Privacy

Who is responsible

Leachie is Daniel Slater, trading as Leachie, a sole proprietor in Cape Town, South Africa. Daniel Slater is the responsible party for the information on this page and its Information Officer under the Protection of Personal Information Act (POPIA). Contact [email protected] for anything on this page.

What is collected and why

If you use an enquiry form

The consultation form on the home page sends your name, your email address, your business's name, what kind of business it is, your current website if you give it, and the page you sent it from. The form on leachie.com/smartqr sends your name, email address, phone number and business name if you give them, what you want the card to open, your message, and the page you sent it from. Both are saved in Leachie's customer records and used to reply to you and to follow up that enquiry.

If you write to us by email or WhatsApp

Whatever you send, usually your name, your contact details, your business's name and what you tell us about your project, is used to reply to you and, if you become a client, to do the work.

If you become a client

The details needed to quote, invoice and deliver the work: your name, your business's name, your contact details, the content of your website, and the record of what was paid.

If you pay online

Payments on leachie.com/pay are taken by Paystack in its own payment window. Your card details go to Paystack and never to us. We receive the email address used, the amount, the plan and Paystack's reference for the payment, and keep them with your account so the plan can be shown, changed or cancelled. Paystack's dashboard also shows us the card type and its last four digits, never the full number.

If you have a Leachie account

Clients and Smart QR card owners sign in at portal.leachie.com (leachie.com/account takes you there), and on leachie.com/pay before paying, with an email address and password or with a Google account. We keep your email address, your name if you give it or Google supplies it, and what you do in your account, such as where your Smart QR codes point and the tasks you create. Your password is stored in a scrambled form that nobody, including us, can read back.

If you record a voice note in the portal

A voice note about someone you met is saved with your account, transcribed by OpenAI, and turned by OpenAI into a written task for Leachie. The recording, the transcript and the task can contain personal information about that person, so record only what you are entitled to share. When the task is saved, a short notice goes to Leachie's private task channel on Discord with the task's title, the person's name and business, and the next step. Phone numbers and email addresses are removed from that notice.

When you visit leachie.com

Google Analytics counts visits and which pages are read. It records the pages you open, the site that sent you, your device and browser, and your approximate location, and a few actions: sending an enquiry form, opening a payment page (with its plan and amount), a completed payment (with its amount), and signing in or creating an account. It never receives your name, your email address or what you write. Google's advertising features are switched on for this site's Analytics, which lets Google recognise visitors who are signed in to a Google account and allow personalised ads. We see visitors only as totals and do not use Analytics to identify anyone.

Microsoft Clarity records how visitors use the pages: clicks, scrolling, mouse movement and the text on the page, so a visit can be replayed to see where a page is confusing. Clarity is set to show page text rather than hide it, so a recording can include what you type into a form before you send it.

Cloudflare Web Analytics counts page views and loading times on leachie.com and the portal without cookies and without identifying you. Cloudflare, which hosts both, also keeps standard technical records of each request, such as your IP address, your browser and the page asked for, to deliver the site and keep it secure.

Giving us information is voluntary, but without contact details we cannot reply to you, and without billing details we cannot provide a paid service.

Cookies and browser storage

_ga and _ga_2E5GS3NKSD

Google Analytics, on leachie.com. They tell a returning visitor from a new one. Kept for up to two years.

g_state

Set by Google's sign-in button on the sign-in pages. It remembers whether you closed Google's sign-in prompt. Kept for up to six months.

Sign-in session

Kept in your browser's storage while you are signed in to the portal, or to leachie.com/pay if you sign in there. Removed when you sign out.

Microsoft Clarity sets its own cookies (_clck and _clsk) on leachie.com to connect the pages of one visit, for up to a year.

Paystack's payment window sets its own cookies under Paystack's privacy policy. leachie.com sets no other cookies.

Google user data

If you choose to sign in with Google, Google gives Leachie your name, your email address and your profile picture. They are used only to sign you in to your Leachie account and to show which account you are signed in with. Nothing else in your Google account is requested or read. This information is stored with your account in Supabase and is not sold, used for advertising, or shared with anyone else.

Leachie also runs an internal keyword-research tool, the Google Cloud app "leachie-ads". It uses the Google Ads API to read keyword ideas and search volumes from Leachie's own Google Ads account, is used only by Daniel Slater, and never accesses or stores any customer's or visitor's Google data.

Leachie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What is never done with it

Your information is not sold, rented or shared for anyone else's marketing. You are not added to a mailing list unless you ask to be. Nothing you send is used as an example of our work unless you have agreed to that in writing, and then only for what you agreed to.

Who else handles it

Only the services needed to run the business, and only the part each one needs:

Cloudflare

Hosts leachie.com and the portal, runs the enquiry and payment functions, counts visits, and forwards email sent to leachie.com addresses. Sees each request and what passes through it.

Supabase

The database behind the portal: accounts, Smart QR settings, voice notes and tasks, payment records, and enquiries from the forms on leachie.com. Stored in Ireland.

Google

The Gmail mailbox where email to leachie.com addresses is delivered and kept, Google sign-in, and Google Analytics.

Resend

Sends email from leachie.com addresses. Sees the email and who it is addressed to.

Paystack

Card payments and monthly billing. Receives your card details, your email address and the amount.

OpenAI

Transcribes portal voice notes and drafts the task. Receives the recording and the transcript. Under its API terms it does not train its models on them.

Discord

Leachie's private task channel. Receives the short task notice described above.

Meta (WhatsApp)

Carries and stores messages if you write to us on WhatsApp.

Microsoft (Clarity) receives the visit recordings described above and keeps them for 30 days.

Each holds your information under its own data-protection terms, and we choose providers on the basis that they protect it.

Information sent outside South Africa

Cloudflare, Supabase (in Ireland), Google, Resend, OpenAI, Discord and Meta store or process information outside South Africa, and Paystack, which is owned by Stripe, may do so. Each is bound by data-protection terms that give a level of protection comparable to POPIA, which is the basis section 72 of POPIA allows for such a transfer.

Microsoft, for Clarity, processes information outside South Africa on the same basis.

How long it is kept

• Enquiries that do not become work: about a year, then deleted.
• Client, invoice and payment records: five years, as South African tax law requires, then deleted.
• Your account, its Smart QR settings, voice notes and tasks: while the account is open, or until you ask for them to be deleted.
• Google Analytics visit data: no longer than 14 months.

Anything else is deleted once it is no longer needed for the reason it was collected.

Keeping it safe, and telling you if something goes wrong

Access is limited to Daniel Slater. Each account can see only its own records, card details never reach us, systems are kept up to date, and nothing sensitive is stored where it does not need to be. If information is ever accessed by someone who should not have it, the people affected and the Information Regulator will be told as soon as reasonably possible, with what happened and what to do about it.

Your rights

Under POPIA you may, at no charge:

• ask whether we hold information about you, and for a copy of it
• ask for it to be corrected, or deleted
• object to its use, and withdraw any consent you gave
• ask not to receive direct marketing

Email [email protected]. We will confirm who you are before sending or changing anything, and reply within 30 days.

If you are unhappy with how we handled your information or your request, you may complain to the Information Regulator of South Africa:

Website

inforegulator.org.za

Complaints

[email protected]

Enquiries

[email protected], 010 023 5200

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Client websites

On websites Leachie builds and looks after for clients, the client decides what happens to any personal information and Leachie acts on the client's instructions. Each of those sites has its own privacy notice. Where a client's site sends enquiries to the client's Leachie portal, Leachie stores them for that client and uses them for nothing else.

Changes to this page

When what this site does with personal information changes, this page changes first, and the date at the top changes with it.