How we handle your information.

We build automations that send messages and keep records for small businesses, so we handle other people's details every day. This page explains, in plain language, what we collect, why, where it goes and what you can ask us to do with it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).

Last updated: 29 October 2026

The short version. We only collect what a job needs. We never sell personal information or use it for anyone else's advertising. Customers of the businesses we work for can stop messages at any time by replying STOP. You can ask us what we hold about you, and ask us to correct or delete it, by emailing thomas@automation-ai.co.za.

1. Who we are

Automation AI ("we", "us") is a South African business that sets up AI and WhatsApp automations and websites for small businesses. It is run by Thomas, who is also our Information Officer under POPIA.

2. Whose information we handle

We handle personal information in two different roles, and POPIA treats them differently.

When you deal with us directly

If you visit this website, try the live demo, contact us or become a client, we decide how your information is used. In POPIA terms we are the responsible party, and this whole policy applies to us.

When we run automations for a business

When a business uses our automations (for example a salon whose WhatsApp assistant we set up), that business decides what customer information is collected and why. The business is the responsible party, and we act as its operator: we process its customers' information only on its instructions, only to run the service, and under a written agreement that requires us to keep it confidential and secure (POPIA sections 20 and 21).

If you are a customer of one of our clients, the business you dealt with is your first point of contact for privacy questions. You are also welcome to contact us and we will help, or pass your request on to them.

3. What we collect

From website visitors, demo users and people who contact us

What you send us: your name, business name, phone number, email address and the content of your messages.
What you type into the live demo form, such as a name, phone number and a pretend booking time. Please feel free to use made-up details.
Basic technical information our hosting provider records when any website is visited, such as your IP address, browser type and the page requested. We use it only to keep the site working and secure.

From our clients (the businesses we work for)

Contact and billing details for the owner and staff we work with.
Business information needed to set up the automation, like services, prices, opening hours and FAQs.
Access to the tools the automation connects to, such as a WhatsApp Business account or Google Calendar. We use the narrowest access that does the job.

About our clients' customers, on the client's behalf

Name and phone number or email address.
Booking or order details, such as the service, date and time.
Messages the customer sends to the business's WhatsApp assistant or forms, and the replies sent back.
Whether the customer has opted out of messages.

We do not ask for special personal information (like health, religion or biometric data) or ID numbers. If a customer volunteers it in a message, it is used only to answer that message. Our automations are designed for adults; we do not knowingly collect information about children without a parent's or guardian's consent.

4. Why we use it

POPIA requires a lawful reason for each use. Here is ours.

What we do	Lawful reason (POPIA s11)
Reply to your enquiry and arrange a free chat	You asked us to, and it is in our legitimate interest to answer
Run the live demo and send the demo messages	You asked for it by filling in the form
Set up, run, monitor and fix a client's automations	Performing our contract with the client
Send a client's customers confirmations, reminders and replies	On the client's instructions, for the booking or enquiry the customer made
Invoicing, accounting and tax records	Legal obligations and our contract
Keeping systems secure and preventing abuse	Legitimate interest

Direct marketing. We only send marketing messages to people who have agreed to receive them or who are existing clients, as POPIA section 69 requires, and every message tells you how to opt out. Automations we build for clients follow the same rule: messages about a customer's own booking are not marketing, and anything promotional (like a "we miss you" nudge or a review request) goes only to the client's own customers and always includes a way to opt out.

AI replies. Some automations use an AI model to read a customer's message and write a reply. The message is sent to the AI provider only to produce that reply. The assistant says it is an assistant, does not make decisions with legal or similar effects about anyone, and hands over to a person when it is unsure.

We never sell personal information, and we never use one client's customer information for another client or for our own marketing.

We use a small number of trusted service providers to run the website and automations. They only get the information they need to provide their service, and are bound by their own security and privacy commitments.

Cloudflare: hosts this website, the demo link and our email forwarding.
Google: email (Gmail), and calendars, sheets and forms when a client's automation uses them. This website also loads its font from Google Fonts.
Meta (WhatsApp Business Platform): delivers WhatsApp messages for client automations.
Telegram: alerts to business owners, and the live demo, which uses Telegram in place of WhatsApp.
AI model providers, such as Anthropic (Claude): write AI replies, as described above.
Server hosting: the servers that run our automation software (n8n).

We may also share information if the law requires it, for example a valid court order, or to protect someone's safety.

6. Information sent outside South Africa

Several of the providers above store or process information on servers outside South Africa, for example in the European Union or the United States. POPIA section 72 allows this when the recipient is bound by laws, binding rules or an agreement that give a level of protection similar to POPIA. We choose providers that offer such protection through their data processing terms, and where we can choose a South African or nearby location, we do.

7. How long we keep it

Enquiries that don't become work: up to 12 months, then deleted.
Live demo entries: deleted within 30 days.
Client records and invoices: for as long as we work together, and then for the period tax and company law require (generally five years).
Clients' customer data: for as long as the client's automation needs it. Automation run logs are cleared regularly. When a client leaves, we return or delete their customer data within 30 days, unless the law requires us to keep it.
Opt-outs: we keep a record of the phone number or email that opted out, so that it is never messaged again.

8. How we keep it safe

POPIA section 19 requires reasonable security measures. Ours include:

Encrypted connections (HTTPS) for this website, the demo and our automations.
Strong, unique passwords and two-step sign-in on the accounts we use, and access limited to the people who need it.
Keys and passwords kept out of public code and shared files.
Only the parts of our systems that customers need to reach are exposed to the internet.
Software kept up to date, and a separate setup for each client so one client's data is never mixed with another's.

If we ever believe personal information has been accessed without permission, we will tell the affected client and, where required, the people affected and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires.

9. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and for a copy of it;
ask us to correct information that is wrong, or delete information we are no longer allowed to keep;
object to us using your information, including for direct marketing;
stop messages from an automation at any time, by replying STOP or telling the business;
withdraw consent you have given, at any time;
complain to the Information Regulator.

To use any of these rights, email thomas@automation-ai.co.za or WhatsApp +27 72 594 1594. We may ask you to confirm who you are first. We will reply within one working day and aim to complete your request within 30 days. There is no charge for a reasonable request.

10. Cookies and this website

This website does not use advertising or analytics cookies, and it does not track you around the internet. Our hosting provider, Cloudflare, may use strictly necessary security measures to protect the site from attacks. The page font is loaded from Google Fonts, which means your browser connects to Google's servers and shares your IP address with them.

11. Changes to this policy

We will update this page when the way we handle information changes, and change the date at the top. If a change affects how we handle a client's customer data, we will tell that client first.

12. Contact and complaints

Questions or concerns about your information? Contact our Information Officer, Thomas, at thomas@automation-ai.co.za or on WhatsApp at +27 72 594 1594. We would like the chance to put things right.

If you are not happy with our response, you can complain to the Information Regulator (South Africa) through its website, inforegulator.org.za.