Privacy policy

The short version

You do not create an account. We do not ask your name, your identity number, or your contact details to show you a comparison. There is no advertising network on this site and no third-party analytics that tracks you across other sites.

Who is responsible for this information

Vulo is currently operated as an independent project, not through a registered company. Until it is, the person operating Vulo acts as the point of contact for privacy requests and decisions about how information is processed — the same role a Protection of Personal Information Act (POPIA) “Information Officer” would hold once a registered entity and a formally designated officer are in place.

What we collect

When you work through a comparison wizard — cellphone contracts, funeral cover, retirement annuities, or school fees — your answers are held in your own browser's session storage while you use it. Depending on the category, that can include: the device or plan type you're after, data/call usage, budget, contract preference and priorities (cellphone contracts); household type, age, cover amount, and province (funeral cover); contribution amount, age, advice preference, and transfer status (retirement annuities); or the school name, EMIS number, or province you search for (school fees). Session storage is cleared by your browser when you close the tab.

When you reach a results page in the funeral cover, retirement annuities, or cellphone contracts categories, those same answers are sent to our database together with a random identifier generated in your browser for that visit, so a comparison can be reproduced later and so we can see which categories and answers people are searching for. The identifier is random and is not derived from anything about you. School fees searches are not saved this way.

Age, province, and household type can describe a person, so we treat these answers as personal information under POPIA even though they are not linked to a name.

What we do not collect

We do not collect your name, identity number, address, phone number, health information, or banking details. We do not use cookies to follow you between sites, and we do not run Google Analytics, advertising pixels, or session-recording tools.

Device photos load directly from providers

Phone photos shown on Vulo are not stored on our own servers — your browser loads them directly from the relevant network's own website (Vodacom, MTN, Cell C, or Telkom), the same way any image embedded from another site works. That means the provider whose photo is shown receives a request from your browser, which typically includes your IP address, the same way it would if you visited that provider's own site directly. Vulo does not control what that provider does with that request.

Where it is stored

Answers are stored in a Supabase database. The site itself is served from Cloudflare's network. Both may process and store data outside South Africa, so your answers may be processed abroad — we rely on these providers' own compliance commitments for cross-border processing safeguards. Access is restricted by database policies so that a visit can only ever read back its own record, never anyone else's.

How long we keep it

Session-storage answers are gone the moment you close the tab. Records saved to our database (see “What we collect” above) are kept only for as long as they serve the purpose they were collected for — reproducing your comparison and understanding aggregate demand — and are not kept indefinitely once that purpose no longer applies.

We do not sell your answers

Your answers are never sold, rented, or passed to insurers, brokers, networks, or lead-generation companies. No provider is told that you looked at their product or anyone else's. Vulo earns nothing from providers, which is the whole point of it.

Your rights

Under POPIA you may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, or object to how it is processed. To find a record we need the identifier from the visit, since nothing else connects a record to you.

You may also lodge a complaint with the Information Regulator of South Africa at any time, whether or not you have raised the matter with us first — current contact details are published on their own website, inforegulator.org.za.

A monitored contact channel for privacy and data requests is being set up and is not live yet — the Information Regulator route above works regardless.

Changes

If this policy changes in a way that affects what we collect or who sees it, the date at the top of this page changes with it.