PRIVACY POLICY

1. Introduction

Viable Core Business (Pty) Ltd ("VCB-AI", "we", "us", or "our") provides artificial intelligence solutions, data infrastructure, and technology consulting services. We are committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and maintaining the highest standards of data privacy.

2. Our Privacy Philosophy

Sovereign. Local-First. Zero Trust Everything.

VCB-AI advocates for a fundamentally different approach to data privacy. We believe in data sovereignty — your data should remain on South African soil, under South African law, beyond the reach of foreign subpoenas and surveillance regimes like the US CLOUD Act.

Our philosophy is simple: We cannot hand over what we do not collect.

We operate on a Zero Trust Everything model. This means we assume every network, device, and user is potentially compromised, and we architect our systems accordingly. We collect only the absolute minimum required, retain it for the shortest period necessary, and design our infrastructure so that even we cannot access data that isn't essential for service delivery.

3. What We Actually Collect

We practice radical data minimization. Unlike companies that harvest everything and figure out uses later, we collect only what is strictly necessary:

• Payment Information: The minimum required to process transactions — name, billing address, and payment method. We use PCI-compliant processors; we never store full card numbers.
• Account Credentials: Email address and hashed password for authentication. We support passwordless/OTP where possible.
• Service Logs: Technical logs retained for 60 days maximum. These contain IP addresses and request metadata for security monitoring but do not contain personal information, conversation content, or AI inference data.
• Contractual Records: Business contact details and contract documentation as required for legal and tax compliance.

What we explicitly do NOT collect:

• We do not log AI conversation content or inference requests
• We do not track your behavior across websites
• We do not build profiles for advertising
• We do not retain biometric data
• We do not collect data from third-party brokers

4. How We Use Your Information

We process personal information only for these specific purposes:

• Processing payments and maintaining legally-required financial records
• Authenticating your access to our services
• Communicating essential service updates and support
• Security monitoring and incident response (using anonymized logs)
• Complying with South African legal, regulatory, and tax obligations

We do not use your data for: Advertising, profiling, selling to third parties, or training AI models without explicit written consent.

5. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Access: Request confirmation of what personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion where no legal obligation to retain exists
• Objection: Object to processing based on legitimate interests
• Restriction: Request limitation of processing in certain circumstances
• Portability: Receive your data in a structured, commonly used format
• Withdraw Consent: Withdraw previously given consent at any time
• Complain: Lodge complaints with the Information Regulator of South Africa

6. Security Measures & Zero Trust Architecture

We implement a Zero Trust security model — trust nothing, verify everything:

• Zero Trust Network Access: No implicit trust based on network location
• End-to-end encryption: Data encrypted in transit and at rest using AES-256 and TLS 1.3
• Multi-factor authentication: Required for all access, supporting OTP and hardware keys
• Principle of least privilege: Access granted only to what's needed, when it's needed
• Microsegmentation: Network isolation preventing lateral movement
• Continuous verification: Every request authenticated regardless of source
• South African hosting: All production data processed on South African soil
• Regular penetration testing: Independent security assessments

7. Data Sharing and Third Parties

We share personal information only when necessary with:

• Service Providers: Cloud infrastructure partners (DDN Storage, Cerebras.ai), payment processors, and IT service providers under strict confidentiality agreements
• Business Partners: Technology alliance partners (Cohesity, Cisco, HPE, Pure, AWS) for integrated solution delivery
• Legal Authorities: When required by law, court order, or regulatory obligation
• Corporate Transactions: In the event of mergers, acquisitions, or asset transfers (with prior notice)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

8. Data Retention

We retain data for the minimum period legally and operationally required:

• Service logs: 60 days maximum, then permanently deleted
• Financial records: 7 years (per South African tax legislation)
• Contractual records: Duration of relationship plus 5 years
• AI inference data: Not retained — processed in memory only

Upon expiry of retention periods, we securely delete data using cryptographic erasure methods. We cannot hand over what we do not collect, and we cannot recover what we have deleted.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, analyze usage patterns, and improve our services. You can manage cookie preferences through your browser settings. Essential cookies required for platform functionality cannot be disabled.

10. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors without verifiable parental or guardian consent. If we become aware of such collection, we will delete the information immediately.

11. Data Sovereignty & International Transfers

VCB-AI advocates for data sovereignty. We process and store all production data on South African soil, under South African jurisdiction. This protects your data from foreign subpoenas, including those issued under the US CLOUD Act.

Where international data transfer is strictly necessary (e.g., payment processing with global providers), we ensure appropriate safeguards including standard contractual clauses and explicit consent as required by POPIA.

12. Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. Material changes will be communicated via email or prominent website notice at least 30 days prior to taking effect. Your continued use of our services after such notice constitutes acceptance of the updated policy.

13. Related Policies

Please also review our Compliance Policy for information on our ethics, governance, and regulatory compliance framework.