Privacy Policy

Last updated: 27 August 2026

This Privacy Policy explains how Xenliv (“Xenliv”, “we”, “us”, “our”) collects, uses, stores and protects personal information when you use the Xenliv Business Hub website and application (the “Service”), in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1. Who We Are

Xenliv is operated by MRB Ventures (Pty) Ltd, Registration number 2025/860877/07, based in South Africa. Our Information Officer can be contacted at xenliv.store@gmail.com.

2. What Personal Information We Collect

Depending on how you use the Service, we may collect:

Account information: name, email address, phone number, business name, business registration/VAT details
Business data you enter: client details, invoices, quotes, expenses, income records, inventory, employee and payroll information you input into the Service
Payment information: processed by our payment provider (PayFast). We do not store full card details ourselves
Usage data: log data, device/browser information, pages visited, and similar technical data
Marketing/advertising data: if you interact with our ads (e.g. via Meta), we may receive limited data about that interaction. See our Cookie Policy for detail

3. Why We Collect It (Purpose)

We process personal information to:

Create and manage your account and provide the Service
Generate invoices, quotes, payslips and reports on your behalf
Process payments and manage billing/subscriptions
Send essential service communications (e.g. verification emails, billing notices)
Improve and secure the Service
Run and measure marketing campaigns (only where you’ve consented, e.g. via cookie consent)
Comply with legal and tax-related obligations

4. Lawful Basis for Processing

We process personal information on the basis of: your consent, performance of a contract with you, our legitimate business interests, and compliance with legal obligations, consistent with POPIA’s conditions for lawful processing.

5. Your Business Data (Client, Invoice, Payroll Records)

Data you enter about your clients, employees and business (e.g. client contact details, payslip data) is processed by Xenliv on your behalf, as the operator of the Service. You remain responsible, as the data controller for that information, for having a lawful basis to process it (e.g. your clients’ and employees’ personal information). Xenliv acts as an operator under POPIA in this respect.

6. How We Store and Protect Your Information

Data is stored with our infrastructure provider (Supabase), hosted with industry-standard security controls
Access to your data is restricted via row-level security, so only your account can access your records
We apply reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and disclosure
[Add specifics once finalised: encryption at rest/in transit, backup policy, breach-notification process]

7. Sharing of Information

We do not sell personal information. We may share limited data with:

Service providers who help us operate the Service (e.g. Supabase for hosting/storage, PayFast for payments, Resend for authentication emails)
Meta, in connection with advertising campaigns, where you’ve consented to marketing cookies
Legal or regulatory authorities, where required by law

8. International Transfers

Where any of our service providers store or process data outside South Africa, we take reasonable steps to ensure an adequate level of protection consistent with POPIA’s cross-border transfer requirements.

9. Data Retention

We retain personal information for as long as your account is active, plus any additional period required for legal, tax, or accounting purposes (e.g. financial records retention requirements under South African law). Soft-deleted financial records are retained in line with this requirement before permanent removal.

10. Your Rights

Under POPIA, you have the right to:

Access the personal information we hold about you
Request correction or deletion of your personal information
Object to processing, in certain circumstances
Withdraw consent (e.g. for marketing) at any time
Lodge a complaint with the Information Regulator of South Africa

To exercise these rights, contact us at xenliv.store@gmail.com.

11. Cookies

We use cookies as described in our Cookie Policy. Non-essential cookies (e.g. analytics, advertising) are only set with your consent.

12. Children’s Information

The Service is intended for business use by adults. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email.

14. Contact Us

Questions or requests regarding this policy or your personal information can be sent to: xenliv.store@gmail.com

Information Regulator of South Africa: enquiries@inforegulator.org.za

This document is a working draft prepared for legal review. It has not yet been reviewed by a qualified attorney or POPIA consultant and should not be published or relied upon until it has been.