01
Who is responsible
PRJCT STUDIO, registration number 2025/341591/07. Stellvia is the public brand used for this website. It is the responsible party for the processing described in this notice.
- Privacy and rights enquiries: privacy@stellvia.co
- PAIA requests: paia@stellvia.co
02
What this site does
Stellvia is preparing a buyer-readiness control service for South African service suppliers. The site currently provides information, deterministic Control Check 3.0, confirmed early-access email, a capacity-controlled Control Review request, a Founding Programme expression-of-interest process and a contact route.
The site does not conclude a software subscription, take payment, guarantee admission, promise payment, make a credit decision or provide legal, tax or accounting advice.
03
Information we collect
Depending on the route used, Stellvia may collect:
- work email address;
- business name;
- a minimized, time-limited Control Check draft after the visitor explicitly chooses to save and start;
- early-access request, confirmation and optional profile state;
- selected contact purpose and bounded free text;
- enumerated operating, evidence, workflow, timing, value-band and readiness answers;
- deterministic result class, reason codes and hard-disqualifier codes;
- notice and optional-marketing versions, copy hashes, channel, provenance and time;
- opaque receipt, idempotency and payload digests;
- short-lived pseudonymous abuse-control information;
- email-provider message and event identifiers and minimized delivery state;
- preference, unsubscribe, suppression and rights-request records.
04
Information not to submit
Do not submit customer documents, government identifiers, bank or card details, tax records, credentials, employee records, health information, biometric information, children's information or confidential workflow evidence.
05
Why we use it
Stellvia uses the information to:
- respond to a contact request;
- generate and explain a requested preliminary or full-stage fit result;
- record a Founding Programme expression of interest;
- provide a stable submission receipt and prevent accidental duplicates;
- save, resume, complete, expire or revoke a requested Control Check draft;
- confirm and manage an early-access request;
- record a capacity-controlled Control Review request;
- send requested operational correspondence;
- maintain optional communication preferences;
- prevent abuse and secure the service;
- reconcile email acceptance, delivery, failure, bounce, complaint and suppression;
- handle privacy, PAIA and complaint requests;
- maintain auditability and recover the service.
06
Lawful justification
The applicable lawful justification depends on the operation and may include action requested by the data subject, legitimate operational and security interests, legal obligations and express consent for optional electronic marketing.
07
Required and optional information
Fields marked required are needed to process the relevant request. If required information or the notice acknowledgement is not provided, the request cannot be submitted.
Optional marketing consent is separate, unchecked and not required for contact, qualification or application processing.
08
Drafts and saved records
Before the visitor chooses Save and start, answers remain in the browser tab. That explicit action creates one minimized server draft tied to the submitted email address. The draft supports recovery and expires after 14 days unless it is completed or revoked sooner. It is not marketing consent.
A completed assessment record is created only after deliberate final submission and successful commit. Exact duplicate submissions within the approved replay window return the original receipt instead of creating another assessment, email or lead activity.
Clearing a browser form does not delete a committed server record. Contact privacy@stellvia.co to request access, correction, deletion, restriction or objection.
09
Qualification
Control Check model 3.0.0 is deterministic and explainable. Historical 2.0.0 and 1.3.0 records remain unchanged and readable. A result is not an offer, admission, contract, capacity decision, credit decision or professional decision. The result shows the recorded answers that caused it and gives a useful boundary outcome when the current product focus does not fit.
No artificial-intelligence propensity score or opaque profile is treated as the official result.
10
Providers and international processing
Stellvia uses infrastructure and service providers that may process information outside South Africa:
- Vercel for hosting and server execution;
- Neon/Databricks for PostgreSQL and recovery;
- Resend for transactional email and provider events;
- Cloudflare Turnstile for abuse prevention;
- GoDaddy for DNS;
- Google Workspace for controlled human correspondence;
- GitHub for source and CI, which must not contain real customer data.
- Stellvia records the applicable providers, processing purposes, regions, safeguards, retention and deletion procedures. International transfers are made only where an applicable section 72 basis is available.
11
Email and optional marketing
Operational messages requested by the visitor remain separate from marketing.
Stellvia will send optional product updates or research invitations only after a separate, specific choice has been confirmed. Consent may be withdrawn at any time. Every marketing message will identify Stellvia and provide a free and simple unsubscribe route.
Withdrawal does not prevent receipts, security notices or replies necessary to handle a request.
12
Retention
An unfinished Control Check draft expires after 14 days. Expiry removes the active draft and its resume authority, subject to the minimum receipt or digest evidence needed to prevent duplicate processing and to enforce privacy or suppression choices.
Stellvia retains personal information only for the purpose-specific periods in its approved retention schedule, subject to legal holds, disputes, security incidents and provider backup expiry. Deleted records may remain in backups until the configured recovery window expires. When a backup is restored, applicable deletions and suppressions must be reapplied.
13
Security
Stellvia uses access controls, least-privilege database roles, encrypted transport, signed provider webhooks, secret separation, bounded input validation, idempotency, anti-abuse controls, backups, restore tests and monitoring.
No system is completely secure. Where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, Stellvia will investigate, contain and notify the Information Regulator and affected data subjects as required.
14
Rights
Subject to applicable law, a data subject may request confirmation, access, correction, deletion, destruction, restriction or objection and may withdraw optional marketing consent.
Requests may be sent to privacy@stellvia.co. Stellvia will use proportionate identity verification and will not request an identity document by default. A request is described as complete only after the site record and any relevant provider actions have been verified.
A person may complain to the Information Regulator using the current contact route published by the Regulator.
15
Analytics, cookies and browser storage
Vercel Web Analytics provides anonymous aggregate route and device information within the existing hosting service. It is not configured to receive form answers, names, email addresses, telephone numbers, receipts, query strings or free text. Google Analytics 4 remains disabled unless the exact production origin and publication gates are open and the visitor explicitly allows analytics in that browser. Before that choice the application does not load the Google analytics script, send a Google Analytics request or ping, or receive a Google Analytics cookie.
The browser stores only the visitor's GA4 choice so it can be respected on later pages. Withdrawal prevents future GA4 collection. Advertising signals, cross-site identity, session replay and marketing pixels are disabled. Hosting and Turnstile may process network and browser metadata necessary to provide and secure the service. Current storage and browser behaviour is described on the Analytics and browser storage page and must be updated if provider behaviour changes.
16
Children and special personal information
The site is intended for adults acting in a business capacity. Do not submit children's information or special personal information. Stellvia does not intentionally request such information.
17
Changes
Material changes to the purpose, data categories, providers, regions, marketing, analytics, qualification consequence, retention or commercial offering require a new review and an updated notice.
18
Contact
- General: info@stellvia.co
- Support: support@stellvia.co
- Privacy: privacy@stellvia.co
- PAIA: paia@stellvia.co