Privacy

Last updated 24 September 2026

In short: I collect your email address and what's needed to bill you, and use it only to send you Just a Thoughtand manage your subscription. I never sell it or use it for marketing. This site has no analytics, no ads and no tracking cookies.

Who is responsible

Phantom Design (Pty) Ltd, the company that sells Just a Thought, is the responsible party under the Protection of Personal Information Act (POPIA). Its information officer is Simon Dingle. "I" and "me" on this page mean me and my company.

Email: hello@simon.co.za
Address: 31 Parliament Street, Cape Town, 8001, South Africa

What I collect, and why

When you browse: nothing beyond standard server logs (IP address, page requested, browser), kept briefly to keep the site secure and running.
When you subscribe: your email address, to send you the newsletter and manage your subscription. Paystack collects your payment details at checkout. I see only limited details, such as the card type and its last four digits, and never your full card number.
When you email me: whatever you send, to reply to you.

I process this to carry out the subscription you signed up for, to meet legal obligations such as keeping tax records, and for my legitimate interest in keeping the site secure. Giving your email address is voluntary, but I can't deliver the newsletter without it.

Who processes it for me

These services process your information only to provide their service to me:

Paystack (a Stripe company): payments and subscription billing. See Paystack's privacy policy.
Resend: the subscriber list and sending emails.
Fly.io: hosts this site, on servers in Johannesburg.
Telegram: if a payment or cancellation fails to process, I get an alert with the email address involved so I can fix it.

Resend, Fly.io and Telegram are based outside South Africa, so some of your information is processed abroad. I only use providers bound by data protection obligations comparable to POPIA's, as section 72 requires.

Security

The site is served over HTTPS. Card details are handled only by Paystack, which is PCI DSS-certified, and never reach me. Subscriber data sits with the providers above, in access-controlled accounts. If a breach ever affects your information, I'll tell you and the Information Regulator, as POPIA requires.

How long I keep it

I keep your email address while you're subscribed, and remove it from the mailing list when you cancel. Payment records are kept for five years, as South African tax law requires. Ask, and I'll delete anything else sooner.

Your rights

You can ask what information I hold about you, have it corrected or deleted, object to how it's used, or withdraw your consent. Email me and I'll respond within 30 days. If you're not satisfied, you can complain to the Information Regulator.

Emails I send

Subscribers get the newsletter and messages about their subscription, such as a welcome email or notice of a price change. No marketing, no third-party offers. Every issue has an Unsubscribe link.

Cookies

This site sets no cookies of its own. Paystack's checkout page, which is theirs rather than mine, uses its own cookies for security and fraud prevention.

Changes

If this policy changes in a way that affects you, I'll email subscribers. The date at the top shows the latest version.

Terms · Refunds & cancellation · Contact