Last updated: 23 August 2026
This policy explains how Avuno Technologies (Pty) Ltd ("Avuno", "we", "us") handles your personal information when you use our website (avuno.co.za), our account area and website builder (account.avuno.co.za), our free tools, or otherwise engage our services. We are based in Mossel Bay, Western Cape, South Africa.
It is written for South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), in plain language, because it is meant to be read by a business owner and not only by a lawyer.
1. Who is responsible for your information
Avuno Technologies (Pty) Ltd is the responsible party for the personal information described in this policy. That means we decide why and how it is processed, and we are accountable for it. Our Information Officer is Werno Roodt, who can be reached at hello@avuno.co.za.
Four POPIA words are used throughout this policy:
- Data subject — you, the person the information is about.
- Responsible party — us, because we decide what is done with it.
- Operator — a supplier that processes information for us, on our instructions, such as our payment provider or our hosting provider.
- Processing — anything done with personal information: collecting it, storing it, using it, sharing it, or deleting it.
2. The two ways you can work with us
Some of what follows depends on how you use Avuno:
- Studio projects. We design and build a website or application for you, then host and look after it.
- Self-serve accounts. You create your own account, build your own website in our builder, and publish it on your own domain. Anyone can sign up — you no longer need an invitation from us.
Both run on the same systems, and the same protections in this policy apply to both.
3. What we collect, why, and our lawful basis
POPIA requires a lawful reason for every kind of processing. The table below sets out what we collect, why we process it, and which reason we rely on. Not every row will apply to you — it depends on which parts of Avuno you use.
| What we collect | Why we process it | Lawful basis (POPIA section 11) |
|---|---|---|
| Sign-up details: your name, email address and a password, which is stored only as a one-way hash | To create your account and sign you in | Performing our contract with you |
| Email verification: a verification token and the date it was used | To confirm the address is really yours and keep fake accounts out | Performing our contract; our legitimate interest in preventing abuse |
| Google sign-in, if you choose it: your Google account ID, email address and name. We never see or store your Google password | To sign you in without you having to keep a separate password with us | Performing our contract with you |
| Two-factor authentication, if you switch it on: a TOTP secret and hashed backup codes | To stop someone else signing in as you, even if they have your password | Performing our contract; our legitimate interest in account security |
| Website content you enter: business name, what the business does, services, town, contact details, opening hours, and any images you upload | To generate, build, host and serve your website | Performing our contract with you |
| Copy generation inputs: your business name, what the business does, your town and your phone number | Sent to Anthropic's Claude API to write first-draft copy for your website (see section 6) | Performing our contract with you |
| Your domain name, and the public DNS records we look up for it | To check the domain is set up correctly and to connect it to your site | Performing our contract with you |
| Payment records: your name, email, the amount, a payment reference and your subscription status | To take payment, run your monthly subscription, issue invoices and keep accounting records | Performing our contract; a legal obligation under tax and company law |
| Free AI visibility check: your name, email, business name, website address and town | To run the check and email you the report you asked us for | Steps towards a contract at your request. The report is the service you asked for, not marketing |
| Marketing opt-in on that check: whether you ticked the follow-up box, the date and time you ticked it, and the exact wording you agreed to | To send you sales follow-up about what we do, and to keep proof that you agreed to it | Your consent, and nothing else (section 69). If you do not tick the box, we send nothing |
| Enquiries: your name, email, phone or WhatsApp number, and the details of your enquiry | To answer you and prepare a quote | Steps towards a contract at your request |
| Support and other correspondence: whatever you send us | To help you and keep a record of what was agreed | Performing our contract; our legitimate interest |
| Analytics: page views, referring pages and general region, collected without cookies | To see which pages are useful and where visitors come from | Our legitimate interest in improving our own website |
| Server and security logs: IP address, browser type and timestamps | To keep our systems secure and to spot and stop abuse | Our legitimate interest in security |
Things we do not do: we do not see or store your card number, we never receive your Google password, we do not run advertising or cross-site tracking, we do not sell your personal information, and we do not send marketing emails without your consent.
4. Accounts, Google sign-in and two-factor authentication
Anyone can create an Avuno account. We ask for your name, email address and a password. Your password is stored as a one-way hash, which means we cannot read it and cannot tell you what it is. We send a verification email and your account is only fully usable once you have confirmed the address.
You can sign in with Google instead. If you do, Google confirms who you are and passes us your Google account ID, email address and name. That is all we receive. Your Google password stays with Google and never reaches us.
You can switch on two-factor authentication. We then store a TOTP secret, which your authenticator app uses to generate codes, and a set of backup codes that we store hashed. We hold this only to check the codes you enter, and it is deleted if you turn two-factor authentication off.
