Privacy · updated 26 October 2026
How we handle your data.
Short version: we collect only what we need to do the work, we keep it private, and we delete it when we no longer need it. Ask and we’ll delete it sooner.
Who we are
Kiff Leads is run by Gregory Dearham in South Africa. For anything about your data, email gregory.dearham@kiffleads.com.
If you order from us
- What you tell us: your name, your business name, your email address, your website address and, if you choose, your kind of business.
- What you send us: photos and files, links to your profiles and listings, and your notes.
- Access you give us: if you invite us as a Manager on your Google Business Profile, or add us as an editor on your website, we use that access only for your order, and you can remove it at any time. We never ask for your passwords.
- Roughly where you are: the city your internet connection is in, rounded to about 10 km, taken from your connection when you order. We use it only to see where our customers are.
- Payment: PayFast handles your card. We never see or store card numbers; PayFast tells us the payment went through, how much, and its reference.
We use this to do the work, to email you about your order, and to keep the accounts. We don’t sell it, rent it or use it for advertising.
If you visit the site
No cookies and no tracking scripts. We count visits: which page, which day, which country, and where the visit came from (for example, one of our emails). To count a person once a day, your internet address and browser are turned into a one-way code that includes the date, so it can’t be traced back to you or linked across days. The code is kept for two days; your internet address is never stored. If your browser asks sites not to track it (Do Not Track or Global Privacy Control), you aren’t counted at all. Consent pages and your private order page are never counted.
If we emailed your business
We found your business’s email address on your own website, along with your business name and what we noticed about your website. We write once, only to ask whether we may send you marketing information, because South African law (POPIA section 69) allows a business like ours to ask only once. If you say no, or don’t answer, we don’t contact you again, and we keep your address on a do-not-contact list so that it stays that way.
If you answer on our consent page, we record your answer, the date and time, and which version of the wording you saw. The page link is private to you; we store only a scrambled form of it, never your name or address alongside it. You can change your answer or withdraw consent at any time, free of charge.
Where it’s kept
With the services that run the site: Vercel (hosting), Supabase (storage for your files), Upstash (order and consent records) and Hostinger (email). Some of them keep data outside South Africa. Your files are stored privately: only we can open them, through links that expire.
How long we keep it
- Your files: deleted automatically 90 days after we deliver your order.
- Order records (what you bought, for how much, when): five years, because tax law requires it.
- Consent answers: for as long as we might contact you, and then as proof of what you chose.
- Visit counts: totals only, for 100 days.
Your rights
You can ask to see the data we hold about you, have it corrected, or have it deleted. Email us and we’ll do it within 30 days. If you ask us to delete it, we remove your name, email, business, website, files, links and notes; the record of the sale itself stays, without your details, for the accounts.
If you’re unhappy with how we handle your data, you can complain to the Information Regulator (South Africa). In the United States you can also contact the Federal Trade Commission about commercial email.