Privacy notice

Written for the Protection of Personal Information Act, 2013 (POPIA). Plain language on purpose. Last updated 18 September 2026.

The short version

The directory needs no account and collects nothing about you. An account exists only if you make one, and everything in it is yours to download or delete from the account page in two clicks.

Without an account

Your saved places, training log, plates, diary, tasks and scan history live in your own browser. They are not sent anywhere, and clearing your browser data erases them. Ask, the question box, runs on your device by default: the directory is already downloaded, so a typed question is answered without leaving your phone. When a model is available the question goes to our own server instead — what is sent, and what is not, is set out below.

With an account

• What we store: your email address, your name if you give one, your home town, and whatever you save — plan, logs, diary, plates, tasks, scans, subscription.
• Where: a Supabase Postgres database in London (eu-west-2), with row-level security so a row is readable only by the account that owns it. Transfers outside South Africa are made under POPIA section 72 on the basis of comparable protection and our contract with the processor.
• Sign-in: Google, Apple or a one-time email link. No password is stored because none exists. Google or Apple tell us your email address and, if you allow it, your name and picture. They do not tell us anything else and we do not ask.
• Health-type data — bodyweight, training load, mood, sleep, injuries, diary entries — is special personal information under POPIA section 26. It is stored only after you tick the consent box on the account page, is visible to nobody but you, and is never used to train a model. Withdraw the consent and the app stops accepting new entries.
• Payments are processed by Yoco. Card numbers never reach Veldlist; we keep the reference, the amount and the date.

What leaves your device either way

• Hosting: pages are served by Cloudflare, whose edge logs standard request data for security. No analytics, no advertising pixels, no third-party tracking scripts, anywhere.
• Fonts and images are served from this site. Nothing is fetched from a third-party CDN.
• Barcode lookups send the barcode number — and nothing else — to Open Food Facts, a non-profit database in France.
• Ask, when a model is available: the question you typed and the town you measure distances from are sent to this site's own server, which retrieves the listings itself and passes only those rows to an NVIDIA NIM endpoint for wording. Your account, your diary and your history are never sent. The reply is checked against the retrieved rows and discarded if it names anything else.
• WhatsApp: if you message the number, Meta processes that conversation under its own terms. We reply inside the window your message opens and start nothing ourselves.
• Flags and suggestions you send about a listing are stored with the text you typed and the date. Please do not put personal information in them.

Cookies

The landing page and the directory pages set no cookies at all. Signing in sets one session cookie so the next page knows it is you; it is strictly necessary, carries no advertising identifier and is removed when you sign out. Small preferences such as your theme are kept in your browser's own storage, which is not a cookie and is never transmitted.

Email

Account email — a sign-in link, a receipt, a change to these terms — is sent because you have an account. Anything else is sent only if you ticked the box, and one tap in any of those messages, or one switch on your account page, stops them for good (POPIA section 69). We use Resend to deliver mail; they see the address and the message.

How long

Account data is kept while the account exists and is deleted immediately when you delete it. Payment records are kept for five years because tax law requires it. Listing records are about businesses, not people, and are kept indefinitely with their dates.

Your rights

You may ask what we hold, correct it, delete it, object to processing, and complain. The account page does the first three by itself — Download everything and Delete my account data. Otherwise email christiaan@sovereignmatrix.agency. The Information Regulator of South Africa can be reached at inforegulator.org.za, and you may complain to them at any time without going through us first.

Responsible party and Information Officer

Christiaan de Wet trading as Sovereign Matrix, Klerksdorp, North West. Information Officer: Christiaan de Wet, christiaan@sovereignmatrix.agency. See also the company and seller disclosure and the PAIA manual.