top of page
Theodore-AI-logo

Privacy Policy

Last Updated: October 13, 2026

​

Theodore AI (“we”, “us”, or “our”) is committed to protecting your privacy and ensuring that your personal information is processed safely, lawfully, and transparently in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa.

​

This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you interact with the Theodore AI WhatsApp Chatbot Application and associated services (collectively, the “Service”).

1. Information We Collect

We collect only the personal information necessary to deliver, maintain, and secure our WhatsApp chatbot service. Depending on your interaction with the Service, we may collect:

  • WhatsApp User Information: Your WhatsApp phone number, display name, profile picture, and uniquely assigned WhatsApp User ID (provided via Meta/WhatsApp Business APIs).

  • Conversation & Operational Data: Messages, prompts, technical specifications, and queries shared directly during interactions with the chatbot, including information submitted via inquiry forms.

  • Technical & Log Data: Operational metadata, including timestamps, message delivery statuses, system interaction logs, IP addresses, and error logs required for infrastructure assessment and security governance.

  • Cookies & Web Analytics (Where Applicable): Essential cookies and performance analytics on our associated web portal/dashboard to monitor platform health, security, and performance.

2. Legal Basis and Purpose of Processing

In compliance with Section 11 of POPIA, we process your personal information for specific, explicitly defined, and legitimate business purposes:

  • Service Delivery & Automation: To process your prompts, refine workflows, and deliver bespoke narrow AI solutions directly within the WhatsApp interface.

  • Accountability & Security Governance: To verify user identities, maintain platform security, prevent fraudulent activity, and audit infrastructure integrity.

  • Customer Support & Communications: To respond to technical inquiries, provide administrative updates, and deliver client support.

  • Analytics & Performance Optimization: To monitor platform health, ensure technical stability, and optimize conversation flows.

​

Note: Theodore AI processes data using private, isolated memory banks. Your sensitive operational intelligence and chat interactions remain secured within a closed network and are never used to train public or foundational AI models.

3. Sharing and Disclosure of Personal Information

We do not sell, rent, or trade your personal information. We only share information under the following strict conditions:

  • Service Providers & Operators: We may share data with vetted third-party operators (such as cloud hosting providers, infrastructure partners, and Meta Platforms, Inc. as the underlying messaging provider) who process data on our behalf under strict confidentiality agreements compliant with Section 20 and 21 of POPIA.

  • Legal Compliance: We may disclose information if required to do so by South African law, court order, regulatory bodies (such as the Information Regulator of South Africa), or legal processes.

  • Business Transfers: In the event of a merger, acquisition, or restructuring, user data may be transferred as an asset under equivalent privacy safeguards.

4. Cross-Border Data Transfers

To provide high-availability AI model inference, your information may be processed or stored outside of South Africa. In accordance with Section 72 of POPIA, we ensure that any cross-border transfer of personal information is made to recipients who are subject to laws, binding corporate rules, or binding agreements that provide an adequate level of protection substantially similar to POPIA.

5. Security Safeguards

Governance and data security are at the core of our operations. In compliance with Section 19 of POPIA, we implement enterprise-grade technical and organizational measures, including:

  • Encryption: End-to-end transport layer security (TLS) for data in transit and AES-256 encryption for data at rest.

  • Access Control: Strict role-based access restrictions limiting sensitive data exposure to authorized senior engineers subject to security audits.

  • Guardrails & Isolation: Private vector indexes and secure memory banks to ensure tenant data separation.

6. Retention of Data

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, satisfy legal or accounting obligations, or resolve disputes. Once personal information is no longer required, it is securely deleted, destroyed, or de-identified in accordance with Section 14 of POPIA.

7. Your Statutory Rights Under POPIA

As a data subject under South African law, you hold the following rights regarding your personal information:

  • Right to Access: Request confirmation of whether we hold your personal information and request a copy of such record (Section 23).

  • Right to Correction/Deletion: Request the correction, destruction, or deletion of inaccurate, irrelevant, out-of-date, or incomplete information (Section 24).

  • Right to Object: Object to the processing of your personal information on reasonable grounds relating to your particular situation, or for direct marketing purposes (Section 11(3)).

  • Right to Submit a Complaint: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been compromised.

8. Third-Party Links & Meta Platform Policy

Our chatbot operates within the WhatsApp environment. Your use of WhatsApp itself is subject to Meta’s standard Terms of Service and Privacy Policy. We encourage you to review Meta’s privacy policies regarding how they handle messaging metadata on their network.

9. Contact Details & Privacy Inquiries

If you have questions about this Privacy Policy, wish to exercise your POPIA rights, or need to contact our designated Information Officer, please reach out to us:

  • Information Officer / Compliance Officer: Compliance Officer

  • Email: hellotheo@theo-ai.co.za

  • Physical Address: 410 Lynnwood Rd, Pretoria, 0081, South Africa

  • Website: https://theo-ai.co.za

Supervisory Authority

If you are unsatisfied with our response, you have the right to contact the Information Regulator (South Africa):

  • Website: https://inforegulator.org.za

  • General Enquiries: enquiries@inforegulator.org.za

  • POPIA Complaints: POPIAComplaints@inforegulator.org.za

Privacy Inquiries

Email
DPO

The Corner Office, 410 Lynnwood Rd, Pretoria, 0081, South Africa

bottom of page