5. The website builder and the content you put into it
When you build a site, you enter details about your business and you can upload images. We store that content and the images on our servers, use them to generate and serve your website, and keep them so you can come back and edit the site later.
Please remember that anything you publish on your website is public by design. Do not put other people's personal information — a staff member's ID number, a customer list, a private phone number — into fields that will appear on the live site, unless you have their permission. You are the responsible party for the personal information of your own customers and staff; we are your operator for the parts we host. POPIA requires that relationship to be set out in writing, and it is: section 14 of our Terms & Conditions is our written operator agreement with you.
6. AI-generated website copy
To give you a usable first draft instead of an empty page, we send a small set of details — your business name, what the business does, your town and your phone number — to the Claude API, operated by Anthropic. Anthropic returns draft wording, which we place in your site for you to edit, rewrite or delete.
Two things worth knowing. First, Anthropic acts as our operator for this, and Anthropic does not use data sent through its API to train its models. Second, the draft is a starting point and not a checked statement of fact — please read it before you publish. Our Terms & Conditions deal with that in more detail.
If you would rather nothing was sent, write your own copy into the builder instead of asking for a draft.
7. Domains and DNS lookups
When you tell us which domain you want to use, we perform public DNS lookups on it — the same lookups any browser does — to confirm it exists and to check whether it is pointing at us yet. We store the domain name and the result of those checks against your account.
You buy your domain from a registrar in your own name. We are not your registrar, and details you gave the registrar are held under their privacy policy, not ours.
8. Payments
Subscriptions and care-plan payments are processed by Paystack. You enter your card details on Paystack's own secure payment page. We never see or store your card number, expiry date or CVV. What comes back to us, and what we keep, is your name, your email address, the amount, a payment reference and whether the payment succeeded or failed.
9. The free AI visibility check
Our free tool at asks for your name, email address, business name, website address and town. We use those details to run searches through DataForSEO, which is a search-data provider, and we email you the report.
The report itself is not marketing. You asked us for it, so sending it to you is simply us doing the thing you requested. You get it whether or not you agree to hear anything further from us.
Sales follow-up is a separate thing, and it only happens if you tick the box. The form carries a plain checkbox asking whether we may contact you about what we do. It is not ticked for you, and ticking it is not a condition of running the check. If you leave it blank you get your report and nothing else: no sales email, no newsletter, no follow-up.
If you do tick it, we record the consent — the date and time you gave it, and the exact wording you agreed to — so that we can show you agreed if we are ever asked. This is what section 69 of POPIA requires. It says we may not send unsolicited electronic direct marketing to someone who is not already our customer unless that person has consented to it.
You can change your mind at any time. Reply to any email from us and tell us to stop, or email hello@avuno.co.za. We stop straight away and you do not have to give a reason. You may also object to the processing on reasonable grounds under section 11(3) of POPIA, and ask us to delete the lead record entirely.
Submitting the form does create a sales lead record on our system, holding your details and the result of the check, so we can pick up where we left off if you come back to us. We keep it as set out in section 13 below, and we delete it sooner if you ask.
10. Hosting, suspension and your data
We host the websites we build and the websites built in our builder. If a subscription goes unpaid, we send reminders and then, after a grace period, replace the live site with a temporary holding page. Suspending a site does not delete it. Your content, your images and your account stay exactly where they are, and the site goes back up when payment resumes. The same applies if you cancel: the site comes down at the end of the period you have paid for, and your data is retained rather than destroyed at that moment. The reminder and suspension timings are set out in our Terms & Conditions, and how long we then keep a suspended site is in section 13 below.
11. Analytics and cookies
Our analytics is Umami, self-hosted on our own server. It does not use cookies, does not set an advertising identifier, and does not follow you to other websites. It records aggregate figures such as page views, referring pages and general region. No third-party advertising or tracking scripts run on our marketing site.
The account area (account.avuno.co.za) sets a single essential cookie to keep you signed in. It is required for the service to work and is not used for tracking.
12. Who we share it with: our operators and sub-processors
We use a small number of suppliers to run the business. Each one is an operator under POPIA: they process information for us, on our instructions, and they are not allowed to use it for their own purposes.
| Operator | What it receives | What it does with it |
|---|---|---|
| Anthropic (Claude API) | Your business name, what the business does, your town and your phone number | Generates first-draft website copy. Anthropic does not use API data to train its models. |
| Paystack | Your name, email address and the card details you type into their payment page | Takes payment and runs your monthly subscription. Returns only a reference, amount and status to us. |
| DataForSEO | Your business name, website address and town, used as search terms | Runs the searches behind our free AI visibility check. |
| Google — Sign-In | Only used if you choose Google sign-in. Google confirms your identity and returns your Google account ID, email address and name | Signs you in. Your Google password is never shared with us. |
| Google — Workspace | Any email you send us, and any email we send you | Hosts our business email. |
| Our hosting and infrastructure providers | Everything stored on our servers: the account database, your website content and your uploaded images | Runs the servers, backups and content delivery that keep your site online. |
We may also disclose information where the law requires it, or to protect our rights. We do not sell personal information and we do not share it with advertisers.
