Privacy notice
How we handle your personal information
Last updated: 29 October 2026
The short version: the website doesn't track you. We only receive personal information when you email us or use the client portal, we use it to do the work you've asked for, and we don't sell it or use it for advertising.
1. Who we are
WrenchVerse Bespoke is a trading name of Henrico JC Swanepoel, a sole proprietor, who is the "responsible party" for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Henrico is also our Information Officer.
- henrico@wrenchverse.com
- Address
- 95 Panorama Road, Centurion
2. What we collect, and why
When you browse the website
The website itself collects nothing about you. The cost calculator and the "Where do I start?" questions run entirely in your browser. What you type or choose is never sent to us.
Our hosting provider, Cloudflare, necessarily processes technical information such as your IP address and browser type to deliver the site and protect it from attacks (see section 4).
When you contact us
When you press "Send my request", the enquiry form sends us your name, email address and what you wrote: your business name, the kind of problem, a description of it, the best time to talk and, if you ticked the boxes, your cost estimate or suggested first step. It's stored in our client portal's database and emailed to us. We also record the IP address it came from, only to limit abuse (for example, someone sending hundreds of fake enquiries).
If sending doesn't work, the form prepares an email in your own email app instead, which reaches us only if you choose to send it. Without JavaScript, the form always works that way.
Why: to reply to you, arrange the free triage and decide together whether to work together. This is processing you've asked for, and it's in our legitimate interest to answer enquiries.
When you're a client
We hold the information needed to do the work and run the business relationship:
- contact details: names, email addresses and your business name;
- project information: stages, notes, milestones and the documents we exchange, such as diagnostic findings;
- requests and messages you send through the client portal;
- quotes and invoices.
While investigating a workflow we may see information about your own staff or customers, for example in documents or screenshots you share. We use that only for the engagement and handle it as confidential. Please share only what we need.
Why: to carry out our agreement with you and to meet our legal obligations, such as keeping financial records.
When you use the client portal
You sign in with your email address. We email you a one-time sign-in link and keep a record that you're signed in. We store only scrambled (hashed) versions of sign-in links and sessions, never the links themselves.
What we don't do
We don't sell or rent personal information. We don't use it for advertising, and we don't make automated decisions about you. We don't send marketing emails or newsletters. If that ever changes, we'll ask for your consent first, as POPIA requires.
3. Cookies and tracking
The website uses no analytics, advertising or tracking cookies, and no third-party scripts or fonts.
The client portal sets one strictly necessary cookie,
wv_session, which keeps you signed in for up to 30 days
or until you sign out. Cloudflare may set strictly necessary security
cookies to protect the site from abuse.
4. Who else handles it
We use a small number of service providers ("operators" under POPIA) who process information only on our instructions:
- Cloudflare, Inc. hosts the website and client portal, including the portal's database and uploaded files.
- Our email hosting provider, based in South Africa, sends and receives our email, including portal sign-in links and notifications.
We may also disclose information where the law requires it, for example to the South African Revenue Service.
5. Information stored outside South Africa
Cloudflare runs a global network, so website traffic and the client portal's data (accounts, project information, messages, invoices and files) are processed and stored on servers outside South Africa. Under section 72 of POPIA, we rely on the fact that this transfer is necessary to provide the services you've asked for, and on Cloudflare's data processing terms, which bind it to protect personal information to a standard substantially similar to POPIA.
6. How long we keep it
- Client records (project information, documents, messages, quotes and invoices): five years after our engagement ends, in line with South African record-keeping requirements such as the Tax Administration Act. After that, we delete them.
- Portal access: when an engagement ends, or if you ask, we remove your portal account. Records we're required to keep are kept for the period above.
- Enquiries that don't lead to an engagement: deleted within 12 months.
- Sign-in links expire after 15 minutes and are deleted within a day. Sessions end after 30 days or when you sign out.
7. How we protect it
The site and portal are only available over encrypted connections (HTTPS). Each client can see only their own business's information in the portal. Sign-in uses one-time links instead of passwords, and only hashed versions of links and sessions are stored. Uploaded files are served only to signed-in users who are allowed to see them.
If a security breach affects your personal information, we'll notify you and the Information Regulator as POPIA requires.
8. Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete information that is inaccurate, out of date, or that we're no longer allowed to keep;
- object to us processing your information, where we rely on our legitimate interests;
- complain to the Information Regulator.
To make a request, email henrico@wrenchverse.com. We may need to confirm your identity first. We won't charge you for reasonable requests.
If you're unhappy with how we've handled your information, please tell us first so we can try to fix it. You can also contact the Information Regulator (South Africa).
9. Changes to this notice
If we change how we handle personal information, we'll update this page and the date at the top. If a change materially affects existing clients, we'll also tell them by email.