Privacy

Who is responsible

Lockhart is a trading name of Lockhart Investments (Pty) Ltd, registration number 2017/196101/07 (“Lockhart”). Lockhart is the responsible party for personal information collected through this website and its own WhatsApp line.

Information Officer: Luke Buckley, luke@lockhart.africa.

What is collected

• What you send through a form: your name, business, email, phone number, website address and message.
• What you send on WhatsApp or by email, and the details you give when you call.
• For the Website Check: the website address you enter and the email the report goes to. The check reads only public information about the website and its domain.

This website sets no advertising or tracking cookies.

The Website Check

When you run the free Website Check, the website address you enter is sent to Google’s PageSpeed Insights service, which loads that website and measures how quickly it shows on a phone. Google’s result is kept for 24 hours, so the same address checked again within a day is answered without asking Google again. To limit each visitor to five checks an hour, your IP address is turned into a one-way code (a hash) and only that code is stored, for about an hour; your IP address itself is not stored. If Google’s usage limit for these tests is reached, the name of the website that was checked (for example yourbusiness.co.za) is kept in a log for 90 days, with the time and Google’s error message. The check’s results are not kept with your name or email unless you ask for the full report.

Bank statements

This covers the Lockhart Cashflow Review and Monthly Books & Reports. Lockhart is the responsible party for the bank statements its clients share with it.

• How they are collected. Directly from the client, through the Lockhart client portal (app.lockhart.africa), which you sign in to with a code sent to your email. They are used only to prepare that client’s review or monthly books.
• Where they are stored. The portal is run for Lockhart by Supabase, which stores uploaded statements, the finished report and the client’s answers to questions about payments on servers in Ireland, in the European Union, encrypted. Statements are removed from the portal as soon as Lockhart downloads them, and are then kept on one encrypted computer in South Africa.
• When they are deleted. 30 days after the report is delivered, with every copy, working file and portal file. A record of each deletion is kept, without any of the content.
• Who sees them. Luke reads every statement. The statements name the client’s customers, staff and suppliers; those names are used only within that client’s review. Some processing is done by a US-based service provider under contract. Statements are never used to train AI models. The portal’s emails (sign-in codes and notices) are sent through Resend in the United States and contain names, email addresses and company names only, never anything from the statements.
• Monthly summaries. For monthly reviews, a summary of each month’s totals per spending category is kept after that month’s statements are deleted, with no names, transaction lines or account numbers, for up to 24 months while the reviews continue.
• Payee categories. Lockhart keeps a list of business payee names and their spending categories to categorise future reviews. It holds no amounts, account numbers or staff names.

Information sent outside South Africa goes only to providers bound by data protection terms that give it protection comparable to South African law. You may ask what Lockhart holds, have it corrected, or have it deleted at any time: luke@lockhart.africa.

Why it is used

• To reply to you and to send what you asked for, such as a Website Check report.
• To prepare a quote, and to deliver and invoice work you have agreed to.
• To keep records that the law requires, such as financial records.

Your information is never sold, and never used to train AI models.

Who it is shared with

Only with service providers that process it on Lockhart’s behalf, under agreements that require them to protect it: email and hosting providers, Formspree (which delivers the website’s forms to Luke’s email, and stores submissions in the United States for 30 days), WhatsApp (Meta) for messages, the providers named under Bank statements above, and, for the assistants, the providers listed under Data and AI below. Some of these providers store information outside South Africa; Lockhart uses only providers whose terms give it adequate protection.

How long it is kept

Only as long as it is needed for the purpose it was collected for, or as long as the law requires. Enquiries that do not become work are deleted on request.

Your rights

You can ask what personal information Lockhart holds about you, ask for it to be corrected or deleted, object to its use, or withdraw your consent. Email luke@lockhart.africa. Requests to delete details are actioned promptly.

If you are not satisfied, you can complain to the Information Regulator at inforegulator.org.za.

Data and AI

This section covers the WhatsApp assistant and missed-call answering, which Lockhart will install for clients. Neither is installed for a client yet. When the assistant is installed for a client, the following will apply.

• It will say it is automated. Every conversation will start by saying so, and the assistant will never pretend to be a person.
• Calls will be recorded, and it will say so. When missed-call answering is installed for a client, it will tell callers the call is recorded so the business can follow up.
• Details will be saved only after saying so. Before saving, the assistant will say: “I’ll save these details so the team can contact you. You can ask us to delete them at any time.”
• Deletion on request. A request to delete details will be logged and actioned.
• Never used to train AI models. Conversations will be used to answer and follow up the enquiry, and for nothing else.
• It will answer only from an approved file. It will never send a quote, an invoice or a payment request; those stay with the business.
• Who will process it. To generate replies, the text of a conversation will be processed by a US-based AI model provider, under contract. Messages will travel through WhatsApp (Meta) and, for calls, a telephony provider (Twilio). Conversation records will be stored in a database service (Supabase) on a hosted server (Railway).
• For client assistants, the client business will be the responsible party for its customers’ information and Lockhart will act as its operator.

Security

Access to personal information is limited to the people who need it, over encrypted connections, with accounts protected by strong passwords and two-step sign-in where the provider offers it.

Changes

If this policy changes, the date at the top changes too. Material changes will be noted here.