How CVO Atlas handles the personal information you give us through cvoatlas.com and when you do business with us.
Who we are
This website, cvoatlas.com, is operated by Matthew Michael Christiansen, a sole proprietor trading as CVO Atlas. CVO Atlas is a trading name, not a registered company. In this policy, "CVO Atlas", "we" and "us" mean Matthew Michael Christiansen trading as CVO Atlas.
For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information described in this policy.
Our contact details: Matthew Michael Christiansen, trading as CVO Atlas; email matthew@cvoatlas.com; Johannesburg, South Africa.
Information Officer: Matthew Michael Christiansen, matthew@cvoatlas.com.
What this policy covers
This policy covers personal information we collect: through the Start a Project enquiry form on cvoatlas.com; through the assistant on the website; when you contact us by email or telephone; when you complete our onboarding forms; and when you become a customer.
It does not cover websites we build and host for our customers. On those websites the customer decides how personal information is used, and the customer's own privacy notice applies; we process that information only on the customer's behalf, under a written agreement.
Information we collect through the enquiry form
When you send an enquiry through the Start a Project form, we collect:
| Field | Required? |
|---|
| Your name | Required |
|---|---|
| Email address | Required |
| Phone number | Optional |
| Business name | Required |
| Current website address | Optional |
| What you would like to talk about (website package, AI chatbot, Google SEO, general question) | Optional |
| Branding interest (none, Brand Refresh, Complete Corporate Identity, or advice) | Optional |
| How you heard about CVO Atlas | Optional |
| Your message about your business and what you need | Required |
| Your agreement that we may use these details to respond, the wording you agreed to, and when | Required to send the form |
We also record technical details about the submission: the date and time it was received, a random reference created by your browser so that a repeated submission (for example if you click twice) is not saved twice, and a reference number for your enquiry.
If you do not provide the required details, we cannot receive your enquiry through the form. You can always email us instead.
The form includes measures to detect automated spam. Submissions identified as automated are discarded and not stored.
Why we use it
We use the information in your enquiry only to respond to you, to discuss a possible project with you and to prepare a proposal if you ask for one. Our lawful basis is your consent, given on the form, and taking steps at your request before a possible contract (section 11(1)(a) and (b) of POPIA).
We do not sell your information and we do not add you to a marketing list. We will send you marketing by email or other electronic means only if you have consented to it, or, if you are our customer, about our own similar services, as section 69 of POPIA allows. You may object to direct marketing at any time, free of charge, and every marketing message will tell you how to do so.
We may compare a new enquiry with recent ones (using the email address and answers) to flag a possible accidental repeat for a person to check. We never delete an enquiry automatically because it looks like a repeat.
Who processes your enquiry for us
Your enquiry is stored in private storage provided by our website host, Netlify, Inc., in the United States. It is not publicly accessible.
A notification containing your enquiry is sent to our business mailbox by our email delivery provider, Resend, using its European Union (Ireland) sending region. Our business mailbox is provided by Namecheap (Namecheap Private Email).
Only CVO Atlas can view stored enquiries, through an administration page protected by strong authentication.
We do not share your enquiry with anyone else, except the service providers described in this policy or where the law requires it.
The assistant on this website
The assistant on this website uses an AI model provided by Anthropic, PBC to answer questions about CVO Atlas from information we have approved. When you use it, your messages in the current conversation are sent from our server to Anthropic in the United States to generate a reply.
We do not store the text of your chat. To apply fair-use limits, we keep a one-way scrambled ("hashed") code derived from your internet (IP) address and a secret value, which is deleted automatically after about two days.
Anthropic processes your messages under its commercial terms. Under those terms, the messages are not used to train Anthropic's models and are deleted by Anthropic within 30 days by default, but messages that Anthropic's safety systems flag may be kept for up to 2 years.
Please do not share sensitive personal information (such as health information, identity numbers or financial details) with the assistant. Its answers can be wrong and are not professional advice.
Website hosting information
When you visit the website, our host's servers automatically receive technical information that your browser sends, such as your IP address, the page requested, the date and time, and your browser type. This is needed to deliver the website and protect it against attacks, and is processed by Netlify under its own terms. Our host also tells the website which country your connection appears to come from, so prices can be shown in your currency. We don't store it.
We do not use this information to identify you or to build a profile of you.
