What we collect, and what we don't.

Who we are

GrowthLab FX is the introducing-broker business of Babongile Terence Ntuli. We refer traders to a broker and earn a rebate on their trading activity — we are not a broker ourselves. See the risk disclosure for what that means for you.

GrowthLab FX is a trading name; it is not yet incorporated as a registered company. For anything on this page you can reach us on WhatsApp or by email at support@growthlabfx.com.

What each form collects

Nothing on this list is inferred, bought or enriched from anywhere else. If it isn't here, we don't have it.

Applying to partner (/apply)

• Your name.
• Your email address, if you give one — it is optional.
• Your WhatsApp number, captured as a dialling code plus local number and stored in international format.
• Your country and city.
• The channels you publish on, and the handle or link for each one. From the handle we derive the public profile URL, so we can look at your audience before we reply.
• Your audience size, roughly how many of your people already trade, what you plan to do, your experience, what you expect from the partnership, and how you heard about us.
• Brokers you already work with, and the per-lot rebate you get from them — either a band or an exact figure. This is commercially sensitive, so we store it in an internal-only section of the record. It is used to work out what we can offer you, and it is never shown outside our own admin.
• If you arrived on a partner's referral link, the code in that link, so the partner who introduced you gets credit.

Booking a call (/book)

• Your name.
• One contact — an email address or a WhatsApp number.
• Your time zone, so the slots you pick mean the same thing to both of us.
• The times you picked, stored in UTC.

The booking form does not record your IP address. It only stores the four items above.

Pitching a campaign (/propose)

• Your name.
• An email address, a WhatsApp number, or both.
• A summary of the campaign, the budget and the targets you have in mind.
• Any files you attach. These are uploaded to our file storage and the record keeps the path to them.

Partner accounts (/signup and /login)

• An email address and a password, handled by our authentication provider. The password is hashed on their side — we never see it and cannot read it.

Technical information

When you submit the apply or pitch form, we store two things the web server can see: the IP address the submission came from, and a two-letter country code the hosting network attaches to the request. Both are best-effort — when the headers aren't there, we store nothing rather than guess.

We keep them for one reason: to spot duplicate and fraudulent submissions, and to know roughly where a lead is coming from. They are not used to build a profile of you, and they are not used for advertising. No other page on this site records your IP.

Analytics

We run Vercel Web Analytics, which counts pageviews so we know which pages people actually read. It records the page, the referring site, the country, and the browser and device type — in aggregate. It sets no cookie, it does not assign you a persistent identifier, and it cannot follow you to other sites. We do not send it custom events, and it is never joined to a form submission, so nothing it collects is tied to your name.

Cookies

The public pages set no cookies at all. Once you sign in as a partner, our authentication provider sets a session cookie so you stay signed in; it is functional and cannot be turned off without breaking login. There are no advertising or tracking cookies anywhere on this site, and our analytics is cookieless — which is why you are not being asked to consent to any.

Embedded video

The videos on the home page are YouTube embeds loaded from youtube-nocookie.com, and nothing loads from YouTube until you actually click play. The still thumbnails, however, are served by Google's image host, so simply loading the page does make a request to Google that carries your IP address and browser details. We have no access to anything that request returns.

What we use it for

• Replying to you on the contact you gave.
• Assessing your application and agreeing a rebate rate.
• Running the partnership afterwards — tracking, payouts, support.
• Attributing your signup to the partner who referred you, if any.
• Keeping ordinary business records of who we dealt with and when.

We do not sell your information, rent it, or hand it to advertisers. We do not send marketing to people who only ever filled in a form — the reply you get is a human one, from us.

Who else touches it

• Supabase — our database, file storage and authentication provider. Every form submission is stored there, and it is where uploaded attachments live.
• Vercel — our hosting provider. It serves this site, supplies the IP and country headers described above, and runs the cookieless pageview analytics.
• Our email provider — when a submission arrives, an internal notification can be sent to our own desk inbox. That email contains your name, country and the contact details you gave, so it passes through the email service on its way to us.
• The broker — if you go on to become a partner, we pass the details needed to open and link your partner account. We do not send the broker anything about people who merely enquired.

How long we keep it

Applications, bookings and pitches are kept as business records for as long as the relationship or the possibility of one is live. We have not yet fixed a formal deletion schedule: 24 months after our last contact with you. Ask us to delete your record sooner and we will.

Your choices

Write to us and you can ask for a copy of what we hold on you, ask us to correct anything wrong, or ask us to delete it entirely. We don't require a reason. Deletion removes your record from our queue, so if you later want to partner with us you would need to apply again.

Depending on where you live you may have further statutory rights, and a regulator you can complain to: the Protection of Personal Information Act, 2013 (POPIA), overseen by the Information Regulator (South Africa).

Children

This site and the partner programme are for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted a form, tell us and we will delete it.

Changes

If we change what we collect, we change this page and move the date at the top. There is no version of this policy that quietly does more than the code does.