Privacy notice
How we handle your personal information
Last updated 27 October 2026
This notice covers this website, Mhleni Support (support.mhleniprojects.co.za, where you ask us for help and follow your requests) and the Mhleni sign-in (auth.mhleniprojects.co.za). It follows the Protection of Personal Information Act (POPIA).
Our products have their own notices for what happens inside them: FirstDriveSA and Threefold.
Who is responsible
Mhleni Projects (Pty) Ltd is responsible for your information. Our information officer is Nomali Zama Myende. Write to support@mhleniprojects.co.za with any question or request about your information.
What we collect
- On this website: nothing about you. It sets no cookies and runs no tracking or analytics. Your browser loads our fonts from Google, which sees your IP address when it does.
- When you ask us for help (the support form, or a product such as FirstDriveSA sending your request to us): your email address, what you wrote and any files you attach. A product also sends who you are in it, such as your name, your role and the page you were on. The support form checks that you are not a bot with Cloudflare's Turnstile, which receives your IP address for that check.
- When you email support@mhleniprojects.co.za: your email address, your name as your email shows it, and what you wrote.
- If you open a Mhleni Support account: your email address, your name, and your password, stored only in a scrambled form that cannot be turned back into the password. You may add a WhatsApp number (we do not use it yet), a backup email address, and a second sign-in step: a passkey or an authenticator app.
- When you sign in to one of our products with your Mhleni account (FirstDriveSA's staff do): that product receives your email address, your name and your role, so it knows who you are.
- When a business pays us (a driving school buying from FirstDriveSA): the name, address and VAT number on its invoices, and the email address of the person who pays. Card details are typed on Paystack's payment page; we never see them.
- Technical records: your IP address when you sign in, register or send a request (in our record of what happened), and the cookies under "Cookies" below.
Why we use it
- To answer your requests and keep you up to date on them, by email.
- To run your account and sign you in to our products safely.
- To take payments and issue invoices, which the law requires us to keep.
- To keep our services safe: to stop bots, abuse and attacks, and to find faults.
We do not sell your information, and we do not send marketing emails.
Who sees it
- Our support team sees your requests and your account. Notes the team writes for itself are never shown to anyone outside it.
- The product you asked about sees the requests it sent us for you, with our replies.
- Companies that run parts of our service for us, only for that: Oracle Cloud (our servers, in Johannesburg), Resend (it delivers our emails), Afrihost (our support@ mailbox), Cloudflare (our network and the bot check), Paystack (payments) and Google (fonts). Resend is in the United States and Cloudflare works worldwide, so some of your information leaves South Africa with them.
How long we keep it
| What | How long |
|---|---|
| A request and its messages | 90 days after it is closed, then the words are removed. Files attached to it are deleted 30 days after it is closed. |
| An email to support@ that we hold back (spam, bulk mail, a sender we cannot verify, a first email from an address we do not know) | Deleted after 30 days. |
| The original of an email you send to support@ (in our mailbox at Afrihost) | Deleted with its request, 90 days after the request is closed. If we held it back, deleted 30 days after it arrived. |
| Your account | Until you delete it, or ask us to. If you never set a password (we made it when you first wrote to us), it goes 30 days after it was last used. |
| Sign-ins, email links and codes | Deleted the night after they expire. |
| Our record of what happened, with IP addresses | 12 months. |
| Our web server's record of visits | Our web server keeps a record of each visit to the site: the time, the page asked for (without anything after a "?"), your IP address and whether the page loaded. We use it only to find faults and stop attacks, and it is deleted after 14 days. |
| Payments and invoices | At least 5 years, as tax law requires. |
| Copies we keep to recover from a fault | Locked so only we can open them, kept in South Africa and deleted before they are 14 days old. Something deleted can remain in a copy until then. |
Cookies
Mhleni Support and the Mhleni sign-in use cookies only to keep you signed in: one for your session in Mhleni Support (30 days), one that remembers you signed in with your Mhleni account (30 days), and the sign-in's own (up to 14 days, and one that lasts the sign-in itself). None of them track you or show you ads. This website sets none.
Your rights
- In your Mhleni Support account you can see and change your name and your email address, change your password, and delete your account (Delete my account). Deleting it removes your personal information from your account and your requests.
- For anything else, such as a copy of your information, a correction, or deleting your information when you have no account, write to support@mhleniprojects.co.za.
- If you are not happy with how we handle your information, you may complain to the Information Regulator: inforegulator.org.za.
Changes
When this notice changes, we update it here and change the date at the top.