← Indawo AI home · Envy Fincorp (Pty) Ltd t/a Indawo AI, reg. 2021/756475/07
Version 1.0.2, effective 20 October 2026. For the website indawoai.co.za, the Ask Indi help chat, the Indawo AI sign-up and the Indawo AI app.
Envy Fincorp (Pty) Ltd, trading as Indawo AI, registration number 2021/756475/07. Address (and address for legal notices): 102 Churchill Street, Wendywood, 2090 (“Indawo”, “we”). Email: privacy@indawoai.co.za.
Information Officer: Mr D Mhlaba, privacy@indawoai.co.za. Information Regulator registration number: to be published.
(a) We are the responsible party for information about people who visit our website, use Ask Indi, ask us for a demo, sign up for or use an Indawo AI account (our clients’ owners, managers and staff users), and suppliers. Sections 3 to 11 apply.
(b) We are an operator (a service provider) for the lodges, guesthouses and hotels that use Indawo AI. If you book a stay, message a property, check in online or leave a review through a property that uses Indawo AI, that property is the responsible party for your information and its own privacy notice applies. We process your information only on its instructions under a written operator agreement (POPIA s20 and s21). Section 12 explains this. If you want to access, correct or delete your booking information, contact the property; if you contact us, we will pass your request to the property promptly.
| Who | Information | Purpose | POPIA basis (s11) | How long we keep it |
|---|---|---|---|---|
| Ask Indi chat users | The questions you type (we strip email addresses and phone numbers from unanswered questions before logging them); no name or IP address is stored with chat questions | Answer your question; improve the help content | Legitimate interest (s11(1)(f)) | Unanswered-question log: 12 months |
| Ask Indi lead form | Name, property name, email or phone, your question, the consent wording you agreed to, date/time, the page you were on | Reply to your question and follow up on it | Your consent (s11(1)(a)), which you can withdraw at any time | 12 months after our last contact, unless you become a client |
| Demo and sales enquiries | Name, business, role, contact details, notes of our conversations | Respond, arrange demos, prepare quotes | Steps at your request before a contract (s11(1)(b)); legitimate interest | 12 months after last contact |
| Business prospects (role mailboxes such as info@ published on a business’s own website) | Business name, published role email/phone, website, region, public notes about the booking tools the business uses, source URL and date | A single request asking whether you agree to hear from us (POPIA s69(2)); if you say no or don’t answer, we stop | Legitimate interest for holding the record; we send marketing only with your consent | Deleted after 12 months without engagement; a suppression entry (email only) kept so we never contact you again |
| Sign-up and sign-in verification (one-time codes by email) | Your email address, the one-time code (stored only in scrambled, hashed form), when it was sent, delivery status, number of attempts, IP address and device type | Check that you control the email address; protect sign-up, sign-in and “continue later” from fraud and account takeover | Steps you ask for before and under a contract (s11(1)(b)); our legitimate interest in security (s11(1)(f)) | Codes expire after 10 minutes and are deleted within 24 hours. Verification and delivery logs: 12 months. Unfinished sign-ups are deleted after 30 days of inactivity |
| Clients and their users | Business and billing details, authorised signatory details including ID/passport number, user names, emails, cell numbers, roles, login and audit records, support tickets, bank details for debit orders, proof of business address | Open and run your account, verify authority, bill, support, keep the service secure, verify your business address (to confirm the business is genuine and prevent fraud) | Contract (s11(1)(b)); legal obligation (s11(1)(c)) for tax records; legitimate interest for security | Life of the account plus 5 years for billing and tax records (Tax Administration Act, VAT Act); ID, bank data and proof of business address deleted 90 days after the account ends and all amounts are settled |
| Marketing to clients and opted-in contacts | Name, email, phone, preferences | Product news, offers, events | Consent (s69(1)(a)) or, for existing clients, similar services with an opt-out each time (s69(3)) | Until you opt out |
| Website visitors | Technical data in server logs (IP address, browser, pages, time) | Security, abuse prevention, fixing faults | Legitimate interest | 30 days in raw server logs |
One-time codes and your cell number. One-time codes are sent by email only, from accounts@indawoai.co.za, through our email delivery provider, which acts as our operator under written terms (sections 6 and 8). We do not send codes by SMS. We use the cell number you give us only to contact you about your account (for example urgent service or security issues). We do not use it for marketing unless you separately opt in.
