Privacy Policy

1. Who we are

LinxAI is a trading name of DTK REFRSH (PTY) LTD, registration number 2025/003280/07, a private company registered in the Republic of South Africa (“LinxAI”, “we”, “us”).

Contact: privacy@linxai.co.za

Registered address: Plot 102, Waterval, Krugersdorp West, Gauteng, 1739, South Africa

This policy explains how we handle personal information under the Protection of Personal Information Act, 4 of 2013 (POPIA).

2. The two capacities

LinxAI holds personal information in two separate capacities. Which one applies determines who decides what happens to the information.

As responsible party. We determine why and how the information is processed. This covers our own website visitors, enquiries, leads, and clients. Everything in this policy applies directly.

As operator. We process information on behalf of a client business, on that client’s instruction. This covers the end customers of businesses that use LinxAI to run WhatsApp messaging, voice agents, or automation. In this capacity the client business is the responsible party. The client determines the purpose of processing, the retention period, and when information is deleted. We act on their documented instruction and do not use the information for our own purposes.

WhatsApp Business Accounts. Each client owns its WhatsApp Business Account and its registered phone number. Where a client grants us access, we administer that account on their behalf: configuring phone numbers, message templates, display names, and account settings, and sending and receiving messages on their instruction. The client grants that access and can withdraw it at any time.

If you are an end customer of a business that uses LinxAI, that business is the responsible party for your information. We will forward your request to them and act on their instruction. You may also contact them directly.

3. What we collect

As responsible party

• Name, email address, phone number, and company name
• Enquiry and correspondence records
• Billing and account records
• Website analytics and usage data
• Cookies

As operator, on behalf of clients

• WhatsApp phone numbers and message content
• Voice call audio, recordings, and transcripts
• Lead and enquiry details submitted through client forms, ads, or chat
• CRM records created in the course of providing the service
• WhatsApp Business Account settings and administration records, created while managing the client’s account on their behalf

4. Why we process it

POPIA requires a lawful basis for each category of processing. Ours are set out below.

5. AI and automated processing

LinxAI uses AI systems to generate message replies, conduct voice calls, and qualify enquiries.

Recipients are told they are interacting with an AI agent. Voice agents disclose this in the opening greeting. Messaging agents identify themselves as automated.

No decision producing a legal effect, or a similarly significant effect, is made solely by automated means without human review.

Message and call content may be sent to the AI model providers listed in section 6 to generate a reply. It is not used by us to train models.

6. Sub-processors

We use the following third parties to deliver the service. Some process personal information outside South Africa.

Where a sub-processor is outside South Africa, we rely on section 72 of POPIA. Transfers are made on the basis that the recipient is subject to binding contractual terms that give effect to principles for the lawful processing of personal information that are substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is necessary to perform a contract with you.

7. Retention

• Enquiries that do not become clients — 24 months from last contact.
• Client account and correspondence records — for the term of the agreement and 3 years after it ends.
• Billing, invoicing, and tax records — 5 years, as required by South African tax and companies legislation.
• Analytics data — retained by the analytics provider under its own schedule. Google Analytics retains event data for 14 months. Microsoft Clarity retains recordings for 90 days.
• Cookie consent record — 365 days, then you are asked again.
• Message content, call recordings, transcripts, and CRM records held as operator — retained for the period the client instructs, and deleted on the client’s instruction or at the end of the client agreement. We do not set this period.

8. Your rights under POPIA

You have the right to:

• Access — ask whether we hold your personal information and request a copy.
• Correction — ask us to correct or complete information that is inaccurate.
• Deletion — ask us to delete or destroy your information. See Data Deletion for how to make the request.
• Objection — object to processing based on legitimate interest, and withdraw consent where processing relies on it.
• Complaint — lodge a complaint with the Information Regulator.

Send requests to privacy@linxai.co.za. We respond within 30 days. Where we hold the information as operator, we forward the request to the responsible party and act on their instruction.

9. Security

• Data is encrypted in transit using TLS, and encrypted at rest by our hosting and database providers.
• Access to client data is restricted to personnel who need it to deliver the service, and is controlled by per-account credentials.
• Credentials and API keys are held in a secrets store, not in code.
• If a security compromise affects your personal information, we notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of it, as required by section 22 of POPIA. Where we act as operator, we notify the client as the responsible party.

10. Changes

We may update this policy. The current version is always published at linxai.co.za/privacy and the revision date at the top of this page changes when it does. Where a change materially affects how we handle your information, we notify affected clients by email.

11. Contact