Privacy policy

• Responsible party: Choccy AI (Pty) Ltd, trading as Weeva AI, registration number 2025/148892/07.
• Address: 4th Floor, The Piazza, 20 Whiteley Rd, Melrose North, Johannesburg, 2196, South Africa.
• Email: [email protected].
• Information Officer: Jordan Haskel ([email protected]).

Our Information Officer oversees our compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and responds to requests and enquiries about this policy.

What we collect depends on how you interact with us. Typically:

• Identity and contact details: name, job title, employer, business address, business email address and business telephone number.
• Account details: for users of the platform, login details, role and permission settings, and the audit log of actions taken in the account, including login times and IP addresses.
• Commercial details: contracts, invoices, payments and billing contacts.
• Technical and usage details: IP address, device and browser information, referring page, pages viewed and time spent on weeva.ai.
• Enquiry details: what you send us through the contact and demo forms, WhatsApp, email or at events.
• Enquiry source: when you send us an enquiry through a form on our website, we also record how you found the website: the page you first landed on, the website that referred you, and any campaign tags in the link you followed. We use this to understand which channels bring enquiries.
• Recruitment details: the information in a CV or application, and references where you provide them.

We do not intentionally collect special personal information through our website, and our website and services are not directed at children under 18. If you believe a child has given us personal information, contact our Information Officer and we will delete it.

• Directly from you, when you use our website, contact us, book a demo, sign a contract or use the platform.
• Automatically, through cookies and similar technologies on weeva.ai (see section 7).
• From your organisation, when it nominates you as a user or contact person.
• From public sources and professional networks, where the information is lawfully available.

The Weeva platform uses AI models, including models supplied by third parties, to read documents and match them to a client's data. When we do this for a client, the processing is governed by our agreement with that client.

For personal information where Weeva is the responsible party, such as website visitor and prospect information, we do not use it to train third-party AI models, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.

weeva.ai uses cookies to work correctly, to remember your choices and to measure how the site is used. For visitors who appear to be in the European Union, the European Economic Area, the United Kingdom or Switzerland, or whose location cannot be determined, analytics cookies stay off until you opt in. For visitors elsewhere, including South Africa, we rely on our legitimate interest under section 11(1)(f) of POPIA to set analytics cookies by default, and you can opt out at any time through the cookie preferences link in the footer. Your choice always overrides the default.

The demo calendar on our Book a demo page is provided by Cal.com and sets strictly necessary cookies. Our cookie policy lists every cookie we use.

We do not sell personal information. We share it only as needed, with appropriate safeguards:

• Service providers and sub-processors: cloud hosting, AI model providers, email and messaging providers, analytics and customer relationship tools, our demo booking provider (Cal.com), and professional advisers.
• Authorities, where the law, a court order or a competent regulator requires it.
• A buyer or successor, in a merger, acquisition or similar transaction, under confidentiality obligations.
• Anyone else you have agreed we may share it with.

Our current sub-processors are listed in our security overview, which we share on request.

Some of our service providers operate outside South Africa. Where personal information leaves South Africa, we transfer it only as section 72 of POPIA allows: to a recipient bound by adequate data protection law or agreement, with consent, or where the transfer is needed for a contract with you or in your interest. Where the GDPR applies, we use recognised safeguards such as standard contractual clauses.

When a client uses the Weeva platform, the orders, delivery notes, customer lists and catalogues it sends us often contain personal information, such as the names and contact details of the client's customers, suppliers and staff. For that information:

• the client is the responsible party and decides why and how it is processed;
• Weeva processes it only on the client's documented instructions, under a written agreement;
• Weeva applies appropriate technical and organisational security measures; and
• requests from those people are directed to the client, and Weeva helps the client respond.

If you are unsure which organisation is the responsible party for your information, contact our Information Officer and we will help.

• Encryption in transit, and encryption at rest for sensitive fields and uploaded documents.
• Tenant isolation, with each client's sensitive data encrypted under its own keys.
• Per-user access controls and an audit log of actions in the platform.
• Security logging, monitoring and vetting of service providers.

No system is completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

We keep personal information only as long as we need it for the purposes above, including legal, accounting and reporting requirements. Then we delete, destroy or de-identify it. Our Information Officer can give you a summary of our retention periods on request.

• Access: ask whether we hold personal information about you and request a copy.
• Correction and deletion: ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
• Objection: object, on reasonable grounds, to processing, including direct marketing.
• Withdrawal of consent: where we rely on consent, withdraw it at any time.
• Complaint: lodge a complaint with the Information Regulator.

Contact our Information Officer to exercise these rights. We may need to verify your identity first. Access requests can also be made under our PAIA manual.

We may update this policy when our processing, the law or good practice changes. The updated date at the top shows the current version. Where a change is material, we will take reasonable steps to tell you.

Information Officer: Jordan Haskel, [email protected], 4th Floor, The Piazza, 20 Whiteley Rd, Melrose North, Johannesburg, 2196, South Africa.

If you are not satisfied with our response, you may complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Complaints under POPIA: [email protected]. Website: inforegulator.org.za.