promotion of Access to Information Act may attract a prescribed fee; in practice, if you email and ask, we’ll just tell you.
Ask us to correct or complete anything inaccurate, irrelevant, excessive, out of date, misleading or unlawfully obtained.
Ask us to delete information we no longer have a lawful reason to keep. Where the law requires us to retain something — tax records, for example — we’ll say so and tell you when it will be deleted.
Object to processing based on legitimate interests, on reasonable grounds relating to your situation.
Withdraw consent at any time, where consent is the basis. This doesn’t affect anything done before you withdrew it.
Not be subject to direct marketing you didn’t ask for.
Complain — to us, or to the Information Regulator (section 10).

To exercise any of these, email privacy@neevo.co.za. We may ask you to verify your identity first, so we don’t hand your information to someone else.

10. Complaints to the Information Regulator

In short: If we get it wrong and won’t fix it, there’s a regulator, and complaining is free.

Please raise it with us first — most issues are a misunderstanding and we’d rather fix it than have it escalate. If you’re not satisfied, you can complain to the Information Regulator:

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 · Toll free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za

Complaints are lodged through the Regulator’s eService Portal, which requires you to register a user profile first.

11. Security

We take reasonably practicable technical and organisational steps to protect personal information: encrypted connections (HTTPS everywhere), access limited to people who need it, patched and updated systems, regular backups, and multi-factor authentication on administrative accounts.

No system is perfectly secure, and we won’t pretend otherwise. If a breach occurs that creates a real risk to you, we’ll notify you and the Information Regulator as soon as reasonably possible, as POPIA requires — telling you what happened, what information was involved, and what to do about it.

12. Changes to this policy

We’ll update this policy when what we do changes. The version number and date at the top always reflect the current version. For material changes we’ll notify subscribers and clients by email rather than relying on you to check.

13. Contact

Questions about this policy, or about anything we hold: privacy@neevo.co.za, or write to Jacques Botha at 1 Ceretto, Woodhill Golf Estate, Garsfontein, 0081.