Privacy Policy

1. Introduction

This Privacy Policy explains how Dear Ziva (Pty) Ltd (Registration Number: 2020/159115/07), trading as Ledra ("we", "us", "our"), collects, uses, stores, and protects your personal information when you use our services, including Ledra Forge and other Ledra-branded products.

We are committed to protecting your privacy and complying with the Protection of Personal Information Act, 2013 (POPI Act) and all applicable South African data protection legislation.

Information Officer:

Rob Cunningham

Email: [email protected]

Physical Address: 79a Bellairs Drive, Glenvista

Postal Address: PO Box 57357, Springfield 2135

2. Who This Policy Applies To

This Privacy Policy applies to:

• Business Customers — Trades businesses, service providers, and professional practices that subscribe to Ledra products
• End Users — Employees, staff members, and authorised users of our Business Customers
• End Customers — Members of the public who communicate with our Business Customers via Ledra-powered WhatsApp messaging services
• Website Visitors — Anyone accessing our website or marketing materials

Different sections of this policy apply to different categories of data subjects.

3. What Information We Collect

3.1 Information from Business Customers

When you register for a Ledra product, we collect:

• Business Information: Company name, registration number, trading name, physical and postal addresses, industry sector
• Contact Information: Business contact person details, email addresses, phone numbers
• Account Information: Username, password (encrypted), authentication credentials
• Billing Information: Invoicing details, payment method information (processed by third-party payment providers)
• Usage Data: Product features used, login times, session duration, feature interaction patterns

3.2 Information from End Users (Staff/Employees)

If you are a staff member or employee using Ledra on behalf of a Business Customer, we collect:

• Profile Information: Name, email address, role/title, profile photo (optional)
• Authentication Data: Login credentials, device information, IP address
• Activity Data: Job assignments, time logged, notes created, documents uploaded, messages sent

3.3 Information from End Customers (WhatsApp Communications)

When members of the public communicate with our Business Customers via WhatsApp services powered by Ledra:

• Contact Information: Phone number, WhatsApp display name
• Communication Content: Message text, images, documents, audio messages, video files sent via WhatsApp
• Metadata: Message timestamps, delivery status, read receipts
• Conversation Context: Message history, conversation thread information

3.4 Automatically Collected Information

We automatically collect:

• Device Information: Browser type, operating system, device model, screen resolution
• Log Data: IP address, access times, pages viewed, referring URLs
• Cookies and Similar Technologies: Session identifiers, preference settings, analytics data (see Section 11)

4. How We Use Your Information

4.1 Service Delivery

We use your information to:

• Provide, operate, and maintain our software services
• Process job assignments, track work progress, and facilitate team collaboration
• Enable communication between Business Customers and their customers via WhatsApp
• Generate reports, analytics, and business insights for Business Customers
• Provide customer support and respond to enquiries

4.2 AI-Powered Features

Ledra Forge uses artificial intelligence to process WhatsApp messages. When enabled, our AI systems:

• Analyse inbound customer messages to determine urgency and intent
• Suggest responses or actions to business users
• Extract key information (e.g., addresses, appointment times, service requests)
• Route messages to appropriate staff members

Important: AI processing occurs in real-time and message content is transmitted to third-party AI providers (see Section 6.3). Business Customers can disable AI features at any time through their account settings.

4.3 Business Operations

We use information for:

• Billing, invoicing, and payment processing
• Account administration and user management
• Security monitoring, fraud prevention, and abuse detection
• Legal compliance and responding to lawful requests
• Internal analytics and service improvement

4.4 Communications

We may use your email address or phone number to send:

• Transactional messages (account notifications, password resets, billing statements)
• Service updates (new features, maintenance schedules, policy changes)
• Marketing communications (only with your consent, and you may unsubscribe at any time)

5. Legal Basis for Processing (POPI Act Compliance)

Under the POPI Act, we process personal information on the following lawful grounds:

6. Who We Share Your Information With

We do not sell personal information to third parties. We share information only as described below.

6.1 Business Customers

If you are an End Customer communicating with a trades business via WhatsApp:

• Your messages and contact information are shared with the Business Customer you are contacting
• The Business Customer is the data controller for this information and is responsible for compliance with their own privacy obligations to you

6.2 Service Providers

We engage trusted third-party service providers who process data on our behalf:

Infrastructure and Hosting:

• Supabase Inc. — Database hosting, authentication, file storage (EU or SA region)
• Lovable B.V. — Application hosting and development platform (data location: EU)

Communication Services:

• Twilio Inc. (USA) — WhatsApp Business API provider, message delivery infrastructure
• Meta Platforms Ireland Limited (Ireland) — WhatsApp Business Platform, message routing and delivery

Artificial Intelligence:

• Anthropic PBC (USA) — Claude API for AI-powered message analysis and automation (when AI features are enabled)

Email Services:

• Resend Labs, Inc. (USA) — Transactional email delivery

Payment Processing:

• Yoco Technologies (Pty) Ltd (South Africa) — Payment gateway and card processing (for applicable Ledra products)

All service providers are contractually bound to protect your information and use it only for the purposes we specify.

6.3 Cross-Border Data Transfers

Important: Some of our service providers are located outside South Africa, including in the United States and European Union. When we transfer personal information internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the Information Regulator
• Adequacy decisions recognising equivalent data protection standards (e.g., EU GDPR)
• Explicit consent where required by law

Specific Cross-Border Transfers:

6.4 Legal Disclosures

We may disclose personal information when required by law or to protect our legal rights, comply with court orders, or respond to lawful government requests.

