Privacy Policy

How The Forever Note collects, uses and protects personal information, in line with the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

The Forever Note is operated by John Henry Herbst (sole proprietor) (Not registered — trading as a sole proprietor), based in South Africa at 25 8th Avenue, Thabazimbi, 0380, South Africa. We are the “responsible party” for the personal information described here.

Information Officer: forevernoteza@gmail.com. Please send any privacy question, request or complaint there first.

2. What we collect

From the person buying a gift:

• Name and email address.
• For physical tiers: a delivery address or pickup point. We do not receive or store your card details — payment is handled entirely by Yoco.

Content you add to a gift page: the recipient’s name, your written message, photos you upload, an optional song (a YouTube/Spotify link we embed, or an audio file you upload), and any dates or captions. This may include personal information about the recipient and about other people in your photos.

Automatically: basic server logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting, and a small number of strictly-necessary cookies (see section 9).

3. Why we use it, and our lawful basis

• To create and host your gift page and to build and post any physical card — performance of our contract with you.
• To take payment — performance of the contract. Yoco processes the payment as a separate responsible party under its own policy.
• To send order confirmations and the gift link, and to answer support messages — contract and our legitimate interest in running the service.
• Security, fraud prevention and keeping proper records — our legitimate interest and our legal obligations (for example tax record-keeping).

4. Information about the recipient

The buyer provides the recipient’s details and the gift content. By placing an order you confirm you are entitled to share that information with us for this purpose. A recipient who receives a gift page can ask us to correct or take down the page at any time using the contact details below.

5. Who we share it with

We use a small number of service providers (operators) who process data on our behalf:

• Supabase — database and file storage for gift pages, uploaded photos and audio.
• Our hosting provider — runs the website and its servers.
• Yoco — payment processing.
• Couriers — Pargo, PUDO or Aramex, for delivering physical cards (name and delivery address only).
• An email/SMS provider — to send confirmations and gift links, once this is enabled.

We may also disclose information if the law requires it, to establish or defend a legal claim, or to prevent harm. We do not sell personal information or use it for third-party advertising.

6. Storage outside South Africa

Our database and uploaded media are hosted with Supabase in AWS eu-west-1 (Ireland), which is outside South Africa. Where personal information is transferred across a border we rely on section 72 of POPIA: the provider is subject to laws or binding agreements that give protection substantially similar to POPIA, including the conditions for onward transfer.

7. How long we keep it

• Gift pages and their content: kept for as long as the page is live — keeping the page online is the product. You or the recipient can ask us to delete a page at any time and we will remove it and its media.
• Order and payment records: retained for as long as needed for accounting, tax and legal purposes (generally five years under South African tax law).
• Server logs: kept for a short period (around 30–90 days) and then deleted or anonymised.

8. How we protect it

• All traffic is encrypted with HTTPS.
• Gift pages are reachable only by a long, randomly generated link — there is no directory and links are not indexed by search engines.
• Database access is restricted; row-level security is enabled; administrative keys are held only on the server and never sent to browsers.
• The admin dashboard is password-protected and access is limited to the operator.

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

9. Cookies

We use only strictly-necessary cookies:

• fn_cart — remembers the gift(s) in your cart between pages (up to 30 days).
• fn_admin — keeps the operator signed in to the admin dashboard (up to 7 days). Only set for the operator.

We do not use analytics or advertising cookies. If that changes we will update this page and ask for consent where required.

10. Your rights

Under POPIA you may:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update it;
• ask us to delete or destroy it, subject to records we are required to keep;
• object, on reasonable grounds, to our processing of it.

Contact forevernoteza@gmail.com. If you are not satisfied with our response you may complain to the Information Regulator (South Africa): enquiries enquiries@inforegulator.org.za, complaints POPIAComplaints@inforegulator.org.za, inforegulator.org.za.

11. Children

The service is intended for adults. Do not upload the personal information of a child under 18 without the consent of their parent or guardian.

12. Changes

We may update this policy. The date at the foot of the page shows the current version; material changes will be highlighted on the site.

13. Contact

The Forever Note — forevernoteza@gmail.com · 25 8th Avenue, Thabazimbi, 0380, South Africa