Privacy Policy

Gareth Foley, trading as OmniGrowth BPO, is the responsible party for the personal information described in this policy. We are based in South Africa, and our address is 1 Glissando Crescent, Radiokop, Johannesburg, Gauteng, 1724, South Africa.

Our Information Officer under POPIA is Gareth Foley. You can reach the Information Officer at gareth@omnigrowthbpo.com or on +27 65 865 3451, or by post at 1 Glissando Crescent, Radiokop, Johannesburg, 1724, South Africa.

We collect only what we need to run your account and the platform. In practice that is:

• Account and profile information. Your first and last name, email address, company name, business summary, avatar, role and the preferences you set (default proposal tone and length, bidding criteria, goals, display currency, notification settings). Your password is handled by our authentication provider and stored only as a cryptographic hash — we never see it.
• Freelancer.com integration data. If you connect a Freelancer.com account, we store the API key and profile URL you supply and the data we retrieve with it: your Freelancer user ID, project listings matching your criteria, and the client and message information attached to those projects. Your API key is used only to make requests to Freelancer.com on your behalf. You can disconnect the integration and remove the key at any time in Settings.
• Content you create in the platform. Projects, proposals and bid drafts, CRM records, notes, follow-ups, workspace tasks, messages, uploaded files, talent records and client portal content.
• Payment records. Your subscription plan, amount, currency, billing period, invoice records, payment status and the reference and subscription token PayFast returns to us. These exist from your first payment onwards. We do not receive or store your card number, expiry date or CVV — those go directly to PayFast.
• Support and enquiry information. What you send us through the contact form, the demo request form, the newsletter form, support tickets and email.
• Technical and usage information. Pages viewed on this website, the referring source, activity logs of significant actions in your account, and the standard server and security logs our hosting providers keep.

The platform is a business tool, so you will load information about other people into it — your clients and their contact details, the developers on your bench, and your own team members.

For that information you are the responsible party and we act as your operator under POPIA: we process it on your instruction, only to provide the service to you, and we do not use it for our own purposes. You are responsible for having a lawful basis to collect and share it, and for telling those people how their information is used. We will help you respond to any request they make to you about it.

POPIA requires a justification for every use. Ours are:

• To perform our contract with you (section 11(1)(b)) — creating and securing your account, giving you access to the features you have paid for, generating proposals you ask for, syncing the integrations you connect, taking payment and issuing invoices, and providing support.
• To meet a legal obligation (section 11(1)(c)) — keeping financial and tax records, and responding to lawful requests from authorities.
• For our legitimate interests (section 11(1)(f)) — keeping the platform secure and free of abuse, detecting fraud, diagnosing faults, and understanding in aggregate which parts of the product and website are used so we can improve them.
• With your consent (section 11(1)(a)) — marketing emails and newsletters, and any optional feature you switch on, such as appearing on the earnings leaderboard. You can withdraw consent at any time.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

We use a small number of service providers to run the platform. Each one processes personal information only to provide its service to us, under contract.

• Supabase — database, authentication and file storage. This is where your account and the content you create live.
• Netlify — website and application hosting and content delivery. Netlify processes request data such as IP addresses in the ordinary course of serving pages.
• OpenAI — AI proposal generation. When you generate a proposal, the project brief and the profile and business information you have chosen to include are sent to OpenAI to produce the draft. We use OpenAI’s API, under terms which provide that content submitted through the API is not used to train their models.
• PayFast — payment processing. PayFast receives the information it needs to take the payment (your name, email address and the amount) and collects your card details directly. It returns a payment reference and status to us.
• Freelancer.com — only if you connect it, and only the requests we make with the API key you supply.
• Email delivery. Where an email provider is configured for our account, it processes your email address and the content of transactional emails in order to deliver them.
• Website analytics and advertising measurement. Where enabled, Google Analytics and the Meta (Facebook) pixel measure visits to our marketing pages. These are not loaded on the client portal.

We may also disclose personal information where the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold — in which case this policy continues to apply to the information transferred.

Some of the providers above host or process data outside South Africa, including in the European Union and the United States. Section 72 of POPIA allows this where the transfer is necessary to perform the contract we have with you, or where the recipient is bound by rules or a contract that give your information a level of protection substantially similar to POPIA.

We rely on both: the transfers are necessary to deliver the platform you have subscribed to, and our providers commit contractually to appropriate security and confidentiality standards.

• Account and platform content — for as long as your account is open, and for up to 12 months after your subscription ends so you can reactivate without losing your work. You can ask us to delete it sooner.
• Invoices and payment records — for at least five years after the end of the financial year they relate to, because South African tax and company legislation requires it. This is one set of records we cannot delete on request.
• Support correspondence — up to three years, so we have the history of an issue.
• Marketing contacts — until you unsubscribe or ask us to remove you.
• Security and activity logs — up to 12 months.

All traffic to and from this website is encrypted with TLS. Access to the database is controlled per-user by row-level security so one account cannot read another’s data. Passwords are stored only as hashes. Administrative access is limited to people who need it.

No system is perfectly secure. If a security compromise affects your personal information, POPIA requires us to notify you and the Information Regulator as soon as reasonably possible, and we will.

We use cookies that are necessary to run the site: a session cookie that keeps you logged in, and a preference cookie that remembers your light or dark theme. These cannot be switched off without breaking the service.

Where analytics and advertising measurement tools are enabled on our marketing pages, they may set their own cookies. You can block or delete cookies in your browser settings; the necessary cookies above are required for the app to work.

We only send marketing email to people who have asked for it, or to our own customers about our own similar services, as section 69 of POPIA allows. Every marketing email has an unsubscribe option, and you can ask us to stop at any time by emailing gareth@omnigrowthbpo.com. Service messages about your account, payments and security are not marketing and will continue while you have an account.

As a data subject you have the right to:

• Be told what personal information we hold about you and, on request, be given access to it (sections 23 and 24 of POPIA, read with the Promotion of Access to Information Act).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• Object to processing we carry out on the basis of legitimate interests, on reasonable grounds relating to your situation.
• Withdraw consent you have given, at any time — this does not affect processing carried out before you withdrew it.
• Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We do not make such decisions. AI features in the platform produce drafts and scores for you to act on; they do not decide anything about you.
• Complain to the Information Regulator, and to institute civil proceedings.

To exercise any of these, email gareth@omnigrowthbpo.com. We will respond within a reasonable time and, where the law allows a fee for an access request, we will tell you the amount before we do the work. We may need to verify your identity first.

If you are not satisfied with how we have handled your personal information or your request, you can lodge a complaint with the Information Regulator. Please raise it with us first if you can — we would rather fix it — but you are not obliged to.

The platform is a business tool and is not intended for children. We do not knowingly collect personal information about anyone under 18. If you believe a child’s information has reached us, tell the Information Officer and we will delete it.

We update this policy when our processing changes or the law does. The date at the top of the page shows when it last changed. If a change is significant we will tell account holders directly. Related documents: our terms and conditions, refund and cancellation policy and delivery policy.