Account service emails. We send account service emails, such as reminders to upload outstanding documents (for example, proof of business address 7 days and 2 days before the deadline) and notices about a pause of your account. These are service messages needed to run your account, not marketing, so they are sent under our contract with you (s11(1)(b)) and do not need your consent.
We do not knowingly collect information from children through our website. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (POPIA s71).
Ask Indi answers from a knowledge base we wrote. It is automated and can be wrong: please check important answers with us. Version 1 does not send your questions to an outside AI model provider. If we switch on an AI model provider, we will update this notice first and name the provider and country (section 8).
Consent wording used in the lead form: > ☐ I agree that Indawo AI may store my name, property and contact details and contact me about this question. I can withdraw consent or ask for my details to be deleted at any time at privacy@indawoai.co.za. See the Privacy Notice. > ☐ (optional) Also send me occasional Indawo AI news and offers by email/WhatsApp. I can unsubscribe at any time.
Our website currently uses no analytics or advertising cookies. Strictly necessary cookies may be used to keep you logged in to the app and to protect forms. When you play a demo video, it is loaded from YouTube in “privacy-enhanced mode” (youtube-nocookie.com); YouTube (Google) may then set cookies or store data on your device under Google’s privacy policy. If we add analytics, we will ask for your consent through a cookie banner before setting non-essential cookies and update this section with the cookie names, purposes and durations.
You can block or delete cookies in your browser settings.
We do not sell personal information.
We send electronic marketing only (a) to people who have consented, or (b) to our clients about similar services, with an opportunity to opt out each time (POPIA s69). If we have not dealt with you before, we may contact you once to ask whether you consent, using a request in the form required by the POPIA Regulations (Form 4). Every marketing message identifies us and gives a free way to opt out (reply “STOP” or “unsubscribe” or use the link). We keep a do-not-contact list.
Our main servers are in South Africa. Some service providers process information in other countries:
| Provider | Country | Safeguard |
|---|---|---|
| Channex.io (channel connections, when a property uses live OTA sync) | European Union / United Kingdom | EU/UK GDPR and a data-processing agreement (s72(1)(a)); transfer to the booking channel the guest chose (s72(1)(c)–(d)) |
| Meta / WhatsApp (when you message us or a property on WhatsApp) | USA, EU and other countries | Meta’s data-processing terms (s72(1)(a)); needed to deliver messages you asked for |
| YouTube / Google (demo videos) | USA and other countries | Only if you press play; Google’s terms |
| xneelo (Pty) Ltd (account emails and one-time codes) | South Africa | to be published |
We transfer information only where POPIA s72 allows.
We use reasonable technical and organisational measures: encrypted connections (HTTPS), encryption of ID and bank fields, role-based access, two-factor authentication for administrators, audit logs, backups and staff confidentiality. ID numbers and bank details are visible only to the client’s Owner/Admin and Accounts users and to authorised Indawo billing staff. No system is completely secure; if your information is compromised we will tell you and the Information Regulator as POPIA s22 requires.
You may: ask whether we hold information about you and request a copy (s23; our PAIA Manual explains how and any fees); ask us to correct or delete it (s24); object to processing based on legitimate interest, and to direct marketing at any time (s11(3)); withdraw consent (without affecting earlier lawful processing); and complain to the Information Regulator (JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001; complaints: POPIAComplaints@inforegulator.org.za; www.inforegulator.org.za). Please contact our Information Officer first so we can try to help.
We will post changes here with a new version number and date. If a change materially affects clients, we will also email the account owner.
When a property uses Indawo AI, we may process your booking, contact, check-in, payment-status, message and review information on its behalf. The property decides why and how it is used. We: use it only to provide the property’s service; do not sell it or market to you ourselves; keep it secure (section 9); may pass it to the booking channel or messaging service you used (section 8); and delete it when the property tells us to or when its account ends. For questions, contact the property. If you cannot reach the property, write to our Information Officer and we will forward your request.
Version: Privacy Notice version 1.0.2, effective 20 October 2026.
