Privacy Policy

We handle only the information needed to run the service:

• Account information — your name, email address and sign-in credentials when you create an account, or basic profile details shared by Google if you choose Google sign-in.
• Workspace information — the business content you and your organisation record in SBC, such as contacts and companies, leads and sales opportunities, projects, tasks, notes, documents, finance entries, campaigns and messages.
• Settings and preferences — your organisation setup, roles, language and reading preferences, and information-feed interests.
• Activity history — a record of actions taken in your workspace, kept so your organisation has an audit trail and SBC can show recent activity.
• Connection details — the status and configuration of services you connect (for example a WhatsApp Business number or another business system). Access credentials for connected services are stored encrypted and are never displayed back to you or anyone else.

We do not collect information for advertising, and we do not sell personal information to anyone.

We use information only to provide and operate SBC:

• to create and secure your account and workspace;
• to store, organise and present your business records to you and the members of your organisation according to their roles;
• to generate insights, reminders, recommendations and drafts from your own records when you use those features;
• to send messages and run automations that you or your organisation explicitly configure and authorise;
• to keep the service reliable, diagnose problems and protect against misuse.

We do not use your workspace content to train general-purpose models, and we do not profile you for advertising.

You sign in with an email address and password, or with your Google account. Authentication is handled by our hosted platform provider. Passwords are never stored in readable form. If you sign in with Google, Google shares basic profile details (such as your name and email address) with us under Google's own terms and privacy policy.

Records you keep in SBC — including personal information about your own customers, leads and contacts — belong to your organisation. Each organisation's records are isolated from every other organisation, and access within an organisation follows the roles its administrators assign (owner, administrator, manager, member).

When you store information about other people in SBC (for example your customers or leads), you act as the party responsible for that information and for having a lawful basis to hold and use it. We process it only on your instructions as part of providing the service.

SBC lets your organisation manage contact lists, message templates, campaigns and conversations. Where messaging is used:

• messages are sent only to recipients your organisation has added, using channels your organisation has connected;
• SBC records consent and opt-out status, and your organisation is responsible for honouring it;
• delivery and status events are recorded so you can see what happened to each message.

You can connect third-party business systems to SBC (for example via API keys, OAuth sign-in or incoming webhooks). When you do:

• the connection is configured per organisation — there is no shared credential across customers;
• access credentials are stored encrypted, used only to perform the connection you set up, and are never shown back in readable form;
• your use of each third-party service remains subject to that provider's own terms and privacy policy;
• you can disconnect a service at any time, which stops further exchange of information through it.

If your organisation connects WhatsApp Business, the connection is made through Meta's own supported onboarding (Facebook Login for Business with Embedded Signup). In that flow you sign in to your own Meta account and choose your own WhatsApp Business account and number.

• Meta returns an access token that belongs to your organisation. It is stored encrypted against your organisation alone and is used only to send and manage messages on your behalf through the WhatsApp Business Platform.
• We do not hold a shared sending credential across organisations, and we cannot use your WhatsApp account for any other customer.
• Message content and delivery events exchanged through WhatsApp are stored in your workspace so your team can manage the conversation, and are handled as described in this policy.
• Data received from Meta is used only to provide the WhatsApp features you connected — it is not sold, shared with unrelated third parties, or used for advertising.
• Your use of WhatsApp and Meta services is also governed by Meta's terms and the WhatsApp Business Messaging Policy.

Disconnecting the integration stops further use of the token, and deleting the connection removes the stored credential.

SBC includes an assistant, insight and automation features that work from your own workspace records. When you use them, the relevant records are processed to produce an answer, recommendation or draft for your organisation. Automated actions run only under the rules and approvals your organisation configures, and are recorded in your activity history.

• Organisation records are isolated and protected by row-level access rules.
• Access inside an organisation is controlled by assigned roles.
• Connected-service credentials are stored encrypted.
• Connections to the service are encrypted in transit (HTTPS).
• Administrative access to the platform is restricted and used only to operate and support the service.

No method of storage or transmission is completely secure, but we work to protect your information and will tell affected users about a personal information breach where the law requires it.

We keep your information for as long as your account and workspace are active. Workspace members with the appropriate role can delete records at any time.

If you want your account or your organisation's workspace deleted, contact us (see below) and we will remove it. Deletion removes the workspace content, stored credentials and personal information we hold about you, except where we must keep limited records for legal, accounting or security reasons. Encrypted backups may retain deleted data for a limited period before being overwritten.

You may also ask us for a copy of the personal information we hold about you.

Depending on where you live (including under South Africa's Protection of Personal Information Act, POPIA, and similar laws elsewhere), you may have the right to:

• access the personal information we hold about you;
• correct or update inaccurate information (you can do most of this in your profile);
• request deletion of your account and personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details below. If your information sits inside a workspace managed by an organisation (for example your employer), please also contact that organisation, as it controls those records.

SBC is hosted with reputable cloud providers whose infrastructure may be located in other countries. Where information crosses borders, it is protected by the safeguards described in this policy and the contractual protections in place with our providers.

If we change this policy we will update the version and date on this page. Material changes will be highlighted in the app where appropriate. Continuing to use SBC after a change means you accept the updated policy.

For any privacy question, request or complaint, contact the operator of SBC:

Smart Apps Africa (Pty) Ltd
Email: mark@smartappsafrica.co.za
Product: Smart Business Companion, a Smart Apps Global platform

If you are in South Africa and are not satisfied with our response, you may contact the Information Regulator (South Africa) at inforegulator.org.za.