Privacy policy

Notifyza (Pty) Ltd (registration number 2026/918778/07), a company registered in South Africa (“Notifyza”, “we”, “us”), provides the Notifyza platform. For information about our own customers and their team members we are the responsible party under POPIA. For the contacts our customers upload and message, our customer is the responsible party and we process that information on their behalf, as an operator.

• Account details: your name, email address, password (stored only as a secure hash) and, if you sign in with Google, the basic profile Google shares.
• Organisation details: your organisation’s name, team members, sending domains, sender names and addresses, and SMS sender IDs.
• Contacts you add: names, email addresses, phone numbers, custom fields, list memberships, and each contact’s opt-ins and opt-outs per channel.
• Campaign content and results: the emails, SMS and WhatsApp messages you create, and delivery, open, read, click, bounce and opt-out events.
• WhatsApp connection: when you connect WhatsApp through Meta, we receive your WhatsApp Business Account and phone number IDs, the number’s display name and quality rating, and an access token that lets Notifyza send messages for you. Tokens and PINs are stored encrypted.
• Billing: your plan, invoices and payment status. Card details are entered on PayFast and never reach us.
• Technical information: logs of requests to our service (such as IP address and browser) kept to run, secure and fix the service.

• To provide the service: sending your campaigns, recording results, and showing reports.
• To honour opt-outs: unsubscribes, STOP replies and WhatsApp opt-out buttons are recorded so those people aren’t messaged again.
• To bill you, provide support, keep the service secure, and meet our legal obligations.
• To power the AI features, if your organisation uses them. Each feature sends our AI provider only what it needs:
  • Writing emails and SMS: what you ask for, the email or SMS being worked on, and your organisation’s name, logo and contact details.
  • Explaining a campaign’s results: its figures (counts, rates and times), not who opened or clicked.
  • Building a segment from a description: your field, list and campaign names, not your contacts.
  • Suggesting replies in the inbox, when someone in your team asks for them: that conversation (its most recent messages) and the contact’s first name. This is the only AI feature that sends anything a contact wrote.
  No other information about your contacts is sent. An owner or admin can turn AI off for the whole organisation in Settings, and then nothing is sent.

We do not sell personal information, and we do not use your contacts for our own marketing.

Only the service providers needed to run Notifyza, each bound to protect the information:

• Amazon Web Services (SES) to deliver email.
• BulkSMS to deliver SMS.
• Meta (WhatsApp Business Platform) to deliver WhatsApp messages and review message templates.
• PayFast to process payments.
• Anthropic (Claude) to provide the AI features, for organisations that have them turned on.
• Our hosting and infrastructure providers.

We may also disclose information when the law requires it; see “Requests from public authorities” below.

If a court, regulator, police or other public authority asks us for personal information, including information we receive from Meta:

• We check that the request is lawful and properly made before acting on it.
• We challenge a request we believe is unlawful, overly broad or not properly made.
• When we must comply, we disclose only the minimum information the request lawfully requires.
• We keep a record of each request: who made it, what was asked, our legal reasoning, how we responded and who at Notifyza (Pty) Ltd handled it.

We may also report suspected illegal use of Notifyza, such as fraud or spam, to the relevant authorities on our own initiative, where the law allows.

Some providers above process information outside South Africa. We only use providers with protections comparable to POPIA, as section 72 of the Act requires.

We keep your information while your account is active. When an organisation is deleted, its contacts, campaigns and results are deleted, apart from records we must keep by law (such as invoices). Backups are overwritten within 30 days.

We use encryption in transit, encrypt access tokens and PINs at rest, store passwords only as hashes, and limit access to those who need it. If a breach affects your personal information, we will tell you and the Information Regulator as POPIA requires.

Under POPIA you may ask to see the personal information we hold about you, have it corrected or deleted, and object to its use.

To do so, email support@notifyza.co.za. If you received a message from one of our customers, contact that business directly, or opt out with the link or reply option in the message. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za.

Notifyza stores your sign-in session and preferences in your browser so you stay signed in. Emails sent through Notifyza may include open and click tracking, which our customers can turn off per campaign.

Our marketing website (notifyza.co.za) uses Google Analytics to understand how visitors use the site: pages viewed, how they arrived, and general device and location information. Google Analytics does not store full IP addresses. This is separate from the Notifyza platform itself, which does not use Google Analytics.

We will post any changes here and update the date above. For significant changes, we will also email account owners.