Who we are
Chatta (chatta.co.za) helps South African businesses answer their customers on WhatsApp. For this policy, Chatta is the “responsible party” under the Protection of Personal Information Act, 2013 (POPIA).
Chatta is not yet a registered company. It is run by its founder in South Africa. TODO: add the registered company name, number and address once the company exists.
What this policy covers
Two things, which we describe separately so it’s clear what applies today:
- This website, today: visiting chatta.co.za, trying the demo, and joining the early-access list.
- The Chatta service, once it opens: business accounts, the assistant, and the messages it handles for you.
What the website collects
The early-access form
Your email address, the kind of business you run, and how you’d like to sign in later. We use these only to tell you when Chatta opens and to plan which sign-in options to build first. You choose to give them to us (consent).
The demo
The demo runs entirely in your browser. What you type, including any business details you add under “Your business”, is not sent to us or anyone else, and it disappears when you leave the page.
Visit statistics
We count visits with Vercel Web Analytics, which doesn’t use cookies. It records things like the page viewed, the referring site, the type of device and the country, without identifying you.
Your theme choice
If you pick the cream or dark theme, your browser remembers it in its own storage on your device. It isn’t sent to us.
Security logs and spam protection
Our hosting provider keeps short-lived technical logs, which include IP addresses, to keep the site running and safe. To stop spam on the form we count attempts per connection using a scrambled (hashed) version of your IP address, which we don’t store in the clear.
The website sets no advertising or tracking cookies.
What the service will collect
When accounts open, Chatta will process:
- Your account: your name, email, sign-in details from Google, Facebook or email, and your billing details (handled by our payment provider).
- Your business information: services, prices, hours, areas, policies and FAQs you enter, so the assistant can answer from them.
- Your customers’ conversations: their WhatsApp name and number, their messages and the assistant’s replies, and booking details.
- Records we must keep: a log of every handoff to a person and every deletion request.
For your customers’ messages, you are the responsible party and Chatta acts as your operator: we process them only to provide the service to you. The assistant never asks for health details beyond what a booking needs.
Sending information outside South Africa
WhatsApp messages already pass through Meta’s servers outside South Africa, and the AI runs outside South Africa, so a service like Chatta can’t keep everything in the country. We say so plainly rather than promise otherwise.
Our database is in the United Kingdom, which has data-protection law similar to POPIA. We only use providers bound by agreements that protect your information, as section 72 of POPIA requires. TODO: legal review of each provider’s transfer terms.
How long we keep it
- Early-access list: until 12 months after Chatta opens, or until you unsubscribe or ask us to delete it, whichever comes first.
- Service data: while your account is open, then deleted after you close it. TODO: set the exact period after closing.
- Handoff and deletion logs: kept as long as needed to show we handled requests properly. TODO: set the period.
How we protect it
- Everything is encrypted in transit (HTTPS) and at rest.
- Each business’s data is walled off from every other business’s at the database level.
- Only the people and systems that need information can reach it, and secrets are never kept in our code.
- If a breach ever affects your information, we’ll tell you and the Information Regulator as POPIA requires.
Your rights
Under POPIA you can:
- ask what personal information we hold about you, and get a copy;
- ask us to correct it, or to delete it;
- object to us using it, or withdraw your consent (for example, leave the early-access list);
- complain to the Information Regulator at inforegulator.org.za.
Email us to use any of these rights. We’ll reply within 30 days and won’t charge you for it.
Children
Chatta is for businesses. We don’t knowingly collect information from anyone under 18 through this website.
Information officer and contact
Information Officer: TODO: name to be registered with the Information Regulator
Email: privacy@chatta.co.za
You can also use our contact form and choose “Privacy or data request”. For anything else, email support@chatta.co.za.
Changes to this policy
We’ll update this page when anything changes and change the date at the top. Big changes will also be emailed to the early-access list.