Data & Privacy Policy

1. Who this policy is for

Alevo is a financial-management platform operated by Ubuntu Solu Labs (Pty) Ltd, trading as Alevo ("Alevo", "we", "us" or "our"). This policy applies when you use Alevo's website, installed web app, payment pages, quote-approval pages, and related support services.

When a business uses Alevo to store information about its own clients, suppliers or team members, that business decides what information to enter and why. The business must have the right to provide that information. Alevo processes it only to provide the service to that business.

2. Information we process

• Account and profile data: your name, email address, user ID, profile image and sign-in/session information.
• Business workspace data: business name, contact details, registration and tax details, payment instructions, team access and branding assets.
• Records you create: invoices, quotes, services, clients, expenses, income, budgets, bank-account details, notes, attachments and activity records.
• Payment data: invoice amounts, payment status, Paystack references and payment-related contact details. Card details are entered with and processed by Paystack; Alevo does not store card numbers or CVVs.
• Technical and security data: device/browser details, IP-related technical logs, page errors, request identifiers and security events needed to run and protect Alevo.

3. Why we use it

We use information to create and deliver the service you ask for, including to:

• authenticate you, keep your workspace secure and provide the features you use;
• create documents, send transactional emails and process payment requests;
• respond to support requests, prevent abuse and investigate faults;
• meet legal, tax, accounting and record-keeping obligations where they apply; and
• improve Alevo using optional product analytics only when you allow them on your browser.

Under POPIA, these uses are generally necessary to provide the service, meet legal obligations, protect legitimate interests such as security, or are based on consent where consent is required. We do not sell personal information or use it for targeted advertising.

4. Specialized and special personal information

For client, patient, dependant, minor or legal-matter information entered by a business customer, that customer is normally the responsible party under POPIA. Ubuntu Solu Labs is the operator and processes that information only on documented instructions and under written processing and security terms consistent with POPIA sections 20 and 21.

Depending on the workflow, this may include health information such as ICD-10 codes, medical-scheme or membership details; dependant or minor information such as names, dates of birth and dependant codes; and legal-matter information such as case numbers, matter references and descriptions. Customers must not enter more information than their lawful business purpose requires.

POPIA section 26 restricts processing of special personal information unless an applicable authorisation exists, including the health-information authorisation in section 32. Processing personal information of children is addressed separately in sections 34 and 35. The customer remains responsible for lawful basis, notices, consent or competent-person consent, accuracy and professional obligations.

For special personal information, including ICD-10 diagnostic codes, medical-scheme memberships and legal-matter file references, our intended baseline is TLS 1.2 or a current stronger equivalent for data in transit; encrypted-at-rest storage provided by the infrastructure provider; authenticated access controls and workspace isolation; restricted database permissions; audit logging for protected actions; controlled backups; and managed deletion. Application secrets and encryption credentials are kept out of ordinary client-facing records. These controls reduce risk but do not replace your lawful-basis, consent, minimisation or professional obligations.

5. Providers that help operate Alevo

We use carefully selected providers to run specific parts of Alevo:

• Authentication provider: account authentication, sign-in and sessions.
• Neon: hosted PostgreSQL database for application records.
• Cloudflare R2: storage for files and business assets you upload.
• Vercel: application hosting, delivery and infrastructure operations.
• Resend: transactional delivery of invoices, quotes, receipts, onboarding guidance, account confirmations and other service emails.
• Payment providers: Paystack and, where enabled for the relevant flow, Capitec Pay or Ozow process payment checkout and settlement instructions under their own terms.
• Sentry: technical error monitoring. Alevo has session replay disabled.
• PostHog: optional product analytics when you choose “Allow analytics”. Session recording is disabled.

We share only the information needed for each provider to perform its service, or when disclosure is required by law.

6. Analytics, cookies and your choice

Alevo uses essential browser storage and cookies for sign-in, security, preferences and reliable operation. These are needed for the app to work.

Optional analytics are off until you allow them. If you allow analytics, PostHog receives product-usage events such as pages viewed and features used to help us improve Alevo. You can change this choice below at any time. Your preference is stored only in this browser.

7. Security and access

We use reasonable technical and organisational safeguards designed to protect the confidentiality and integrity of data. These include TLS 1.2 or a current stronger equivalent for data in transit, encrypted-at-rest storage provided by our infrastructure providers, role-based access controls, workspace isolation, restricted application database permissions, audit logging for protected actions, backups, and a recovery process for deleted records. The exact control set can change as providers and infrastructure are updated.

No online service can promise absolute security. Please keep your account credentials private and tell us promptly if you believe your account has been accessed without permission.

8. Retention and deletion

Active data is retained while you use Alevo. When you delete a record or close your account, it is removed from normal use immediately and soft-deleted rather than instantly destroyed. It remains securely recoverable for 60 days, then is permanently purged by Alevo's retention process.

Ordinary deleted data uses the 60-day window. Business financial records such as invoices, expenses, credit notes and recurring billing records use a documented five-year baseline where tax, payment-network or accounting obligations may apply, and may be held longer while an audit or dispute remains open. Backups may retain encrypted copies until their normal rotation is complete. We do not use a blanket long-term retention period for ordinary deleted data.

9. Your privacy rights

Subject to applicable law and identity verification, you may ask to access, correct, export, object to, restrict or delete personal information we hold about you. For business-client data entered by an Alevo customer, please first contact that business because it controls that relationship.

Send privacy requests to support@ubuntusolu.com. We will respond within the period required by applicable law.

10. Business data and processing requests

For information a business enters about its clients, suppliers or team members, that business is normally the Responsible Party and Ubuntu Solu Labs acts as its Operator. We process that information only on the business's documented instructions and to provide Alevo. We will reasonably assist with access, correction, export, deletion, security and incident-response requests, subject to the business's instructions, provider limitations and applicable law.

Businesses can review the Business Data Processing Agreement or contact us for a signed version, security questionnaire or subprocessor list.

A business must not use Alevo as a substitute for its own POPIA governance. It must decide whether an ICD-10 code, medical-scheme membership, legal-matter file reference or other special personal information is necessary, permitted and accurate before entering it.

11. International processing

Alevo's service providers may process data in South Africa and other countries where they operate. We use providers that offer appropriate contractual, technical and organisational safeguards for this processing.

12. Security incidents, changes and contact

If we discover a security compromise affecting personal information, we will investigate, contain it and make notifications required by applicable law. For business-controlled client data, we will notify the relevant business so it can meet its own notification duties.

We may update this policy when Alevo or the law changes. Material changes will be posted here with a new “Last updated” date and, where appropriate, communicated in the app or by email.

For privacy questions or complaints, contact Ubuntu Solu Labs at legal@ubuntusolu.com or info@ubuntusolu.com. You may also lodge a complaint with the Information Regulator of South Africa.

Supplier disclosure: Ubuntu Solu Labs (Pty) Ltd, trading as Alevo, registration number 2026/198683/07, registered address Durban, KwaZulu-Natal, South Africa. This policy is a product disclosure and should be reviewed with South African counsel for your specific circumstances.