Vital Pursuit Website: Privacy Policy

Effective date: 17 September 2026
Responsible party: Bioscience and Technology Holdings (Pty) Ltd, trading as Vital Pursuit ("we", "us"), Reg. no. 2016/366514/07, 32 Ryneveld Street, Stellenbosch, 7600, South Africa
Contact: info@vitalpursuit.co.za

1. Scope

This policy covers the website https://vitalpursuit.co.za ("the website"): browsing it, using the Strategy Preview AI tool, and sending us your details through its forms. It also covers how we handle those details once you become a consulting client.

It does not cover our apps. Each app has its own privacy policy and POPIA notice, published with that app.

2. Summary

You can browse the website without giving us any personal information. We do not use analytics, advertising or tracking tools, and we set no cookies of our own.
The Strategy Preview sends only the text you type to our AI provider (OpenAI) to generate a response. We do not store that text or the response. OpenAI does not use it to train its models.
If you send us a form, we receive the details you entered by email and keep them as enquiry and client records.
Two Google services load on every page: Google Fonts, for the typefaces, and Google reCAPTCHA, which protects the forms and the AI tool from spam and abuse.
We do not sell your information or use it for advertising.

3. Browsing the website

3.1 Our web server

When your browser loads the website, our hosting provider's web server automatically records a standard access log. The log holds the time, the page or file requested, the response status, the IP address the request came from, the referring page and your browser identifier (user agent). We use these logs only to keep the website secure and working and to trace faults and abuse.

Hosting: a managed web server in Cape Town, South Africa.
Retention: kept for a limited period under the hosting provider's standard log rotation, and then deleted.

3.2 Google Fonts

The website's typefaces are loaded from Google's font servers. Your browser therefore connects to Google, which receives your IP address and browser identifier in order to deliver the fonts. Google handles this under its own privacy policy: https://policies.google.com/privacy.

3.3 Google reCAPTCHA

We use Google reCAPTCHA v3 to tell people apart from automated abuse. reCAPTCHA loads when you open the website and runs in the background: there is no puzzle to solve. To assess whether traffic is automated, Google collects information such as your IP address, browser and device characteristics, and how you interact with the page, and it may set or read cookies under its own terms. When you send a form or use the Strategy Preview, our server passes Google a reCAPTCHA token and your IP address, and Google returns a score. We do not keep the token or the score.

reCAPTCHA is subject to the Google Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms).

3.4 What we do not do

We use no analytics, advertising pixels, social-media trackers or session recording. We set no cookies of our own, and the website does not store anything in your browser's local storage.

4. Strategy Preview (AI tool)

When you type a challenge and choose Get Initial Strategy:

What is sent: the text you typed (up to 5,000 characters), together with our own instructions, goes from our web server to our AI provider, OpenAI, which generates a response. Nothing else is sent: no name, no contact details and no uploads, because the tool accepts none.
What we keep: we do not store your text or the response on our servers. The response is shown in your browser only and disappears when you reset or leave the page, unless you choose to send it to us (section 5).
Abuse protection: to limit how often the tool can be used, our server records the times of your recent requests against a one-way code calculated from your IP address and browser identifier. The code cannot be turned back into your IP address. Only requests from the last 10 minutes are counted. These records are kept on our web server in South Africa and deleted automatically after 3 years at most.
At OpenAI: OpenAI processes the text under its API terms with us. Those terms bind it not to use API content to train its models. OpenAI may keep the text and the response for up to 30 days to operate the service and to monitor for abuse, and then deletes them, unless the law requires it to keep them longer. Content flagged by automated safety checks may be reviewed by a person at OpenAI. OpenAI encrypts data at rest and in transit. Its commitments are published at https://openai.com/enterprise-privacy/ and its privacy policy at https://openai.com/policies/privacy-policy/.
Where: OpenAI processes the text in the United States (see section 8).

Please do not enter personal information or confidential details in the Strategy Preview. Describe the challenge in general terms. The tool is not designed for identifiable information about you, your clients, patients or staff.

5. Forms: contact and follow-up requests

The website has two forms: the contact form, and the follow-up form shown after a Strategy Preview. When you send either, we receive:

your full name and email address (required);
your phone number and organisation (optional);
your message or notes;
for the follow-up form only: the challenge text you typed in the Strategy Preview and the AI response it produced, so that we have the context of your request.

How it reaches us: our web server sends your details by email to our business mailbox. It does not keep a copy on the web server.

Why we use it: to reply to you, to discuss and prepare a possible engagement, and, if you become a client, to deliver and administer our consulting services.

Lawful basis: you send the form voluntarily and for this purpose, which is your consent (POPIA section 11(1)(a)). We also rely on the processing being necessary to take the steps you ask for before any contract (section 11(1)(b)). You can withdraw consent at any time (section 10).

Marketing: we use your details to respond to your enquiry and to serve you as a client. We will not add you to a newsletter or marketing list unless you ask us to, and we never sell or rent your details.

6. Where your enquiry is stored

Our business email and documents run on Google Workspace. Your enquiry, and any later correspondence, is stored there as part of our client and enquiry records. Google acts as our service provider under its Workspace data processing terms (https://workspace.google.com/terms/dpa_terms.html) and encrypts data at rest and in transit. Our Workspace data is held in Europe.

7. Retention

Enquiries: kept as part of our business records for as long as they remain reasonably necessary, for example to follow up, to keep the history of a business relationship, or to establish or defend legal claims.
Clients: kept for the duration of the relationship, and afterwards for as long as the law requires or allows. This includes accounting and tax records, which are generally kept for at least five years, and records needed to establish or defend legal claims.
Strategy Preview: we do not keep your text or the response; OpenAI deletes them within up to 30 days (section 4).
Web server access logs: see section 3.1.
Rate-limit records (Strategy Preview): deleted automatically after 3 years at most (section 4).

You can ask us to delete your details at any time (section 10). We will do so unless the law requires us to keep them.

8. Cross-border transfers

OpenAI (United States): only the text you type in the Strategy Preview. The transfer is necessary to provide the response you ask for (POPIA section 72(1)(c)), and OpenAI is bound by its API terms with us to protect the content, not to train on it and to delete it within the stated period (section 72(1)(a)).
Google Workspace (Europe): your enquiry and correspondence. Data held in the European Union is protected by the General Data Protection Regulation, a law that gives protection comparable to POPIA (section 72(1)(a)), and by Google's data processing terms with us.
Google Fonts and reCAPTCHA (Google's global infrastructure, including the United States): your IP address and browser information, processed by Google under its own terms, to deliver fonts and protect the website.

9. Security

The website is served over encrypted HTTPS connections.
reCAPTCHA and rate limiting protect the forms and the AI tool from automated abuse.
Our API keys and server settings are held outside the public web folder.
Our mailbox is protected by Google Workspace security, including account authentication.

10. Your rights

Under POPIA you may ask us to access, correct or delete the personal information we hold about you. You may also object to its processing, withdraw consent, and complain to the Information Regulator. Most of what we hold about website visitors is what you sent us through a form. Email info@vitalpursuit.co.za, or our Information Officer at info-officer@vitalpursuit.co.za. See the POPIA Notice for details, and our PAIA Manual for formal requests for access to records.

11. Children

The website and our services are for businesses and professionals. They are not directed at children, and we do not knowingly collect information from anyone under 18.

12. Our apps

Our apps are separate services with their own privacy documents, published on each app's page. This policy does not apply to them.

13. Changes

We may update this policy. The effective date above will change, and material changes will be shown on the website.