Privacy

Who this covers

This policy covers cornerstone-ai.pro and the forms on it. It's written to the Protection of Personal Information Act (POPIA). The responsible party is Cornerstone AI (Pty) Ltd, South Africa. The Information Officer is Cristo Van Rensburg, reachable at [email protected].

Work I do for clients is governed by a separate written agreement, and the data I touch inside a client's systems is covered there, not here.

What I collect, and why

When you request a call, the form asks for your name, email, business name, and what you'd fix. It also asks for your role, phone number, website, team size and a monthly revenue band, so I can tell before we talk whether the program fits. I use this to answer you, to prepare for the call, and to decide whether to offer you the program.

When you join the newsletter, I collect your email address, and Kit records when you confirmed, opened or clicked, which is how a newsletter provider works.

When you book a call from the program page (cornerstone-ai.pro/expansion), your name and email are saved as soon as you continue past the first step, so I can follow up if you don't finish. The questions after that (where the business is, monthly revenue, who decides, how urgent it is, your WhatsApp number and website) tell me whether the call is a fit and help me prepare. I may email you about the call: a reminder if you didn't pick a time, and confirmations and reminders once you have. Every one of those emails has an unsubscribe link.

On the program page, I also record how the page is used: which steps of the form were reached, how much of the video was watched and where the visit came from, tied to a random identifier stored in your browser. It shows me where the page loses people. That page also runs the Meta pixel, which tells Meta that a visit, a sign-up or a booking happened so my adverts reach the right people; when you give your email or book, a hashed (scrambled) copy of your email is sent to Meta for the same purpose.

On every visit, Cloudflare records aggregate, cookieless analytics: page views, country, browser and referring site. Nothing there identifies you. The form also keeps the campaign parameters and referring page of your visit for the length of your browser session, so I know how you found the site.

The lawful basis

Consent, for the newsletter and for the follow-up emails about a call you started booking, which you can withdraw with the unsubscribe link in any issue. Legitimate interest, for answering an enquiry you sent me and for keeping the site secure. Where a contract follows, processing continues under that contract.

Who processes it

• Cloudflare hosts the site, runs the Turnstile bot check on the form, and provides the analytics above.
• Supabase stores enquiries and bookings in my own database, which I run my business on.
• Kit holds the newsletter list and sends the issues.
• Resend sends the notification that tells me a new enquiry arrived.
• Google Workspace is my email and calendar.
• Meta receives the pixel events and hashed email described above, to measure and target my adverts.

Some of these operate outside South Africa. Each one works under its own published terms and safeguards, and none of them is permitted to use your details for anything other than the service above. I don't sell or rent personal information, ever.

How long I keep it

An enquiry that doesn't become a client is deleted twelve months after your last message. A newsletter address stays until you unsubscribe, then Kit deletes it under its own retention rules. Booking records follow the enquiry. Where a contract follows, its own retention terms apply.

Your rights

You can ask what I hold about you, ask me to correct it, ask me to delete it, or object to how it's used. Email [email protected] and I'll answer within a month, usually much sooner. If you're not satisfied, you can complain to the Information Regulator at [email protected].

Security

Everything is served over HTTPS. The form is checked for bots before it's accepted, and enquiries land in a database that only I and the people I've explicitly given access to can read, with that access set at the data itself.

Cookies

Most of the site sets no tracking or advertising cookies, and Cloudflare's analytics are cookieless. The program page (cornerstone-ai.pro/expansion) is the exception: the Meta pixel sets advertising cookies there, and the page keeps a random visitor identifier in your browser's storage so a returning visit counts once. The Turnstile bot check may set a short-lived cookie on its own domain while it verifies you're a person, and the booking page uses one to hold your slot while you fill in the form.

Changes

If this policy changes, the effective date at the top changes with it. Nothing here narrows your rights under POPIA.