VumeloVumelo
Log inCreate account
VumeloVumelo

Cookie Notice

Last updated: 2026-10-06

Vumelo uses a small set of cookies and some browser storage that are needed to sign you in and keep the service secure, and the Meta Pixel on our public pages to measure how well our adverts work. Our sign-up, log-in and password reset forms can also run a bot check. This notice explains each one, and how to switch the Meta Pixel off.

1. What a cookie is

A cookie is a small text file a website stores in your browser. It lets the site recognise your browser on the next request, which is how a site can keep you signed in instead of asking for your password on every page. Similar tools work alongside cookies: a tracking pixel measures visits, and a site can also keep information in your browser’s local storage and session storage. This notice covers all of them.

2. Cookies that are strictly necessary

Vumelo sets these cookies, all of which are needed for signing in and for security:

  • The sign-in cookie that keeps you signed in (the Supabase auth cookie). Our own page code reads it to connect to our database for you, so it is not HttpOnly: scripts running on our pages can read it. It is sent only to our site, over secure (HTTPS) connections, and stays until you sign out or your session ends.
  • A session cookie for the access gate that protects the site when it is closed for maintenance or review. It is HttpOnly, so page scripts cannot read it.
  • For our own staff only, the admin console cookies that keep a signed-in admin session open and hold the second sign-in step. They are HttpOnly.

You cannot sign in or stay signed in without these cookies, so POPIA and the Electronic Communications and Transactions Act (ECTA) do not require consent for them.

3. A cookie that remembers your Meta choice

vmlo_ads_optout: set only when you switch Meta tracking off (section 6). It records that choice on this browser, so our server honours it too. Our server sets it, and the page sets it as well so it applies at once; it lasts 400 days. It holds nothing about you except that choice.

4. Storage in your browser

Vumelo also keeps some information in your browser’s local storage, which stays until it is cleared, and session storage, which is cleared when you close the tab. Only our pages read it; it is not sent to us on its own.

  • A working copy of your portfolio (properties, gradings, deals and cash records), so pages load quickly, with notes on what still has to be saved to our servers: vumelo.<account number>.v1, vumelo.<account number>.sync and, on devices that used an older version, vumelo.<account number>.migrated. The main copy is on our servers. If your account moves to another organisation, the previous copy is kept aside in vumelo.<account number>.v1.prev-org until you log out. If this browser’s copy is ever damaged and cannot be read, the damaged copy is kept aside in vumelo.<account number>.v1.corrupt until you log out, and a fresh copy is loaded from our servers.
  • Which account the data in this browser belongs to: vumelo.owner.
  • Drafts of a deal analysis or a grading you are working on: vumelo.deal.* and vumelo.grading.*.
  • In session storage, the email address you signed up with, so the next page can show where we sent the link (vumelo.verify.email).
  • Details an older version of the sign-up page saved (vumelo.profile.v1). Nothing writes or reads it now; it is removed the next time anyone signs in on this browser, and when you log out.
  • News stories you saved: vumelo.news.saved.v1.
  • Your Meta choice on this browser (vmlo.ads.optout) and notes that stop one advert event being reported twice (vmlo.px.*, and vmlo.px.checkout.* in session storage).
  • After you log out, the time you logged out (vumelo.loggedout), with nothing else. For about 2 minutes it makes any other open tab clear its copy too. It is removed the next time anyone signs in.

When you log out, Vumelo removes everything listed above from this browser, except your Meta choice, so that logging out does not switch tracking back on, and the log-out time. If your session ends without Log out (for example it expired, or you were signed out on another device), only your changes not yet saved to our servers and your unfinished drafts stay, so they can be sent when you sign back in. They are removed as soon as anyone else signs in on this browser. On a shared computer, always log out when you finish.

5. The bot check (Cloudflare Turnstile)

On the sign-up, log-in and password reset pages, and when you resend a sign-up link, change your password or delete your account, our forms can run Cloudflare Turnstile to tell people from bots. When it runs, Cloudflare’s script runs in a small frame on those pages, processes your IP address and browser signals to make the check, and may keep a little data in your browser to do so. It is used only for security, never for advertising. Cloudflare processes this outside South Africa (see sections 5 and 6 of our Privacy Policy).

