Privacy

Who this covers

This policy covers cornerstone-ai.pro and the forms on it. It's written to the Protection of Personal Information Act (POPIA). The responsible party is Cornerstone AI (Pty) Ltd, South Africa. The Information Officer is Cristo Van Rensburg, reachable at [email protected].

Work I do for clients is governed by a separate written agreement, and the data I touch inside a client's systems is covered there, not here.

What I collect, and why

When you request a call, the form asks for your name, email, business name, and what you'd fix. It also asks for your role, phone number, website, team size and a monthly revenue band, so I can tell before we talk whether the program fits. I use this to answer you, to prepare for the call, and to decide whether to offer you the program.

When you join the newsletter, I collect your email address, and Kit records when you confirmed, opened or clicked, which is how a newsletter provider works.

When you apply or book a call from a program page (cornerstone-ai.pro/expansion or cornerstone-ai.pro/advisors), your name and email are saved as soon as you continue past the first step, so I can follow up if you don't finish. The questions after that (about your business or practice, your team, who decides, how urgent it is, and your WhatsApp number) tell me whether the call is a fit and help me prepare. I may email you about the call: a reminder if you didn't pick a time, and confirmations and reminders once you have. Every one of those emails has an unsubscribe link.

When you leave your details on a LinkedIn lead form, LinkedIn passes me your name, phone number, work email and company name. With your consent, I use them to send you the walkthrough video by email and SMS, and to contact you about it by phone, email and SMS, including to book a call with you. If we speak by phone, I may record your answers to my questions and book the call on your behalf. Every follow-up email and SMS tells you how to opt out.

When you open your walkthrough link, the link is personal to you, so what's recorded on that page (whether you opened it, which parts of the video you watched, and whether you booked) is tied to your name. I use this to decide when and how to follow up. What you watch stays with me, and is never sent to Meta or LinkedIn. If you book, LinkedIn is told that a booking happened, with a hashed (scrambled) copy of your email and your name and company, so I can see which of my adverts led to it.

On the program pages, I also record how the page is used: which steps of the form were reached, which screens of the demo were opened and which of its buttons were pressed (never anything typed into it), which parts of the video were watched (this stays with me and is never sent to Meta or LinkedIn) and where the visit came from, tied to a random identifier stored in your browser. It shows me where the page loses people. Those pages also run the Meta pixel and the LinkedIn Insight Tag, which tell Meta and LinkedIn that a visit, an application or a booking happened so my adverts reach the right people; when you apply or book, a hashed (scrambled) copy of your email is sent to them for the same purpose.

On every visit, Cloudflare records aggregate, cookieless analytics: page views, country, browser and referring site. Nothing there identifies you. I also keep my own count of page views: which page was opened, the referring site, any campaign tags in the link you followed, and the country, device type, browser and operating system. Nothing is stored in your browser for this and your IP address is never saved. To count a day's visitors, your IP address and browser details are scrambled together with a random value that is thrown away after that day, so the count cannot follow you from one day to the next. The form also keeps the campaign parameters and referring page of your visit for the length of your browser session, so I know how you found the site.

The lawful basis

Consent, for the newsletter, for the follow-up emails about a call you started booking, and for the walkthrough video and follow-up after a LinkedIn lead form. You can withdraw it with the unsubscribe link in any email, by following the opt-out instruction in any SMS, or by telling me on a call. Legitimate interest, for answering an enquiry you sent me and for keeping the site secure. Where a contract follows, processing continues under that contract.

Who processes it

• Cloudflare hosts the site, runs the Turnstile bot check on the form, and provides the analytics above.
• Supabase stores enquiries, bookings and the page count in my own database, which I run my business on.
• Kit holds the newsletter list and sends the issues.
• Resend sends the notification that tells me a new enquiry arrived.
• Google Workspace is my email and calendar.
• Meta receives the pixel events and hashed email described above, to measure and target my adverts.
• LinkedIn receives the Insight Tag events and hashed email described above, for the same purpose, and collects your details when you use one of my lead forms.
• Make passes your LinkedIn lead form details to my database and starts the email and SMS that deliver your walkthrough video.
• SMSPortal delivers the SMS messages.

Some of these operate outside South Africa. Each one works under its own published terms and safeguards, and none of them is permitted to use your details for anything other than the service above. I don't sell or rent personal information, ever.

How long I keep it

An enquiry that doesn't become a client is deleted twelve months after your last message. A newsletter address stays until you unsubscribe, then Kit deletes it under its own retention rules. Booking records follow the enquiry. Where a contract follows, its own retention terms apply.

Your rights

You can ask what I hold about you, ask me to correct it, ask me to delete it, or object to how it's used. Email [email protected] and I'll answer within a month, usually much sooner. If you're not satisfied, you can complain to the Information Regulator at [email protected].

Security

Everything is served over HTTPS. The form is checked for bots before it's accepted, and enquiries land in a database that only I and the people I've explicitly given access to can read, with that access set at the data itself.

Cookies

Most of the site sets no tracking or advertising cookies, and Cloudflare's analytics and my own page count are cookieless. The program pages (cornerstone-ai.pro/expansion and cornerstone-ai.pro/advisors) are the exception: the Meta pixel and the LinkedIn Insight Tag set advertising cookies there, and the page keeps a random visitor identifier in your browser's storage so a returning visit counts once. The Turnstile bot check may set a short-lived cookie on its own domain while it verifies you're a person, and the booking page uses one to hold your slot while you fill in the form.

Changes

If this policy changes, the effective date at the top changes with it. Nothing here narrows your rights under POPIA.