Privacy Policy (POPIA)

1. Commitment to Data Sovereignty & POPIA

IDATHA AI (Pty) Ltd ("IDATHA", "we", "us", or "our") respects the privacy and constitutional data protection rights of our clients. This Privacy Policy sets out our practices regarding the collection, use, processing, and protection of personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 (POPIA) of South Africa.

2. Information We Process

Depending on how you use our platform and the agent harness, we process the following categories of information:

Account Information: Full name, verified mobile/WhatsApp number, email address, billing credentials, and province.
Life-Admin Files & Artifacts: Municipal bills, rates statements, SARS deduction receipts, medical aid claims, vehicle registrations, and emails you explicitly choose to upload or forward to your personal agent.
AI Model Keys: API keys for third-party models (OpenAI, Anthropic, xAI) provided by you. These keys are stored encrypted on-device or within your sandboxed microVM and never exposed to other clients.
Agent Interaction Logs: Prompt transcripts and execution histories between you and your dedicated agent.

3. Connected Social Media Accounts

You may connect your own social media account — a TikTok account, for example — to your agent so that it can prepare and send posts for you. This is optional, and you can remove it at any time.

Connecting uses the platform’s own official authorisation process. We never ask for, see, or store your social media password. The platform issues us a token, which is stored encrypted on the server that runs your agent and is used for one purpose only: to send a post that you have approved.

When you connect an account we can read your basic public profile — your display name, username and avatar — so that your dashboard can show you which account is linked. We do not read your messages, your feed or your followers, and we do not post anything you have not approved.

You remain in control:

Nothing is published until you approve that specific post in your dashboard.
You can disconnect at any time from your dashboard. Disconnecting removes the connection and the token immediately.
You can also revoke access from the platform itself — in TikTok, for example: Settings and privacy → Security and permissions → Manage app permissions.
Deleting your account deletes the connection and the token with it.

We do not sell or share this connection, we do not use it for advertising, and the token is never used for any account other than the one you connected.

4. Zero Public Model Training Guarantee

We enforce an uncompromising rule: your documents, tax records, and conversations are NEVER used to train, fine-tune, or improve public AI models. Data processed within your personal agent environment remains strictly isolated to your account.

5. Architecture & Storage Isolation

Each client agent runs inside an isolated, hardware-virtualized microVM container (Firecracker architecture). Data at rest is encrypted using military-grade AES-256 encryption. Transmission between your device and our servers is secured via TLS 1.3 encryption.

6. Your AI Provider Key

IDATHA does not supply the language model. You connect a key from an AI provider of your choice — OpenAI, DeepSeek, Groq, Google Gemini, OpenRouter or any other OpenAI-compatible provider — and your prompts are transmitted to that provider under your own account and their terms.

Your key is encrypted before it is stored and is decrypted only to serve your own requests. It is never shared, resold, or used for another user's traffic. You may replace or remove it at any time.

Because inference happens at your chosen provider, the handling of your prompt content there is governed by your agreement with them. IDATHA's own processing — your memory, your message history, your scheduled tasks and your knowledge-base queries — stays on our own infrastructure.

One exception. To make routine decisions such as checking that a booking confirmation is genuine, or screening a page or email before your agent reads it, the service sends the relevant text to our AI decision provider, TypeSafe. They do not train or fine-tune any model on it. It is held only as long as needed to provide the service, and deleted on request. Your agent's answers continue to run on your own AI provider key and are governed by that provider's terms.

7. Your Rights Under POPIA

As a data subject in South Africa, you have the right to:

Request confirmation of whether we hold personal information concerning you.
Request access to, correction, or destruction of your personal information.
Object to the processing of your personal information on reasonable grounds.
Export your conversation transcripts and uploaded document archives at any time.

8. Data Deletion & Account Closure

You may request deletion of your personal information at any time. There are two ways to do so:

From your WhatsApp chat — send delete my account to your agent.
By email — write to privacy@idatha.co.za from the address or WhatsApp number registered to your account, with the subject "Data Deletion Request".

We confirm every request within 5 working days and complete deletion within 30 days. There is no charge.

What is deleted: your account record, registered WhatsApp number, email address, agent conversation transcripts, and any documents you uploaded. Encryption keys protecting your stored third-party AI provider credentials are destroyed, rendering those keys unrecoverable.

What is retained: only records we are legally obliged to keep under South African law — principally invoices and tax records, retained for the periods required by the Companies Act and SARS. These are held in a restricted archive, accessible to no one but our accountants, and are never used for any other purpose.

WhatsApp and Meta: when you connect your WhatsApp number to IDATHA, message content is processed on our own servers solely to generate replies. Deleting your IDATHA account stops that processing and removes your number from our platform. Meta Platforms Ireland Ltd separately holds its own records relating to your WhatsApp account under Meta's own privacy policy; those records are not controlled by us, and you may exercise your rights over them directly with Meta.

Step-by-step instructions, including exactly what happens and when, are set out on our Data Deletion page.

9. Information Officer Contact

To exercise your rights under POPIA or for data protection inquiries, please contact our Information Officer:

Information Officer
IDATHA AI (Pty) Ltd
Email: privacy@idatha.co.za / support@idatha.co.za
Johannesburg & Cape Town, South Africa

10. Copyright Assertion

All content, brand marks, visual design systems, software architectures, and South African life-admin knowledge graphs on this website are protected under copyright: