Privacy Policy

1. Who We Are

This website is operated by Mirembe Muse (Pty) Ltd, trading as CreativelyNanda.co.za, a company registered in South Africa.

• Website: https://creativelynanda.co.za
• Email: hello@creativelynanda.co.za
• Address: East London, Eastern Cape, South Africa

We are the Responsible Party (as defined in POPIA) for personal information collected through this website.

2. Personal Information We Collect

We collect the following categories of personal information:

3. Why We Collect Your Information

We process your personal information for the following lawful purposes:

• Order fulfilment: To process payments (via PayFast), deliver digital products, and send purchase confirmations via email (Resend).
• Communication: To respond to enquiries and support requests.
• Legal compliance: To comply with financial, tax, and regulatory obligations under South African law.
• Security: To detect fraud and protect the integrity of our platform.
• Analytics: To understand how our website is used and improve the user experience.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

4. Third-Party Service Providers

We share personal information only with service providers necessary to operate our platform:

• PayFast (DPO PayGate (Pty) Ltd): Payment processing. PayFast is a registered payment service provider in South Africa and is PCI DSS compliant. Your card details are never stored on our servers.
• Supabase Inc.: Database and file storage hosted on AWS. Data may be stored outside South Africa. Supabase implements appropriate safeguards.
• Resend Inc.: Transactional email delivery (order confirmations and project correspondence).
• Vercel Inc.: Website hosting and edge deployment.
• Anthropic PBC: AI assistant functionality on this website. Messages you submit to the AI chat assistant are processed by Anthropic's Claude API. Anthropic does not use these messages to train its models by default. See Anthropic's privacy policy at anthropic.com/privacy.

Where data is processed outside South Africa, we take reasonable steps to ensure it receives equivalent protection to that provided by POPIA.

5. How Long We Keep Your Data

• Order records: 5 years from the date of purchase (for tax and accounting compliance under the Income Tax Act).
• Contact form submissions: Up to 12 months, or until the enquiry is resolved.
• Session identifiers: Up to 12 months.
• Analytics data: Aggregated; no personal retention period applies.

6. Your Rights Under POPIA

As a data subject, you have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate information.
• Request deletion of your personal information, subject to legal retention obligations.
• Object to the processing of your information.
• Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated.

To exercise any of these rights, contact us at hello@creativelynanda.co.za. We will respond within 30 days.

Information Regulator (South Africa): www.justice.gov.za/inforeg  |  inforeg@justice.gov.za

7. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. These include HTTPS encryption, row-level security on our database, and restricted access to production systems. No method of transmission over the internet is 100% secure, but we take our obligations under POPIA seriously.

8. Cookies

This website uses minimal cookies and browser storage:

• localStorage: Shopping cart contents and PWA installation preferences (stored locally on your device only).
• Session storage: Temporary interaction state (e.g., poem likes per session).
• Vercel Analytics: Privacy-first analytics that do not use cookies and do not track individuals.

We do not use third-party advertising or tracking cookies.

9. Consulting and B2B Engagements

When you engage us for consulting, AI engineering, web development, or business automation services, we may process personal information about your employees, clients, or end users as part of delivering those services. In such cases:

• You, as the client, are the Responsible Party for any personal information you share with us.
• We act as an Operator (as defined in POPIA) and will only process that information for the purposes of the engagement.
• We will not retain client data beyond the conclusion of the project without written instruction.
• Where required, we will enter into a written Operator Agreement before processing begins.

10. Access to Information (PAIA)

In terms of the Promotion of Access to Information Act, No. 2 of 2000 (PAIA), you may request access to records held by Mirembe Muse (Pty) Ltd. Requests must be submitted in writing to the Information Officer at hello@creativelynanda.co.za. We will respond within the timeframes prescribed by PAIA.

11. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted personal information to us, please contact us immediately so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect when the policy was last revised. Continued use of the website after changes constitutes acceptance of the updated policy.