Information sent outside South Africa. Some of these operators process information outside the country. POPIA allows this where the recipient is bound by rules or a contract that provide a level of protection substantially similar to POPIA. We rely on the contractual terms in each supplier's data processing agreement for that.
13. How long we keep it
We keep personal information only for as long as we actually need it. These are the periods we work to.
| What | How long | Why |
|---|---|---|
| Account details and website content | While the account is open, then 90 days after closure | So an account closed by mistake can be recovered |
| Suspended websites (unpaid or cancelled) | 12 months, then deleted after written notice | So a site can be restored if the customer returns |
| Payment and invoice records | 7 years | Companies Act and tax law require it; cannot be deleted on request |
| Sales enquiries and leads | 24 months from last contact, or immediately on request | Sales follow-up only |
| Unclaimed pre-signup website drafts | 14 days | Deleted automatically |
| Server and access logs | 90 days | Security and fault diagnosis |
| Email verification and password reset tokens | 48 hours / 10 minutes | Expire automatically |
The seven-year period on financial records is a legal obligation, and it overrides a deletion request. South African tax and company law requires us to keep payment and invoice records for that long, so we cannot delete them while that duty lasts, even if you ask us to. Everything else in the table is deleted on request under section 24 of POPIA — email hello@avuno.co.za and we will do it.
What happens when you leave. You can ask us for a copy of your website content and the images you uploaded, and we will give it to you in a usable format. Your site then comes down and stops being served from our hosting, and the periods in the table above start running from that point. Your domain is registered in your own name and is not affected.
Two other notes. Analytics figures are aggregates and are not tied to a named person. Backups are encrypted, and material you have deleted can remain in a backup until that backup is overwritten on its normal rotation. It is not put back into your account and is not used for anything else.
14. How we protect it
We serve everything over HTTPS, store passwords using strong one-way hashing, store two-factor backup codes hashed, offer two-factor authentication on accounts, keep software patched, take regular backups, and restrict who can reach production systems. No system is perfectly secure, but we take the reasonable technical and organisational measures POPIA requires. If a breach affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.
15. Your rights as a data subject
Under POPIA you have the right to:
- Access — ask whether we hold personal information about you, and ask for a copy of it (section 23). We may need to confirm who you are first.
- Correction — ask us to correct or update anything inaccurate, out of date or misleading (section 24). Most of it you can edit yourself in your account.
- Deletion — ask us to delete or destroy information we no longer have a lawful reason to keep (section 24). The one exception is our payment and invoice records, which the law requires us to hold for seven years — see section 13.
- Objection — object, on reasonable grounds, to processing we base on legitimate interests, and object to direct marketing (section 11(3)).
- Withdraw consent — where we rely on your consent, such as agreeing to sales follow-up after the free AI visibility check, you can withdraw it at any time by replying to any email from us or emailing us. That does not undo processing that already happened.
- Stop direct marketing — tell us to stop and we will, at once and without asking why (section 69). We do not send electronic direct marketing to anyone who has not agreed to it.
- Complain — see below.
To exercise any of these, email hello@avuno.co.za. We will acknowledge you and respond within a reasonable time. We do not charge for this, except that POPIA allows a prescribed fee for copies in some access requests.
16. Complaining to the Information Regulator
If you are unhappy with how we have handled your personal information, please raise it with us first at hello@avuno.co.za so we have a chance to fix it. You do not have to go through us, though.
You may complain directly to the Information Regulator (South Africa), which is the body that enforces POPIA. A complaint is made in writing on the Regulator's prescribed complaint form (Form 5 under the POPIA Regulations), submitted to the Regulator's complaints unit. The current form, the submission address and the Regulator's contact details are published at inforegulator.org.za. Complaining to the Regulator is free.
17. Children
Avuno is a service for businesses and is not aimed at children. We do not knowingly collect the personal information of a child. If you believe a child has given us information, email hello@avuno.co.za and we will delete it.
18. Changes to this policy
We may update this policy from time to time — for example when we add a feature or change a supplier. The "last updated" date at the top reflects the current version, and material changes will be reflected here.
19. Contact us
Questions about this policy, or about your personal information? Email hello@avuno.co.za or use our contact page. Avuno Technologies (Pty) Ltd, Mossel Bay, Western Cape, South Africa.