Privacy policy
Protection of Personal Information Act (POPIA), 4 of 2013 · Last updated 11 August 2026
Firu is a South African studio, and this site is governed by South African law. This policy sets out what personal information we collect, why, and what you can do about it. It is deliberately short, because this website does very little.
1. Who is responsible
Firu is the responsible party for the personal information described here, as that term is used in POPIA. You can reach us at info [at] firu [dot] co [dot] za about anything in this policy, including any request set out in section 6.
2. What this website collects
This website is a set of static pages. It has no contact forms, no accounts, no shopping cart and no comment section. In ordinary use it collects no personal information from you at all.
Specifically:
- No analytics. We do not run Google Analytics, Matomo, or any other visitor-tracking or measurement tool.
- No cookies. The site sets no cookies of its own, and there is no consent banner because there is nothing to consent to.
- No advertising or profiling. We do not run advertising, retargeting pixels, or social media tracking plugins.
- No third-party fonts or scripts. Fonts are served from our own hosting rather than a font CDN, so loading a page does not send your IP address to a third party.
Hosting and server logs
The site is hosted by Netlify, which operates the servers and content delivery network that serve these pages. As part of delivering the site, Netlify's infrastructure processes standard technical request data — your IP address, the page requested, the time of the request, and your browser's user-agent string. This is the ordinary operation of the internet rather than something we collect for our own purposes; we use it only to keep the site available and secure. We do not combine it with any other information, and we do not use it to identify you.
3. When you email us
The only way this site invites you to make contact is a plain email link. If you email us, we receive whatever you choose to put in that email — typically your name, your email address, and details about your business. We use it to answer you and, if it goes further, to scope and deliver work.
Our email is hosted on Google Workspace. We keep correspondence for as long as the business relationship reasonably requires, and thereafter for any period the law obliges us to.
4. Client project data
This is separate from the website, and worth stating plainly because it is the part that actually matters. When we build systems for a client, those systems may process that client's own customer data — names, phone numbers, delivery addresses, order histories.
- In that work the client is the responsible party and Firu acts as an operator on their behalf, as POPIA uses those terms.
- We process that data only on the client's instruction and only to build, run and support what they engaged us to build.
- Systems are built on the client's own accounts — their WhatsApp number, their payment provider, their spreadsheets, their store. The data stays with them.
- We do not sell client data, and we do not use it to train models.
- Where a project needs it, we put a written operator agreement in place setting out these obligations and the security measures around them.
5. Who else sees your information
We do not sell personal information. We share it only with the service providers we need in order to operate — currently our hosting provider and our email provider — and with anyone we are legally required to disclose it to. Some of these providers process data outside South Africa; where that happens, section 72 of POPIA requires the recipient to be subject to comparable protection, and we rely on the providers' contractual data-protection terms for that.
6. Your rights
Under POPIA you may, at any time:
- ask what personal information we hold about you, and where we got it;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, or obtained unlawfully;
- object to our processing of your information on reasonable grounds;
- withdraw any consent you have given, with effect going forward;
- complain to the Information Regulator.
Email info [at] firu [dot] co [dot] za and we will act on it. There is no charge for asking.
7. Unsolicited marketing
We do not send unsolicited marketing. Equally, we do not consent to our contact details being harvested from this site for marketing purposes, and we reserve our rights in that regard.
8. Security
The site is served over HTTPS. We apply reasonable technical and organisational measures to protect information in our care. No transmission over the internet is completely secure, and email in particular should not be assumed to be — please do not send us passwords, card numbers or ID numbers by email.
9. Complaints
If we have not resolved something to your satisfaction, you may complain to the Information Regulator of South Africa, at POPIAComplaints@inforegulator.org.za or via inforegulator.org.za.
10. Changes
If this policy changes we will update the date at the top of this page. Material changes will be described here rather than made quietly.