Privacy Policy

Who we are

MLMSoftwarePro LLC, trading as MLMSoftwarePro, is the responsible party and data controller for the personal information described in this policy. We build and operate MLM and direct selling software for companies; we do not operate a direct selling business ourselves.

For anything in this policy, including a request to exercise a right, write to hello@mlmsoftwarepro.com. Your use of the website itself is separately governed by our Terms of Service .

What this policy does and does not cover

This policy covers personal information we collect through this website — principally the enquiry form — and information our hosting provider records in order to serve the pages.

It does not cover distributor, customer or order data processed inside a platform we have built for a client. In that relationship the client is the responsible party and controller, and we act only as an operator and processor on their instruction. That processing is governed by the data processing agreement in the client's contract, not by this page. If you are a distributor or customer of a company that uses our software, your request belongs with that company; send it to us and we will forward it and say so.

What we collect

From the enquiry form, only what you type into it:

Your name — so a reply is addressed to a person.
Your work email address — so we can reply at all.
Your phone number and company name, both optional — supplied only if you choose to.
Your message, including any compensation plan detail you decide to include.
The consent you record by ticking the required checkbox, which is stored with the enquiry.

Our hosting provider also records standard server request data — IP address, timestamp, requested URL, user agent — for delivery, security and abuse prevention. We do not use it to build a profile of you and we do not join it to your enquiry.

What we do not collect

This is unusually short for a privacy policy, and it is accurate rather than aspirational — you can confirm every line of it in your browser's network tab:

No analytics of any kind. No Google Analytics, no product analytics, no session recording, no heatmaps.
No advertising or conversion pixels, and no remarketing audiences.
No cookies. This site sets none, first-party or third-party, so there is no cookie banner to dismiss.
No third-party fonts, embedded videos, chat widgets or social buttons, so no third party learns you visited.
No account, no login, and no tracking across sessions or devices.
No special-category or sensitive personal information, and nothing about children.

Until you submit the enquiry form, your browser makes no request to any domain other than this one.

Why we are permitted to process it

Under the EU and UK GDPR, our lawful basis for handling your enquiry is your consent under Article 6(1)(a), recorded by the required checkbox on the form. Our basis for the server request data described above is legitimate interests under Article 6(1)(f) — keeping the site available and resisting abuse — balanced against the fact that it is not used to profile or target anyone.

Under South Africa's Protection of Personal Information Act, we process your enquiry on the basis of your consent under section 11(1)(a), and the request data on the basis of our legitimate interests under section 11(1)(f).

Consent given on the form can be withdrawn at any time and costs you nothing — see your rights below. Withdrawing it means we stop processing and delete the enquiry; it does not undo a reply we already sent.

What we use it for

Three things, and no others:

To answer your enquiry, including asking scoping questions and configuring a sandbox demonstration from the plan detail you sent.
To keep a record that the enquiry and the consent existed, which is what makes both GDPR and POPIA accountability demonstrable rather than asserted.
To keep the site working and secure, using the request data described above.

We do not use your details for marketing you did not ask for, we do not add you to a newsletter, and we do not sell, rent or trade personal information to anybody, ever.

Only the service providers that make the site and the form work. Each one processes the data on our instruction, for that purpose only:

Our form delivery provider, Web3Forms, receives the submission and delivers it to us by email. It is the only third party that receives what you typed.
Our hosting provider, Vercel, serves the pages and keeps the request logs described above.
Our email provider, which stores the resulting message in our mailbox like any other email.

We disclose personal information to nobody else, except where we are legally compelled to and, where the law allows it, after telling you.

If we ever add a processor — a CRM, a scheduling tool, an analytics product — this list changes in the same release.

Where it goes

Our providers are United States based, so an enquiry sent from the EU, the UK or South Africa is transferred across a border and processed in the United States.

For transfers out of the EU and UK we rely on the Standard Contractual Clauses in our providers' data processing terms. For transfers out of South Africa we rely on section 72(1)(b) of POPIA, which permits a transfer where the recipient is bound by an agreement upholding principles for lawful processing that are substantially similar to POPIA's. If you would rather not have your details processed in the United States, email us instead of using the form and say so.

How long we keep it

Enquiries are kept for 24 months from your last contact with us, then deleted. Two years is how long a software selection cycle can realistically run in this industry; keeping it longer would serve us rather than you.

A compensation plan document or commercially sensitive material you send is treated as confidential and is deleted on request, immediately and without asking why. Server request logs are kept for a short rolling window by our host and then expire.

Where we have a legal obligation to retain something — a contract, an invoice, a tax record — that obligation governs, and only the specific records it applies to.

If you are in the EU or the UK, you have the right to:

Be told what we hold about you and get a copy of it (access, Article 15).
Have inaccurate information corrected (rectification, Article 16).
Have it deleted (erasure, Article 17).
Have processing restricted while a dispute is resolved (Article 18).
Receive it in a portable, machine-readable form (portability, Article 20).
Object to processing based on legitimate interests (Article 21).
Withdraw consent at any time (Article 7(3)), which for an enquiry means we stop and delete.
Complain to your national supervisory authority — you do not have to come to us first, though we would rather you did.

We answer within one month, free of charge. We may ask you to confirm your identity, using no more information than is needed to do it.

Your rights under POPIA

If you are in South Africa, you have the right to:

Ask whether we hold personal information about you, and be given a record of it (section 23).
Have information corrected, or destroyed or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
Object to processing on reasonable grounds (section 11(3)).
Withdraw consent at any time (section 11(2)(b)).
Not be subject to unsolicited electronic direct marketing (section 69) — we send none.
Complain to the Information Regulator, and to seek civil relief in a court.

We have designated an Information Officer as POPIA requires, reachable at hello@mlmsoftwarepro.com. Address a section 23 or 24 request there and we will confirm the outcome in writing.

How we protect it

The site is served over HTTPS only, so what you type into the form is encrypted in transit. The form stores nothing in your browser and there is no client-side database to leak. Access to enquiries is limited to the people who need to answer them, on accounts protected by multi-factor authentication.

Bot submissions are filtered with a hidden field and a submission-timing check rather than a third-party captcha, specifically so that a page whose job is to collect a lead under a consent notice does not simultaneously load somebody else's tracker.

No transmission over the internet is perfectly secure. If a breach ever affected your information we would notify you and the relevant regulator as GDPR Article 33 and POPIA section 22 require.

Children

This is a business-to-business site for companies operating or launching a direct selling business. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. A change that materially affects how we handle information already collected will be described here rather than folded in silently, and where the law requires consent for the new processing we will ask for it again rather than assume it.