Cookies and browser storage
This website does not set cookies and does not use analytics, advertising, social media tracking or other third-party tracking tools. All the website's scripts, fonts and images are served from our own website.
The website uses your browser's storage for two small functional items, which stay on your device:
| Name | Type | Purpose | How long |
|---|
| cvo-motion | Local storage | Remembers whether you paused the homepage animation | Until you clear your browser's storage |
|---|---|---|---|
| cvo-enquiry-id | Session storage | Shows your enquiry reference on the thank-you page | Until you close the browser tab |
| cvo-currency | Local storage | Remembers the currency you chose for prices (only if you choose one) | Until you clear your browser's storage |
| cvo-chat, cvo-chat-open | Session storage | Keeps your conversation with the assistant, and whether its window is open, while you move between pages. Kept only in your browser; we don't store it | Until you close the browser tab |
If we add cookies, analytics or similar technologies in future, we will update this policy first and, where required, ask for your consent.
Customers and onboarding
If you become our customer, we also process the contact details of you and your staff, the agreement, invoices and payment records, project communications, the information you give us in our onboarding forms, and the materials you send us. We do this to perform our agreement, to invoice you, to keep records required by tax law, and to protect our legal rights (section 11(1)(b), (c) and (f) of POPIA). We never ask you to send passwords, identity numbers or bank card details through our forms.
Invoicing and payments. We issue invoices and payment reminders using Zoho Invoice (Zoho Corporation), which holds your billing name, email address, billing address (if given), the services, amounts and payment status, in the Zoho data centre region linked to our account. If you pay by card through a payment link, the payment is processed by our card-payment provider (in South Africa, Yoco). Payments from outside South Africa are made through the payment provider or bank details named on your invoice. These payment providers collect and process your payment details as independent responsible parties under their own privacy policies; we receive confirmation of payment and the payer's name and reference, not your full card number.
When we host your website or operate your chatbot, the personal information of your website visitors is processed under our Data Processing Agreement with you, not under this policy.
How long we keep information
| Information | How long we keep it |
|---|
| Enquiries that do not lead to a project | Up to 12 months from our last contact, then deleted |
|---|---|
| Customer agreements and project records | For the duration of the agreement and 5 years after it ends |
| Invoices, payment confirmations and financial records | At least 5 years from the date the relevant tax return is submitted (Tax Administration Act 28 of 2011, section 29) |
| Support and project correspondence | 2 years after the matter is closed |
| Assistant rate-limit codes | About 2 days |
We may keep information longer if the law requires it or if it is needed for a legal claim, and then only for that purpose (section 14 of POPIA).
Information outside South Africa
Our website host (Netlify) and AI provider (Anthropic) process information in the United States; our email delivery provider (Resend) sends from the European Union (Ireland); our mailbox provider (Namecheap) and invoicing provider (Zoho) process it in the regions linked to our accounts, which may be outside South Africa; and international payment providers named on invoices process payments in the countries where they operate. Each provider is bound by written data processing terms that require it to protect personal information, as section 72 of POPIA requires.
How we protect information
We use appropriate, reasonable technical and organisational measures to protect personal information, including encrypted (HTTPS) connections, private storage, restricted and strongly authenticated access, keeping secret keys on the server only, security headers and multi-factor authentication on our accounts. No method of transmission or storage is completely secure. If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as section 22 of POPIA requires.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you and ask for a copy of it;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that we are no longer authorised to keep;
- object to our processing of your information on reasonable grounds, and object at any time to direct marketing;
- withdraw your consent at any time (this does not affect processing before you withdraw it); and
- complain to the Information Regulator.
To use these rights, contact our Information Officer at matthew@cvoatlas.com. We may need to confirm your identity. We respond within 30 days of receiving your request, and simple requests are free. If you ask us to delete or correct information, we tell you what we have done. Requests for access to records may also be made under the Promotion of Access to Information Act 2 of 2000, as described in our PAIA Manual, which is available on request from our Information Officer.
Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. General enquiries: enquiries@inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. Telephone: 010 023 5200.
Children
This website and our services are for businesses and adults. We do not knowingly collect personal information from children.
Changes to this policy
We update this policy when our website or our use of personal information changes, and show the version and date at the top. This is version 1.2, dated 14 October 2026.
