Privacy Policy

Last updated: 23 July 2026 · Version 5

Chris uses an AI assistant to answer enquiries and book appointments. This notice, given in terms of section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA"), explains what personal information the assistant handles and how. You can reach us about anything in this policy at cristhatchers@gmail.com.

Who is responsible for your information

Chris is the responsible party under POPIA; our registered address is available on request at cristhatchers@gmail.com.

The assistant is hosted and operated on our behalf by In House IT (Pty) Ltd (registration number 2024/456850/07) of 7 Radar Drive, Durban North, KwaZulu-Natal, 4051, South Africa — our operator under POPIA — on a server located in Johannesburg, South Africa, under a written agreement that limits what may be done with your information to running this service for us, nothing else. The providers it uses in turn are listed under “Who receives your information” below.

What we collect, and where it comes from

Everything comes directly from you: the messages you send the assistant, including voice notes; your name and a phone number or email address when you make a booking; the appointment details themselves; photos or details you choose to share about your issue; if you message us on WhatsApp, the phone number you message from; and if you email us, the address you write from. When you use the web chat we also record the network (IP) address your messages arrive from and the approximate area it points to (city level at best, derived from the address's network registration — never your device's GPS location). To work out that area, the network address alone is sent once to an address-lookup service (ipwho.is), which may process it outside South Africa; nothing else about you or your conversation is sent with it. We use this for security, to prevent abuse of the chat, and as part of the ordinary record of the enquiry; it is not used to track you on other websites. The chat page stores a random session identifier in your browser so your conversation can continue where it left off — it identifies your browser session, not you, and is not used to track you anywhere else.

Why we process it, and on what basis

We process your information to answer your questions, make and manage the bookings you ask for, send you quotes and invoices for our work where applicable, send appointment reminders you'd expect, and occasionally ask how we did after an appointment. Under section 11 of POPIA our basis is that the processing is necessary to carry out what you're asking us to do, and our legitimate interest in keeping ordinary business records of it. Marketing messages rely on your consent or an existing customer relationship (see Marketing below). Our team can read conversations with the assistant so a human can step in and to improve how we serve you.

Is providing information voluntary?

Entirely. You can chat without giving any personal details — but we can't book an appointment without a name and a way to contact you, and we can't send a reminder without the contact detail it goes to.

AI processing, and information sent outside South Africa

Replies are generated by an artificial-intelligence language model, and voice notes are transcribed by the same provider so the assistant can understand them. They are used to generate the reply, not to build a profile of you.

Your records — this conversation and your booking history — are stored on our server in Johannesburg. To produce a reply and run the service, some information is sent to providers who process it outside South Africa:

What permits these transfers. Under section 72 of POPIA we rely on the data-processing terms that form part of our agreement with each provider — which require them to keep your information confidential, to process it only in order to provide the service to us, and not to use it to train AI models — read together with the fact that the transfer is necessary to do the very thing you have asked us to do, namely answer you and manage your booking (section 72(1)(d)). We do not authorise any of these providers to use your information for their own purposes, and none of them is permitted to sell it.

How long they keep it. Our AI provider's API terms provide that content sent through the API is not used to train its models and is retained only for a short period for abuse monitoring before being deleted. Meta, Google and PayFast retain information under their own published policies.

If you would rather your message were not processed this way, say so in the chat and ask for a person — one of our team will take the conversation over.

Please send only what's needed

Share just enough to answer your question or make your booking. Please don't type identity numbers, bank or card details, medical history, information about someone else, or anything similarly sensitive into the chat — POPIA treats some of these as special personal information with extra restrictions, and the assistant does not need them to help you. If something sensitive is genuinely relevant, ask for a person and we'll deal with it properly.

No decisions are made about you by a machine alone

The assistant helps make the bookings you ask for — nothing more, and you can change or cancel them at any time. No decision with legal or similarly significant effect on you is taken solely by automated processing (section 71 of POPIA), and you can always ask for a human — say so in the chat and a person will take over.

Who receives your information

Our own team; In House IT, as the operator that hosts the service; the AI provider (message content only, to generate replies); Meta Platforms, if you contact us on WhatsApp (your messages travel through Meta's WhatsApp Business Platform under Meta's own terms); our calendar provider, where bookings are placed into our business calendar; and, if you give a street address for a call-out, OpenStreetMap's Nominatim geocoding service receives that address (nothing else — no name or contact details) so we can send the team member already working nearest to you. If we offer it and you choose to pay an invoice online, your payment is made on the secure pages of PayFast (Pty) Ltd under PayFast's own terms — we never see or store your card details, and we receive back only confirmation that the invoice was paid, with a payment reference. Finally, an encrypted copy of our backups is held off-site with Microsoft (OneDrive) so a server failure can't destroy your records — it cannot be read without our key. We do not sell your personal information, and nobody may use it to train AI models.

Marketing

This site uses no third-party analytics, no advertising trackers and no marketing cookies. If we post links to this site on social media, we count clicks on our own server — nothing about that is shared with anyone. Electronic marketing is only sent as section 69 of POPIA allows: with your consent, or to existing customers for similar services. Every marketing email carries an unsubscribe link; unsubscribing is immediate and permanent, and we never re-add an unsubscribed address.

How we keep it safe

As section 19 of POPIA requires, reasonable technical and organisational safeguards protect your information: this service runs in its own isolated environment with its own database, connections are encrypted in transit, access is limited to the people who need it, and and encrypted nightly backups protect against data loss. Those backups are encrypted before they leave the server, and an encrypted copy is held off-site (currently with Microsoft OneDrive, outside South Africa) so that a failure of the Johannesburg server cannot destroy your records; nobody holding that copy can read it without our key. If, despite this, your information is accessed by someone unauthorised, we will notify you and the Information Regulator as section 22 of POPIA requires.

How long we keep it

No longer than necessary (section 14 of POPIA): conversation and booking records are kept while they're needed to run the service and keep sensible business records, and then deleted. Invoices and payment records are kept for the period tax law requires (generally five years). Ask us and we'll delete your information sooner where the law allows.

Your rights

Under POPIA you may: ask whether we hold personal information about you and request a copy (section 23); ask us to correct or delete it (section 24); object to processing based on our legitimate interests (section 11(3)); and withdraw consent you've given, without affecting what was lawfully done before. Access requests may also be made under the Promotion of Access to Information Act 2 of 2000 (PAIA) — our PAIA manual explains how. The fastest route is simply to contact us at cristhatchers@gmail.com — we'll sort it out, normally within a few days and at no charge for a first request.

If you believe we've handled your information unlawfully, you may lodge a complaint with the Information Regulator (South Africa) — current complaint channels and forms are published at inforegulator.org.za (Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191).

Children

The assistant is a booking tool for our services and is not directed at children. We don't knowingly process a child's personal information without a competent person's consent (sections 34-35 of POPIA); if you believe we hold a child's information, contact us and we'll delete it.

The assistant can make mistakes

This chat is powered by an artificial-intelligence model, and AI can get things wrong: a reply may occasionally state a time, price, or detail incorrectly, or misunderstand what you asked. Replies are provided in good faith but are not a binding commitment by Chris — anything important, including appointment details, pricing and promises about our services, is only binding once confirmed by a human member of our team. To the maximum extent permitted by law, Chris and In House IT accept no liability for any loss, damage or inconvenience arising from reliance on an AI-generated reply. If the assistant has gotten something wrong or upset you, we genuinely want to know at cristhatchers@gmail.com — a real person will put it right.

Changes

If this policy changes, the date at the top changes with it. Material changes will be visible here before they take effect.