Privacy Policy

Last updated: 5 October 2026

This policy explains how personal data is handled on ayomaseko.com. We collect as little as possible, use it only for the purposes below, and never sell it. This policy is written to meet the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the ePrivacy Directive, South Africa’s Protection of Personal Information Act (POPIA), and the California Consumer Privacy Act as amended by the CPRA.

1. Who is responsible

Ayo Maseko is a virtual persona (see our AI Transparency statement). The website and the persona are operated by the controller named above, who is responsible for all processing described here.

2. What we process and why

a) Visiting the website

When you open a page, our hosting and security provider Cloudflare processes technical data that every browser sends — IP address, date and time, requested page, browser and device type — in order to deliver the site and protect it against abuse. We do not keep our own access logs. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

b) Contact form and email

If you write to us, we process your name, email address, the topic and your message — only to read and answer it. Legal basis: steps prior to a possible agreement (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f)). The form is protected by Cloudflare Turnstile, which checks browser signals to tell people from bots; it is not used for advertising. Messages are delivered to our inbox by Resend. We keep correspondence for as long as needed to deal with your enquiry and delete it no later than 24 months after our last contact, unless a longer legal retention period applies.

c) Analytics — only with your consent

If — and only if — you click “Accept all” or switch on “Analytics”, we load Google Analytics 4 (Google Ireland Ltd.) to measure how the site is used in aggregate (pages viewed, approximate region, device type, referring site). Google signals and ad personalisation are switched off, and we use no advertising features. Before consent, no analytics script is loaded and no analytics cookies are set. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). You can withdraw consent at any time via Cookie settings; withdrawal does not affect processing that happened before. Analytics data is kept for 14 months. Details: Cookie Policy.

d) Social networks

Our Instagram and TikTok links are plain links. Nothing is loaded from those networks until you click, at which point their own privacy policies apply.

3. Who receives data

All service providers act as processors under written agreements (Art. 28 GDPR). Where data is transferred outside the EEA, UK or South Africa, we rely on adequacy decisions (including the EU–US Data Privacy Framework) or Standard Contractual Clauses, as permitted by Chapter V GDPR and section 72 POPIA.

4. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. Email ayo@ayomaseko.com and we will respond within one month. You also have the right to lodge a complaint with a supervisory authority — in particular in the country where you live or work, or where the controller is established. In South Africa this is the Information Regulator; in the UK, the Information Commissioner’s Office (ICO).

California residents

We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information. We honour the Global Privacy Control (GPC) signal: if your browser sends it, analytics stays off unless you actively switch it on. You may request to know, correct or delete your information using the email above; we will not discriminate against you for exercising these rights.

5. Automated decisions, children, security

We do not make automated decisions with legal or similarly significant effects about you. This website is not directed at children and we do not knowingly collect data from anyone under 16. All traffic is encrypted (HTTPS/TLS) and access to messages is restricted to the people who answer them.

6. Changes

We will update this policy when our processing changes. The date at the top always shows the current version.