Least data, deliberately. This page says exactly what we collect, why we hold it, who else touches it and how to have it removed. It is short because there is not much to say.
Last updated 5 September 2026
Value Nexus, a South African business operated by Joel Gamsu, is the responsible party under the Protection of Personal Information Act, 2013 (POPIA) and the data controller under the UK and EU GDPR for the information described here.
Information Officer: Joel Gamsu. Contact: joel@valuenexus.co.za.
| What | When and why |
|---|---|
| Name, email address, firm, role, and the systems and portfolio shape you select | Only when you complete a form on this site. Used to reply to you and to prepare for the conversation you asked for. The email that carries an enquiry also records the country and city that our host derives from your connection, and the kind of organisation you chose on the home page if you chose one. |
| Anything you type into the free-text field | Only what you choose to write. Please do not send confidential portfolio data through a web form. |
| A question you type into the Ask panel that we cannot answer | Sent to us so that it can be answered properly, and so the question can be added to the published answers. Email addresses and telephone numbers are removed before it is sent. Nothing you type is stored. There is no cookie. Your IP address is used only as a counter to limit misuse, held for up to 48 hours and never stored alongside anything you wrote. Please do not type personal or confidential information into it. |
| Aggregate page analytics | Every visit. Page views, referrer, country and device class, collected without cookies and without any identifier that follows you between websites. |
| Standard server and security logs | Every request, held briefly by our hosting provider to serve the page and to defend against abuse. |
We do not run advertising pixels, we do not build visitor profiles, and we do not buy, sell or enrich contact data.
We use as few third parties as the job allows. Fonts and images are served from this site itself. Two scripts are not: Cloudflare's Turnstile, which checks that a visitor is a person, and Cloudflare's cookieless analytics beacon. Both belong to the host named below. One more is loaded only if you press the microphone button to speak to Tracey, and never otherwise: the ElevenLabs voice client. Nothing else is loaded from anyone else's network.
Converts speech to text and speaks Tracey's replies, and only while you have chosen to speak to her. Nothing is sent to ElevenLabs unless you press the microphone button. The agent is configured to retain neither audio nor transcripts after a call.
Hosts this site, serves it through its global network and provides the cookieless page analytics. Cloudflare processes request data, including IP address, to deliver and protect the site.
Form submissions are handled by an endpoint we run ourselves, on this same domain. It validates the message, sends it to our mailbox through Resend, an email delivery provider, and stores nothing. No third party sits between you and us: your details are not passed to a form relay, a marketing platform or a mailing list. Resend processes the message in Ireland, and we do not use click or open tracking, so opening or clicking anything we send you is not recorded.
Once your enquiry reaches our mailbox it is held there, like any other business email.
Some of these providers operate outside South Africa. POPIA permits cross-border transfer where the recipient is subject to comparable protection or bound by contract to it; our providers are bound by their own data processing terms.
Tracey is an automated assistant, not a person. She answers questions about Value Nexus from what is published on this site.
What happens to what you type. Before your question leaves your browser, and again on our server before it goes anywhere else, we remove email addresses, telephone numbers, identity and passport numbers and account numbers of 8 digits or more from it. Short numbers may remain. A name, an organisation or a place that you type into a question is not removed, so please do not type one. The remaining text is sent to our language model provider, together with a short running note of your situation that is kept for the length of the conversation. That provider does not write the substance of a reply: it chooses which of the answers already published on this site fits, writes at most 2 short sentences connecting your question to it, and may lightly reword one of a fixed set of follow-up questions. Both are checked against a fixed vocabulary before you see them, and dropped if they fail. The running note is stripped of contact details and figures, may only use words this site itself uses, and is encrypted so that it can be carried between your questions without being readable or alterable in your browser. A name or organisation you type may still appear in it if it happens to be an ordinary word. Nothing you type is stored on this site or by us after the conversation ends.
Please do not type personal or confidential information into her. The removals above are a safeguard, not a guarantee, and the surest protection is not to type it.
