Privacy Policy

Olvix ("Olvix", "we", "us") builds small, focused software for growing businesses. We are based in South Africa and act as the responsible party for personal information collected through this website, and as an operator when we process personal information on behalf of the businesses that use our products.

Questions about this policy or your personal information can be sent to hello@olvix.co.za.

This policy applies to olvix.co.za, to the software products and hosted tools we operate (including booking, scheduling, payments and customer-communication tools), and to messages we send or receive on behalf of our business customers through channels such as WhatsApp, SMS and email.

When you book with, pay, or receive messages from a business that uses an Olvix product, that business decides why and how your information is used. Olvix processes it under that business's instructions. Requests about your relationship with a specific business should go to that business first; we will help them respond.

We collect only what is needed to provide the service you or a business asked for:

• Contact details: name, phone number and email address, when you contact us, create an account, or make a booking.
• Account and business details: business name, location, opening hours, staff names and services, when a business sets up an Olvix product.
• Booking and payment details: the service, date, time and price of a booking, deposit and payment status, and cancellation or reschedule history. Card and bank details are handled by our payment partners and never stored by Olvix.
• Messages: the content, timestamps and delivery status of messages exchanged through our products, including WhatsApp conversations with a business, so that we can deliver, log and support them.
• Technical data: IP address, device and browser type, pages visited and basic usage events, collected through server logs and privacy-respecting analytics.

• To provide and run the service: confirm bookings, take deposits, send reminders and updates, manage a walk-in queue, and keep records a business needs.
• To communicate with you about the service, respond to requests, and provide support.
• To keep the service secure, prevent abuse and fraud, and meet legal obligations.
• To understand how our products are used and improve them, using aggregated or de-identified data wherever possible.

We do not sell personal information and we do not use it for third-party advertising.

Our products can send and receive messages through the WhatsApp Business Platform, provided by Meta Platforms, Inc. and its affiliates. When a business uses this feature, your phone number, the messages you exchange with that business, and delivery information are processed by WhatsApp in order to deliver them.

• Consent: businesses only message you on WhatsApp after you have opted in, for example by booking online, replying to a message, or agreeing at reception. We record when and how you opted in.
• Opting out: reply STOP to any message to stop receiving WhatsApp messages from that business through Olvix. You can also ask the business or Olvix directly.
• Content: message templates are approved by WhatsApp before use, and message content is used only to deliver the conversation and keep a record for the business.
• Meta's own handling of your data is described in the WhatsApp Privacy Policy and the Meta Privacy Policy.

A business using Olvix can choose to connect a team member's Google Calendar so that bookings and personal events stay in sync. This is optional, is switched on by the team member themselves through Google's sign-in and consent screen, and can be disconnected at any time from the Team page in the app or from the Google account's security settings.

• What we access: with the calendar.events and calendar.readonly permissions we read the start and end times, titles and busy/free status of events on the connected calendar, and we create, update and delete the events that represent Olvix bookings. With the openid and email permissions we read the Google account's email address to show which account is connected.
• What we use it for: busy time on the connected calendar blocks those slots from being booked in Olvix, and Olvix bookings are written to the calendar. We do not use calendar data for anything else, including advertising, profiling or training models.
• What we store: the event times and identifiers needed to keep the two calendars in step, the account email, and an encrypted refresh token so the sync can keep running. Event details are stored only as long as the connection exists, and are deleted when it is disconnected or the team member is removed.
• Who sees it: only the connected business (as time off in its calendar) and Olvix's systems. We do not share, sell or transfer Google user data to anyone else, and no person at Olvix reads it except to fix a support problem you have asked us to look at, or as required by law.
• Olvix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We process personal information under the Protection of Personal Information Act (POPIA) and, where it applies, the General Data Protection Regulation (GDPR). Our grounds are: performing a contract or the steps you asked for before one (bookings, payments, accounts); your consent (marketing messages, WhatsApp opt-in), which you can withdraw at any time; our legitimate interests in running a secure, reliable service; and compliance with legal obligations, such as tax and payment-record rules.

We share personal information only with providers who help us run the service, under contracts that restrict how they may use it:

• Hosting and infrastructure providers that store and process data for us.
• Messaging providers, including Meta (WhatsApp Business Platform), SMS and email delivery services.
• Payment providers, such as Paystack, that process deposits and payments. Payments made to a business settle to that business's own account.
• Google, when a team member connects Google Calendar (see the Google Calendar section above). Google's handling of your data is described in the Google Privacy Policy.
• Analytics, monitoring and error-tracking tools that help us keep the service working.
• The business you are dealing with, which sees the bookings, messages and details you share with it.

We may also disclose information when the law requires it, to protect the rights and safety of people using the service, or as part of a business transfer, in which case this policy continues to apply.

We keep personal information for as long as it is needed for the purposes above. Booking and payment records are kept for as long as the business needs them and as required by financial record-keeping law. Message logs are kept to support the business and are deleted or de-identified on a rolling basis. Website server logs are kept for a short, fixed period. When a business closes its Olvix account, its data is deleted or de-identified within a reasonable period, except where we must keep it by law.

We protect personal information with encryption in transit, access controls, audit logging, tested backups and least-privilege access for our team. No system is perfectly secure; if we become aware of a breach affecting your information we will notify the affected businesses, the Information Regulator and you where the law requires.

Depending on where you live, you have the right to:

• Ask what personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Ask us to delete your information, or to restrict or object to how we use it.
• Withdraw consent for marketing or WhatsApp messages at any time.
• Receive your information in a portable format.
• Complain to a supervisory authority. In South Africa this is the Information Regulator (inforegulator.org.za).

To exercise any of these rights, email hello@olvix.co.za. We may ask you to verify your identity, and we respond within the time the law allows, usually 30 days.

You can ask for your personal information to be deleted at any time:

• Email hello@olvix.co.za from the address, or including the phone number, you used with the service, with the subject "Delete my data".
• If your information was collected by a business using Olvix, you can also ask that business; we will action their request.
• For WhatsApp conversations, reply STOP to end messaging, then send the deletion request above to have message history removed.

We confirm deletion requests in writing and complete them within 30 days, except for records we are legally required to keep, which are restricted from any other use until they can be deleted.

This website uses only strictly necessary cookies and local storage, such as remembering your light or dark theme preference. Our products use session cookies to keep you signed in. We do not use advertising or cross-site tracking cookies.

Our website and products are intended for adults and for businesses. We do not knowingly collect personal information from children under 18 without the consent of a parent or guardian. If you believe a child has provided information to us, contact us and we will delete it.

Some of our providers, including Meta and cloud hosting services, process data outside South Africa. Where that happens we make sure the recipient is subject to laws or binding agreements that protect your information to a standard comparable to POPIA.

We will update this policy as our products and the law change. The date at the top shows the latest version. If a change materially affects how we use your information we will let you know through the service or by email.

Olvix, South Africa. Email hello@olvix.co.za for privacy requests, questions and complaints. Registered company details are available on request.