This Privacy Policy explains how BOTSIZA ("we", "us") collects, uses, and protects your personal information when you use botsiza.com and our chatbot products. We are committed to compliance with the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are (the Responsible Party)

BOTSIZA is operated by R Wright, a sole proprietor based in South Africa.
Information Officer: R Wright (POPIA section 56).
Contact: [email protected]

2. What personal information we collect

From Owners (paying subscribers):

• Business name, owner name, email address, phone number
• Business location (city, province)
• Payment information (processed by PayFast — we never see your card details)
• Business knowledge files you upload to your bot

From Visitors (people chatting with an Owner's bot):

• An anonymous browser ID (random string, not linked to your real identity)
• Chat messages and bot replies (used to capture leads for the Owner)
• Optional: name, contact details, address — only when you choose to share them with the Owner's bot for follow-up
• Files you choose to upload (images, PDFs) for the bot to analyse

3. Lawful basis for processing

We process personal information on the following POPIA-recognised bases:

• Performance of contract: to deliver the BOTSIZA service to Owners.
• Consent: when Visitors voluntarily share contact details with an Owner's bot.
• Legitimate interest: security monitoring, fraud prevention, service improvement.
• Legal obligation: tax records, compliance.

4. Who we share information with

We share the minimum necessary information with these third parties to operate the service:

• Anthropic PBC (USA) — chat messages are sent to Anthropic's Claude API to generate replies. Anthropic does not train models on API data.
• Resend (USA) — outbound transactional emails (welcome, lead notifications).
• PayFast (South Africa) — payment processing for Owner subscriptions.
• Cloudflare (USA) — CDN, DNS, DDoS protection. Sees IP addresses and request metadata only.
• Hetzner Online GmbH (Germany) — hosting infrastructure where the database lives.

We do not sell your personal information to anyone. Ever.

5. Cross-border transfers

Our database is hosted in Germany (Hetzner). Some processors (Anthropic, Resend, Cloudflare) are based in the USA. POPIA permits these transfers because the foreign jurisdiction provides comparable protection or you have consented to their use as part of the service. By using BOTSIZA you consent to this transfer.

6. How long we keep your data

• Owner account data: for the life of your subscription, plus 5 years for tax/SARS purposes.
• Chat logs: for the life of the Owner account that owns the conversation. Owners may request earlier deletion.
• Lead capture records: for 3 years from creation.
• Payment records: 5 years (SARS / VAT requirement).
• Backups: 14 days rolling.

7. Your rights under POPIA

You have the right to:

• Access the personal information we hold about you
• Correct or update inaccurate information
• Request deletion ("right to erasure")
• Object to processing
• Lodge a complaint with the Information Regulator (inforegulator.org.za)

To exercise any of these, email [email protected] with the subject "POPIA request". We respond within 30 days.

8. Security measures

Our infrastructure is hardened: firewall (UFW), brute-force protection (fail2ban), key-only SSH, encrypted in transit (TLS 1.3), per-customer folder isolation (0700 perms), daily backups, observability/error tracking. No system is 100% breach-proof; if one occurs we will notify affected Owners within 72 hours per POPIA section 22.

9. Cookies

We use essential cookies only (session token, anonymous browser ID for chat continuity). We do not use third-party tracking cookies or advertising cookies. No Google Analytics. No Facebook pixel.

10. Children

BOTSIZA is intended for businesses and adult visitors. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

11. Changes to this policy

If we make material changes, we will update the "Last updated" date at the top and notify Owners by email. Continued use after the update constitutes acceptance.

12. Complaints

If you believe we have not handled your information correctly, contact us first at [email protected]. If unresolved, you may approach the Information Regulator of South Africa: inforegulator.org.za.