7. Security of Your Information

We implement appropriate technical and organisational security measures to protect your personal information, including:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access, principle of least privilege, multi-factor authentication for administrative access
• Database Security: Row-level security policies preventing cross-tenant data access
• Monitoring: Automated threat detection, intrusion monitoring, and security logging
• Incident Response: Documented breach response procedures with regulatory notification timelines

Despite these measures, no system is completely secure. We will notify you and the Information Regulator promptly in the event of a data breach that poses a risk to your rights and freedoms.

8. WhatsApp Business Platform — Special Provisions

Our Ledra Forge product operates on the WhatsApp Business Platform. Special conditions apply:

8.1 Meta's Role

Meta Platforms (WhatsApp) is an independent data controller for the underlying messaging infrastructure. Their privacy policy governs their processing of WhatsApp data. We operate as a Business Solution Provider using Meta's approved API.

8.2 Message Templates and Consent

• We only send outbound WhatsApp messages using pre-approved Meta message templates
• Businesses using Ledra Forge must obtain consent from End Customers before initiating WhatsApp communications
• End Customers can opt out of WhatsApp communications at any time by replying STOP

8.3 24-Hour Messaging Window

WhatsApp's Business Platform rules restrict certain message types outside a 24-hour customer-initiated window. We comply with all WhatsApp Business Policy requirements.

9. Your Rights Under the POPI Act

As a data subject, you have the following rights:

9.1 Right to Access

You may request a copy of the personal information we hold about you.

9.2 Right to Correction

You may request that we correct inaccurate or incomplete personal information.

9.3 Right to Deletion

You may request that we delete your personal information, subject to legal retention requirements and contractual obligations.

9.4 Right to Object

You may object to the processing of your personal information where we rely on legitimate interest as our lawful basis.

9.5 Right to Complain

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa.

10. Data Retention

We retain personal information for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Retention Periods:

After the retention period expires, personal information is securely deleted or anonymised so that it can no longer identify individuals.

Early Deletion Requests: You may request earlier deletion of your personal information (see Section 9.3), subject to legal and contractual obligations.

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience, analyse usage, and deliver targeted content.

11.1 Types of Cookies We Use

Strictly Necessary Cookies:

• Session management and authentication
• Security and fraud prevention
• Load balancing and performance optimisation

These cookies are essential for the website to function and cannot be disabled.

Analytics Cookies:

• Google Analytics (anonymised IP addresses)
• Usage statistics and feature adoption tracking
• Error monitoring and debugging

Marketing Cookies:

• Advertising platform tracking (if applicable)
• Conversion tracking
• Remarketing audiences

11.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may limit functionality.

To opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout

11.3 Third-Party Tracking

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected]. We will delete such information promptly.

Business Customers are responsible for ensuring their End Users are of appropriate age to use the services.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings.

How We Notify You:

• Material Changes: We will notify you via email (to the address associated with your account) at least 30 days before the changes take effect
• Minor Changes: We will update the "Last Updated" date at the top of this policy and post a notice on our website

Your Continued Use: By continuing to use our services after changes become effective, you acknowledge and accept the updated Privacy Policy.

Archived Versions: Previous versions of this Privacy Policy are available upon request.

14. Multi-Tenant Data Architecture

Ledra operates a multi-tenant software platform, meaning multiple Business Customers share the same infrastructure while their data remains logically separated.

Data Segregation:

• Each Business Customer's data is isolated using database-level row security policies
• Access controls ensure users can only access data belonging to their organisation
• WhatsApp numbers and message histories are strictly segregated per Business Customer
• No Business Customer can access another Business Customer's data

Security Implications: While data is logically separated, it resides on shared infrastructure. We implement strict access controls, encryption, and monitoring to prevent unauthorised cross-tenant access.

15. Business Customer Data Controller Responsibilities

Important for Business Customers: If you are a Business Customer using Ledra to process personal information about your own customers, employees, or contractors, you are the data controller for that information, and we are your data processor.

Your Obligations:

• Maintain your own privacy policy compliant with the POPI Act
• Obtain lawful consent from your End Customers before collecting their information
• Provide POPI Act notices to your data subjects
• Respond to data subject rights requests from your customers
• Ensure your use of Ledra services complies with applicable data protection laws
• Maintain appropriate security measures for credentials and access control

Our Data Processing Agreement: Business Customers must enter into a Data Processing Agreement (DPA) with us, which is incorporated into our Terms of Service. The DPA specifies:

• Scope and nature of processing activities
• Security obligations and incident notification procedures
• Sub-processor arrangements and approvals
• Data subject rights assistance
• Cross-border transfer mechanisms

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

17. Definitions

• Business Customer: An organisation or individual that subscribes to Ledra services.
• Data Controller: The party that determines the purposes and means of processing personal information.
• Data Processor: The party that processes personal information on behalf of the data controller.
• Data Subject: An identifiable natural person whose personal information is processed.
• End Customer: A member of the public who communicates with a Business Customer via Ledra-powered services (e.g., a homeowner contacting a plumber via WhatsApp).
• End User: An employee, staff member, or authorised user of a Business Customer who uses Ledra services on behalf of that Business Customer.
• Personal Information: Information relating to an identifiable, living, natural person, including but not limited to name, contact details, identification numbers, location data, and online identifiers.
• POPI Act: Protection of Personal Information Act, 2013 (Act No. 4 of 2013), South Africa.
• Processing: Any operation performed on personal information, including collection, storage, use, disclosure, and deletion.

Acknowledgement: By using Ledra services, you acknowledge that you have read, understood, and agree to this Privacy Policy.

This Privacy Policy was last reviewed and approved by Dear Ziva (Pty) Ltd on 8 April 2026.