6. Advertising measurement (Meta Pixel)

We advertise Vumelo on Facebook and Instagram. To see which adverts bring people to the site and which lead to sign-ups and paid plans, we use the Meta Pixel, a small piece of code from Meta Platforms Ireland Limited (Meta Platforms, Inc. in the United States).

Where it runs. On our public pages: the home page, sign-up, log-in and the legal pages. It also loads on the checkout page and the payment confirmation page, only to report those two steps. Once Meta’s code has loaded in a browser tab, it stays loaded if you then move into your account in that tab without reloading the page, but we send it nothing from inside your account apart from those two checkout steps.

What it reports. A page view on those public pages, and these events when they happen: you create an account (and start your free trial), you open the checkout for a paid plan, and a payment for a plan is confirmed. The checkout and payment events include the plan name and price. We never send Meta your name, properties, documents, gradings, deal figures or anything else you keep in Vumelo.

From our server, with a hashed email. We also send the sign-up, checkout and payment events to Meta from our own server (Meta’s Conversions API), so they arrive even when a browser blocks the pixel. These copies include a scrambled (SHA-256 hashed) copy of your email address and of your Vumelo account number, your IP address and browser details, and the Meta cookies above. Meta compares the hashed email with the hashed addresses of its own users to match the event to a Facebook or Instagram account. Meta counts each event once, whichever copy arrives.

Advert audiences. We may also give Meta a hashed list of our customers’ email addresses, so it can show our adverts to people similar to our customers and stop showing them to people who already subscribe.

What Meta receives. With each report, Meta’s code also sends the address of the page (only the site and the path: we take advert parameters such as utm_ tags and fbclid off the address first, and keep fbclid only as the _fbc cookie below), your IP address, browser and device details, an identifier stored in the _fbp cookie that Meta’s code sets on our site, and, if you arrived by clicking one of our adverts, an _fbc cookie that records that click (each lasts about 90 days). If you are logged in to Facebook or Instagram in the same browser, Meta may link the report to your account there under its own cookies and its own privacy policy, which applies to what Meta does with this information. See Meta’s Privacy Policy.

Datahash. Meta’s code also sends these same reports to Datahash, a company that runs Meta’s Conversions API Gateway for us. Datahash passes them on to Meta from its own servers, so they still arrive when a browser blocks a direct connection to Meta. Datahash handles them on our behalf as our operator, outside South Africa (see sections 5 and 6 of our Privacy Policy).

Why we do it, and your right to object. We use the Meta Pixel on the basis of our legitimate interest in measuring and improving our advertising (POPIA section 11(1)(f)). You may object at any time (section 11(3)), and we will stop. Switch it off below, which stops the reports to both Meta and Datahash from this browser. If you are signed in, it also stops our server sending your events and leaves you out of customer lists, on every device (you can do the same in your account settings). We also send nothing to Meta when your browser sends a Global Privacy Control or Do Not Track signal.

Checking this browser’s setting…

Clearing this browser’s cookies or site data for Vumelo also clears the switch on this browser; an objection you made while signed in stays on your account. You can also limit how Meta uses information about you for adverts in your Facebook or Instagram ad preferences, and block or delete cookies in your browser settings.

7. What we do not use

We do not use third-party analytics cookies. Apart from the Meta Pixel described above, we do not use advertising or cross-site tracking cookies; the Cloudflare bot check is a security tool, not tracking. If we add another non-essential cookie or tracker, we will update this notice first and tell you.

8. Controlling cookies and storage

You can clear or block cookies and site data in your browser settings at any time. Blocking the strictly necessary cookies will stop you from signing in and using Vumelo. Clearing browser storage removes the copies and drafts listed in section 4; your saved work stays on our servers. Blocking the Meta Pixel or its cookie has no effect on how Vumelo works for you.

9. Contact us

Cookie or privacy questions: getinfo@mystudenthouse.co.za. Online identifiers such as cookie and session data are personal information under POPIA, so this notice sits alongside our Privacy Policy.

This is a plain-language summary of our legal terms. If anything here is unclear, contact us before you rely on it.