Privacy notice

Vlyt is a mobile app for small South African businesses. This notice explains how we handle personal information under the Protection of Personal Information Act, 2013 (POPIA).

Who we are

Vlyt is operated by Vlyt Software (Pty) Ltd (registration number 2026/823208/07) (“we”, “us”), based in Stellenbosch, South Africa. For POPIA, the company is the Responsible Party and Information Officer for personal information processed through the app and this website.

Privacy and data requests: support@vlyt.app.

What we collect

Account information. Email address and password if you register with email; Google account details if you sign in with Google; phone number if you use SMS sign-in; display name and business name you enter during setup; optional profile photo.

Business data you create. Contacts and customers (including details you import from your device address book, with your permission), products, quotes, stock, expenses, receipts, product images, and related records.

Technical and diagnostics. Device type, OS, app version, crash reports and error logs (via Sentry; we do not attach IP address or account email to those reports by default), and in-app usage patterns (via PostHog when analytics is enabled) used to improve the product.

Website analytics. The marketing site at vlyt.app may use Google Analytics 4 to understand visits and whether people open store links. We do not use analytics to sell your business data or advertise to your customers.

We do not store card numbers. If paid subscriptions are offered later, mobile billing would go through Apple/Google and web payments through a payment processor — card details would not touch our own servers.

Why we collect it

We process personal information to provide the Service: sign-in and account security, catalog and quoting features, support, product improvement, crash diagnostics, and (where enabled) one-time SMS codes for phone verification. We do not sell your personal or business data.

Contacts import

If you choose to import customers from your phone’s contacts, we only read the fields you select to create or update contact records in your account. We do not upload your full address book for marketing, and we do not share those contacts with other users.

SMS OTP

If phone sign-in is enabled and you verify with a mobile number, we send a one-time verification code via our SMS provider (currently Vonage or a successor). Message and data rates may apply. We do not send marketing SMS. Phone sign-in may be unavailable while we keep SMS usage limited.

Who we share it with

We use service providers that process data on our behalf to run Vlyt:

• Supabase — database, authentication, file storage
• Resend — transactional email (confirm signup, password reset, security notices)
• PostHog — product analytics
• Sentry — crash and error monitoring
• Vonage (or current SMS provider) — OTP codes when phone sign-in is enabled
• Google — Google Sign-In when you choose that method; Analytics on the marketing site

WhatsApp features open pre-filled messages in your WhatsApp account. We do not read or store your WhatsApp conversations.

Where it lives

App data is stored with Supabase. Access is limited to your signed-in account. Other users cannot read your catalog, contacts, quotes, or expenses. Some providers operate infrastructure outside South Africa; we take reasonable steps to keep transfers protected consistently with POPIA.

Retention

We keep personal and business data while your account is active. Crash and analytics logs are kept only as long as needed for diagnostics and product improvement.

Account deletion

You can delete your account from Settings in the app, or request deletion without the app on the Delete account page. Deletion is immediate and irreversible: there is no grace period. When you confirm, we remove your stored files (such as product images, avatars, receipts, and reports) and then delete your authentication account. Related business data in our database is erased with that account, except where South African law requires us to retain information longer (for example tax or accounting records, commonly up to five years). After deletion you cannot sign in again with the same credentials unless you create a new account.

Security

We use encryption in transit, access controls, and reputable infrastructure providers. No system is perfectly secure — use a strong password and device lock where available.

Your rights (POPIA)

You may request:

• Confirmation of what personal information we hold about you
• A copy of that information
• Correction of inaccurate or outdated information
• Deletion of your personal information (subject to legal retention)
• Objection to processing based on legitimate interest, where applicable

Use in-app account controls where available, or email support@vlyt.app. You may lodge a complaint with the Information Regulator (South Africa) at enquiries@inforegulator.org.za.

Children

Vlyt is aimed at business users. If you are under 18, a parent or guardian should consent to your use. Contact us to review or delete a minor’s information.

Changes

We may update this notice when our practices change. The date above is the current version. Material changes will be noted here and, where appropriate, in the app or by email.

Contact

Vlyt Software (Pty) Ltd
10 Minaret, Cloetesville, Stellenbosch, 7600
South Africa
support@vlyt.app