Mzansify
← Home

Privacy Policy

Last reviewed:

Mzansify is built around one rule: your calculator inputs never leave your browser. This page explains exactly what we do and don’t collect, how we use the small amount of anonymous analytics we do gather, and what happens if you choose to write to us.

What we do NOT collect

  • Calculator inputs. Everything you type into an income tax, transfer duty, capital gains, or any other calculator on this site is processed entirely in your browser. The values are never sent to any server we control or to any third party. They exist only for the life of your browser tab.
  • Personal identifiers. We do not ask for your name, email, phone number, ID number, tax number, or address. There is no sign-up and no account. The only exception is the contact form, which asks for your name and email address if you choose to write to us (see “The contact form” below).
  • Financial details. Salary figures, investment balances, property values, bond amounts — none of this data is collected, stored, or transmitted.

What we DO collect

We use Google Analytics 4 to understand how people find and move through the site — which calculators are popular, how long visits last, how visitors arrive. The data is aggregated and anonymous. Specifically:

  • Page views. Which pages are loaded, in what order.
  • Referrer. The site that sent you here (e.g. Google search, a blog).
  • Approximate location. City-level at most, derived from your IP. IP addresses are not stored by Google Analytics in its standard configuration.
  • Device and browser type. Mobile vs desktop, Safari vs Chrome, etc.
  • An anonymous cookie. Google Analytics sets a `_ga` cookie that lets it tell a returning visit from a new one. It contains a random ID — no personal data.

We do not log calculator inputs to analytics. We do not run advertising pixels, retargeting scripts, or third-party tracking beyond Google Analytics.

The contact form

The contact form is the only place on Mzansify where you can give us personal information, and only if you choose to.

  • What it collects. The name, email address, topic, subject and message you type. Nothing else is asked for.
  • Why. Only to read your message and reply to you. We use your email address for nothing else, we do not add you to any list, and we do not send automatic replies.
  • Not stored. Your message is delivered to us as an email and is not saved in any database on this site. We do not keep your name, email address or message on any Mzansify server. A copy exists only in our own mailbox, like any email you send us, and in the logs of the email providers involved in delivering it.
  • Anti-abuse counters. To stop spam, we count submissions per visitor. The counter is keyed by a salted, one-way hash of your IP address, never the address itself. It is set to expire within about a day (at most 25 hours) and is then deleted automatically, usually within two further days. We also keep short-lived one-way hashes of the spam-check token (10 minutes) and of your email plus message (24 hours) to refuse exact repeats. These hashes cannot be turned back into your email address or message. We do not store your raw IP address on any Mzansify system.
  • Processors. Two services handle your data on our behalf: Amazon Web Services (AWS), which runs the form and sends the email through Amazon SES, and Cloudflare Turnstile, a privacy-friendly check that you are a person rather than a bot. Your IP address is seen transiently, while the request is being served, by CloudFront (and by AWS WAF, a web firewall that can rate-limit abusive traffic, if we switch it on), and it is sent to Cloudflare Turnstile together with the spam-check token. Turnstile also sees browser details to make its decision. No request copies are kept: we have turned off WAF request sampling. These services process your message and IP address outside South Africa: the form, its counters and the email sending run on AWS in Ireland (in the EU), CloudFront (and the web firewall, if switched on) handles each request at AWS locations around the world, and Turnstile runs on Cloudflare’s global network. Both are bound by data-protection rules at least as strict as POPIA. The email then arrives in our own mailbox, which is hosted by Zoho Mail.
  • Analytics. We record that the contact page was visited, and that a message was sent, as an anonymous count. Nothing you type is ever sent to analytics.

Cookies

The only cookies set by Mzansify are the Google Analytics `_ga` and `_ga_*` cookies described above, and a theme preference cookie (dark/light mode) that stores your choice locally. None of these identify you personally.

You can block all cookies via your browser settings without breaking any calculator — the calculators do not use cookies and work fine without analytics.

Your rights under POPIA

South Africa’s Protection of Personal Information Act gives you the right to access, correct, and delete personal information that a business holds about you. Mzansify does not keep any personal information about you in a database, so there is nothing for us to look up on the site. If you have written to us, the only copy is the email in our mailbox, and you can ask us to delete it.

To make a POPIA request (access, correction or deletion), use the contact form and choose “POPIA data request”. We’ll respond within 14 days.

Who is responsible

The responsible party for your personal information is Mzansify. Our Information Officer is Moritlha Madisha, at 155 West Street, Sandton, Johannesburg.

You can also write to the Information Officer, Moritlha Madisha, at 155 West Street, Sandton, Johannesburg.

Send any request, correction or complaint, including a POPIA data request, to the Information Officer through the contact form. If you are not happy with our response, you can complain to the Information Regulator at inforegulator.org.za.

Third parties

The only third party we share anonymous usage data with is Google (Analytics). The site is hosted on Amazon Web Services (S3 + CloudFront), and the contact form also uses AWS (Lambda, DynamoDB for rate-limit counters, and SES for email) and Cloudflare Turnstile, as described above. Standard server logs generated by CloudFront include request IPs and user agents; these are not linked to any user-level profile and are retained per AWS defaults.

Contact

For questions, corrections, or POPIA data requests, use the contact form.

Changes

If we change what we collect or how we use it, we’ll update this page and change the “Last reviewed” date at the top. We’ll never broaden the scope of what we collect retroactively — any new collection applies only from the date of the change forward.