Privacy Policy

Effective date: [DD MONTH 2026]

1. Introduction

This policy explains how [LEGAL ENTITY — e.g. Yasenza (Pty) Ltd] (“Yasenza”, “we”) processes personal information when you use Yasenza, in line with the Protection of Personal Information Act, 2013 (POPIA). For account and organizational data you provide, we act as the responsible party. For the message content and group data you schedule through Yasenza, we act as an operator processing on your instructions — you remain responsible for having a lawful basis to send it.

Information Officer: [INFORMATION OFFICER NAME] — [privacy@yourdomain].

2. What we collect

• Account & organization data: names, email addresses, hashed passwords, role, and organization details.
• WhatsApp connection data: the linked number’s session/authentication state, and the group identifiers (JIDs) and group names discovered from your account.
• Content you schedule: the messages, captions and media you upload to be sent, and their scheduling metadata.
• Delivery & audit data: send logs (which post went to which group, when, and the outcome) and an audit trail of admin actions.
• Billing data: plan and subscription status, and a payment-processor reference. Card details are handled by our payment processor, not stored by us.
• Technical data: log and diagnostic information needed to operate and secure the service.

3. Why we use it & our lawful basis

We process this information to provide the service (performance of our contract with you), to keep it secure and prevent abuse (legitimate interest / our obligations), to bill you (contract), and to comply with law. We do not sell your personal information, and we do not use the content of your messages for advertising.

4. WhatsApp data

To deliver your scheduled posts, Yasenza maintains a WhatsApp Web session for your linked number and stores the group identifiers needed to send. Delivery itself occurs over WhatsApp’s infrastructure and is subject to WhatsApp/Meta’s own processing and terms, over which we have no control (see the Terms, section 3).

5. Sub-processors

We use trusted providers to run the service. Each processes only what is needed for its function:

• Database hosting — Neon (PostgreSQL).
• Media storage — Cloudflare R2.
• Application hosting — Fly.io.
• Transactional email — Resend.
• Payments — Paystack.
• Message delivery — WhatsApp / Meta Platforms (via the WhatsApp Web protocol).

6. Cross-border transfer

Some providers store data outside South Africa (for example, database and application hosting in the European Union / United Kingdom). Where personal information is transferred across borders, we rely on the provider offering protection substantially similar to POPIA and on contractual safeguards, as permitted by section 72 of POPIA.

7. How long we keep it

• Media for sent or failed posts is eligible for deletion approximately 30 days after sending.
• Account, organization and audit data is kept while your account is active and for a reasonable period afterwards to meet legal, tax and dispute-resolution needs, then deleted or anonymized.
• Send logs are retained to provide reporting and to investigate delivery issues.

8. Your rights under POPIA

Subject to law, you may:

• request access to the personal information we hold about you;
• request correction or deletion of inaccurate or out-of-date information;
• object to certain processing; and
• lodge a complaint with the Information Regulator (South Africa) if you believe your rights have been infringed.

To exercise any right, contact our Information Officer at [privacy@yourdomain].

9. Security

We use appropriate technical and organizational measures — including encryption in transit, hashed passwords, role-based access control, per-organization data isolation, and audit logging — to protect personal information. No system is perfectly secure; we will notify you and the Regulator of a reportable breach as required by POPIA.

10. Cookies

Yasenza uses only the cookies strictly necessary to keep you signed in and to operate the app securely. We do not use advertising or third-party tracking cookies.

11. Children

Yasenza is a business tool intended for use by organizations and is not directed to individuals under 18.

12. Changes & contact

We may update this policy; material changes will be notified in-app or by email. Questions or requests: [privacy@yourdomain].