POPIA Compliance Notice

1. Responsible party

The responsible party for the purposes of POPIA is the 4 Group, trading as ReplyAI, a South African company. We can be contacted at info@4ai.co.za.

2. Purpose of processing

We process personal information for the following purposes:

• To respond to enquiries submitted via our website, chat widget, or WhatsApp
• To set up, configure, and operate AI WhatsApp agents on behalf of business clients
• To send service-related communications and follow-ups
• To improve and maintain our platform and services
• To comply with legal and regulatory obligations

3. Categories of personal information

We may process the following categories of personal information:

• Contact details: name, email address, phone number (including WhatsApp number)
• Business information: business name, industry, and related details
• Communication content: messages sent via our website chat or WhatsApp
• Usage data: interactions with our platform and dashboard

4. Lawful basis for processing

We process personal information on the basis of: (a) consent, where you have provided it; (b) contractual necessity, where processing is required to deliver our services; and (c) legitimate interest, where processing is necessary for the ordinary conduct of our business and does not override your rights and interests.

5. Sharing of personal information

We do not sell personal information. We may share information with the following categories of third-party operators who process data on our behalf: cloud infrastructure providers (Supabase, Vercel), AI processing services (OpenAI), messaging platforms (Meta / WhatsApp), and email delivery services (Resend). All operators are required to process information only as instructed and in accordance with applicable law.

6. Cross-border transfers

Some of our service providers are based outside South Africa. Where personal information is transferred across borders, we take reasonable steps to ensure it receives a comparable level of protection in accordance with POPIA Section 72.

7. Retention of information

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Conversation data from inactive accounts is deleted upon request or after a period of reasonable inactivity.

8. Your rights under POPIA

As a data subject, you have the following rights under POPIA:

• Right of access — you may request a record of the personal information we hold about you
• Right to correction — you may request correction of inaccurate or incomplete information
• Right to deletion — you may request deletion of your personal information, subject to legal retention requirements
• Right to object — you may object to the processing of your personal information on legitimate grounds
• Right to complain — you may lodge a complaint with the Information Regulator of South Africa

9. Information Regulator

If you believe your rights under POPIA have been infringed, you may contact the Information Regulator of South Africa at inforeg@justice.gov.za or visit www.inforegulator.org.za.

10. Contact our information officer

To exercise any of your rights or for any POPIA-related queries, contact our Information Officer at info@4ai.co.za. We will acknowledge your request within 3 business days and respond fully within 30 days.