Who chooses the answers. Anthropic PBC, in the United States, receives your scrubbed question, the running note, the published answers it may choose from, and the standing instructions that govern how it chooses. It does not receive your email address, telephone number or identity number, because those are removed before anything is sent, and it never receives anything you type into the form described below. Transfers outside South Africa and the United Kingdom rely on the recipient being subject to binding contractual terms that provide comparable protection, under section 72(1)(a) of POPIA and Article 46 of the UK GDPR. What Anthropic does with what it receives is governed by its own commercial terms, and we do not control its retention. Our lawful basis is our legitimate interest in answering questions from people who choose to ask them.
If you ask to be put in touch. Tracey may offer to pass your details to Joel Gamsu. Nothing is sent until you complete a short form and press send. At that point your name, your email address, an organisation if you give one, a short summary and the text of the conversation, with contact details removed from it, are emailed to him so he can reply. You are sent an acknowledgement at the same time, without the conversation attached. These details are used only to reply to you. They are not added to a mailing list, not shared, and not used for advertising. Nothing is kept on the website: that email, and the acknowledgement sent to you, are the only records we hold, and replying to ask for deletion is enough. Our email delivery provider handles both in the ordinary way.
The details you type into that form are deliberately not scrubbed, because reaching Joel is the point of sending them.
If you speak to her instead of typing. Tracey can also be spoken to. This never starts on its own: nothing is recorded and no microphone is opened until you press the microphone button and your browser asks you to allow it, and you can end the call at any moment with the same button. A call lasts at most four minutes, and the time remaining is shown on the button from the first second.
While a call is running, your speech is sent to ElevenLabs, Inc., in the United States, which converts it to text and speaks Tracey's reply in her voice. ElevenLabs is a processor for that purpose only. The agent is configured so that neither the audio nor the transcript is retained by ElevenLabs after the call ends. The words Tracey speaks are the same published answers she would have typed, chosen the same way and by the same provider described above, and the transcript is shown on screen as you go so you can read back what was said.
Please do not say anything personal or confidential to her, for the same reason you should not type it. We deliberately do not take your name, your email address or any other contact detail by voice: if you ask to be put in touch, the call ends and you type those into the form below, where you can see exactly what you are sending. Transfers outside South Africa and the United Kingdom rely on the same contractual basis described above. If you would rather not use a third party at all, the typed conversation does everything the spoken one does.
Keeping her working. Tracey is protected by Cloudflare Turnstile, which checks that a visitor is a person rather than a script. To limit misuse and to keep costs bounded we count requests against your IP address and against a random reference for your visit. Those counts are held for up to 48 hours and are then discarded. They are counts, not content: no question, name or email is ever stored with them.
We set no advertising or tracking cookies. Our analytics are cookieless. Our hosting provider may set a short-lived cookie for security and bot detection.
If you choose which kind of organisation you are on the home page, that single choice is stored in your own browser so the page remembers it on your next visit. That choice contains no identifier and clearing your browser data removes it. It is included in an enquiry if you send one, and not otherwise. If you use Tracey, a separate random reference for that conversation is held in your browser for as long as the tab is open. Unlike the choice above, it is sent with each question, so she can follow the thread and so the site can limit misuse. It identifies nobody and it is discarded when you close the tab.
Under POPIA and the GDPR you may ask us to confirm what we hold about you, to correct it, to delete it, to restrict what we do with it, to send it to you in a portable form, and to stop processing it altogether. There is no charge and no form to complete. Email joel@valuenexus.co.za and we will act within thirty days, usually the same week.
If you are not satisfied with how we handle a request, you may lodge a complaint with the Information Regulator (South Africa), or with your own supervisory authority if you are in the UK or the EU.
This site is served only over HTTPS, with transport security, content security and framing protections enforced at the edge. It holds no database of visitors and no login. The only things written to storage are short-lived counters keyed by connection address and by the random conversation reference, held for at most 48 hours, and one running total of the month's assistant cost that carries no visitor key at all. That is how misuse and cost are bounded. Personal information you send through a form is delivered straight to a mailbox rather than stored on the site.
This notice covers visitors to this website. Information belonging to a client portfolio is governed by the engagement agreement and the non-disclosure agreement signed with that client, not by this page. Client data is never used to train anything, never pooled across clients and never leaves the environment agreed with that client.
If this notice changes materially we will update the date at the top. We do not keep a mailing list, so there is nobody to notify.