01
Who is responsible
PRJCT STUDIO, registration number 2025/341591/07. Stellvia is the public brand used for this website. It is the responsible party for the processing described in this notice.
- Privacy and rights enquiries: privacy@stellvia.co
- PAIA requests: paia@stellvia.co
02
What this site does
Stellvia is preparing STELLVIA CONTROL, an operating-control service for South African service businesses that is still in development. The site currently provides information and worked examples, a five-question guide that can be emailed on request, confirmed launch updates and a contact route. Earlier assessment, review and Founding application intake is closed; records made through those routes are kept as described in this notice.
The site does not conclude a software subscription, take payment, guarantee admission, promise payment, make a credit decision or provide legal, tax or accounting advice.
03
Information we collect
Depending on the route used, Stellvia may collect:
- work email address;
- business name;
- the five guide answers, the answer and report versions and a digest of the report when you ask for your guide by email;
- launch-update request, confirmation and preference state;
- selected contact purpose and bounded free text;
- answers, result classes and reason codes recorded through earlier assessment and application routes, which are now closed;
- notice and optional-marketing versions, copy hashes, channel, provenance and time;
- opaque receipt, idempotency and payload digests;
- short-lived pseudonymous abuse-control information;
- email-provider message and event identifiers and minimized delivery state;
- preference, unsubscribe, suppression and rights-request records.
04
Information not to submit
Do not submit customer documents, government identifiers, bank or card details, tax records, credentials, employee records, health information, biometric information, children's information or confidential workflow evidence.
05
Why we use it
Stellvia uses the information to:
- respond to a contact request;
- send the guide you ask for by email and help with related support;
- keep records made through closed assessment, review and application routes;
- provide a stable submission receipt and prevent accidental duplicates;
- confirm and manage launch updates, including the scheduled emails that follow confirmation;
- send requested operational correspondence;
- maintain optional communication preferences;
- prevent abuse and secure the service;
- reconcile email acceptance, delivery, failure, bounce, complaint and suppression;
- handle privacy, PAIA and complaint requests;
- maintain auditability and recover the service.
06
Lawful justification
The applicable lawful justification depends on the operation and may include action requested by the data subject, legitimate operational and security interests, legal obligations and express consent for optional electronic marketing.
07
Required and optional information
Fields marked required are needed to process the relevant request. If required information or the notice acknowledgement is not provided, the request cannot be submitted.
Optional launch updates are a separate, unchecked choice. They are not required to use the guide, request it by email or contact Stellvia.
08
Guide answers and saved records
Guide answers stay in the browser tab while you answer. So that a refresh does not lose them, the tab's session storage keeps only the answer version, the answers and the current step until you clear them or close the tab; your email address is never stored there. If the outcome of an email request is uncertain, the tab also keeps an opaque request reference so that a retry cannot send the guide twice.
After you send a contact message, join the launch list or email your guide, the tab's session storage keeps only what kind of request it was, its reference where there is one, and the time, for up to 24 hours, so that a refresh shows your confirmation instead of an empty form. Nothing you typed is stored there.
A server record is created only when you ask for your guide by email and the request is committed. It holds your email address, the five answers, the answer and report versions and a digest of the report so that Stellvia can send that guide, prevent duplicates and handle support or privacy requests. Exact duplicate requests within the approved replay window return the original receipt instead of creating another record or email.
Clearing a browser form does not delete a committed server record. Contact privacy@stellvia.co to request access, correction, deletion, restriction or objection.
09
Guide results and earlier assessments
The guide's report is built only from the five answers you choose, using fixed rules. It is not a score, assessment, offer, admission, contract, capacity, credit or professional decision, and no documents or business records are inspected.
Records from earlier assessment routes, including Control Check models 3.0.0, 2.0.0 and 1.3.0, remain unchanged and readable. Those routes no longer accept new submissions.
No artificial-intelligence propensity score or opaque profile is treated as the official result.
10
Providers and international processing
Stellvia uses infrastructure and service providers that may process information outside South Africa:
- Vercel for hosting and server execution;
- Neon/Databricks for PostgreSQL and recovery;
- Resend for transactional email and provider events;
- Cloudflare Turnstile for abuse prevention;
- GoDaddy for DNS;
- Google Workspace for controlled human correspondence;
- GitHub for source and CI, which must not contain real customer data.
- Stellvia records the applicable providers, processing purposes, regions, safeguards, retention and deletion procedures. International transfers are made only where an applicable section 72 basis is available.
11
Email and optional marketing
Operational messages requested by the visitor remain separate from marketing.
Stellvia sends optional launch updates only after you confirm a separate, specific choice. After confirmation you receive an introduction and practical notes around days 3, 7, 14 and 21, then at most one useful update each month and a launch announcement. Consent may be withdrawn at any time. Every marketing message identifies Stellvia and provides a free and simple unsubscribe route.
Emailing your guide is a message you requested, not marketing, and does not add you to launch updates.
Withdrawal does not prevent receipts, security notices or replies necessary to handle a request.
12
Retention
Unfinished drafts from the closed Control Check expire after 14 days. Expiry removes the draft and its resume authority, subject to the minimum receipt or digest evidence needed to prevent duplicate processing and to enforce privacy or suppression choices. Once the email provider accepts a requested guide, the report text is removed from the sending record; the guide request keeps the answers and report digest described above.
Stellvia retains personal information only for the purpose-specific periods in its approved retention schedule, subject to legal holds, disputes, security incidents and provider backup expiry. Deleted records may remain in backups until the configured recovery window expires. When a backup is restored, applicable deletions and suppressions must be reapplied.
13
Security
Stellvia uses access controls, least-privilege database roles, encrypted transport, signed provider webhooks, secret separation, bounded input validation, idempotency, anti-abuse controls, backups, restore tests and monitoring.
No system is completely secure. Where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, Stellvia will investigate, contain and notify the Information Regulator and affected data subjects as required.
14
Rights
Subject to applicable law, a data subject may request confirmation, access, correction, deletion, destruction, restriction or objection and may withdraw optional marketing consent.
Requests may be sent to privacy@stellvia.co. Stellvia will use proportionate identity verification and will not request an identity document by default. A request is described as complete only after the site record and any relevant provider actions have been verified.
A person may complain to the Information Regulator using the current contact route published by the Regulator.
15
Analytics, cookies and browser storage
Vercel Web Analytics provides anonymous aggregate route and device information within the existing hosting service. It is not configured to receive form answers, names, email addresses, telephone numbers, receipts, query strings or free text. Google Analytics 4 remains disabled unless the exact production origin and publication gates are open and the visitor explicitly allows analytics in that browser. Before that choice the application does not load the Google analytics script, send a Google Analytics request or ping, or receive a Google Analytics cookie.
For measurement, the browser stores only the visitor's GA4 choice so it can be respected on later pages. Withdrawal prevents future GA4 collection. Advertising signals, cross-site identity, session replay and marketing pixels are disabled. Hosting and Turnstile may process network and browser metadata necessary to provide and secure the service. Current storage and browser behaviour is described on the Analytics and browser storage page and must be updated if provider behaviour changes.
16
Children and special personal information
The site is intended for adults acting in a business capacity. Do not submit children's information or special personal information. Stellvia does not intentionally request such information.
17
Changes
Material changes to the purpose, data categories, providers, regions, marketing, analytics, qualification consequence, retention or commercial offering require a new review and an updated notice.
18
Contact
- General: info@stellvia.co
- Support: support@stellvia.co
- Privacy: privacy@stellvia.co
- PAIA: paia@stellvia.co