Privacy Policy

Effective date: 17 July 2026 · Version 1.0

1. Introduction

This policy explains how HANDY LABS (PTY) LTD (Registration No. 2026/563734/07), trading as Thirdhand ("we", "us"), collects and uses personal information under the Protection of Personal Information Act, 2013 (POPIA).

Our Information Officer is Raa-id Ismail, reachable at raaid@westernambition.co.za or 19 Burwood Road, Crawford, Cape Town, Western Cape, 7780.

This policy covers two groups of people:

  • Business users — the business owners who sign up for Thirdhand. For your information, we are the responsible party.
  • Customers of business users — people who message a business's WhatsApp number. For your information, the business you contacted is the responsible party and we act as its operator, processing information on its behalf and instructions.

2. Information we collect

From business users:

  • Account details: name, email address, phone number, business name and details.
  • Business content you provide: services, prices, FAQ answers, operating hours.
  • Billing information: subscription and payment records (card details are held by Paystack, not by us).
  • WhatsApp Business account identifiers needed to connect your number.
  • Technical data: device information, app version, device push-notification tokens (used only to deliver notifications to your device), notification preferences, and logs of how the service is used.

About customers of business users (as operator):

  • WhatsApp messages sent to and from the business's number, including names and phone numbers.
  • Lead, appointment, and reminder details captured from those conversations.
  • Invoice details: names, contact details, line items, and amounts.
  • Where the business chooses to import it, existing WhatsApp chat history and contacts.

3. Why we process it

  • To provide the service: responding to messages, capturing leads, managing appointments and reminders, creating and sending invoices.
  • To bill business users and manage their accounts.
  • To secure the service, prevent abuse, and comply with Meta's platform policies.
  • To comply with the law (for example, retaining financial records).
  • To improve the service, using aggregated or de-identified information wherever possible.

We process account information because it is necessary to perform our contract with the business user; other processing rests on our legitimate interests, the business user's instructions (as operator), or legal obligations.

4. Automated (AI) processing

Thirdhand uses artificial intelligence to read incoming WhatsApp messages and generate responses on behalf of the business. Message content is processed by our AI service provider (Anthropic) for this purpose, and voice messages are converted to text by our transcription provider (OpenAI). We do not use your message content to train AI models, and our contracts with providers prohibit them from doing so.

5. Who we share information with

We do not sell personal information. We share it only with service providers we need in order to operate:

  • Meta Platforms (WhatsApp Business Platform) — message delivery. WhatsApp's own terms and privacy policy also apply to WhatsApp usage.
  • Paystack — payment processing for subscriptions and invoice payments.
  • Anthropic — AI processing of message content, as described above.
  • OpenAI — converting voice messages to text.
  • Expo (Expo Push Service) and Google (Firebase Cloud Messaging) / Apple (Push Notification service) — delivering push notifications to business users' devices. Notification content may include reminder text and customer names or short message summaries, so that notifications are meaningful; this content passes through these providers' systems in order to be delivered. Business users can limit or switch off each notification type in the app (Settings > Notifications), control what their device shows on the lock screen via their device settings, and choose WhatsApp-only alerts instead of push.
  • Vercel and Neon — infrastructure where our systems and databases run.

We may also disclose information where the law requires it (for example, to a regulator or court), or as part of a sale or restructuring of our business — in which case this policy continues to apply to the information.

6. Cross-border transfers

Some of our service providers, including our hosting, AI, and push-notification delivery providers, store or process information outside South Africa. Where we transfer personal information across borders, we do so under section 72 of POPIA: the recipient is bound by contractual terms that provide substantially similar protection to POPIA, or the transfer is necessary to perform our contract with you.

7. How long we keep it

  • Account information and conversation data: for the life of the account; after account closure (and the 30-day export window in our Terms of Service), deleted or de-identified within 90 days.
  • Invoices and financial records: 5 years, as required by tax legislation, even after account closure.
  • Records of consent and legal notices: as long as needed to demonstrate compliance.

8. Security

We protect personal information with appropriate, reasonable technical and organisational measures, including encryption in transit, access controls that restrict data to each business's own account (tenant isolation), rate limiting, and security review of changes to our systems. No system is perfectly secure; if a breach affects your information we will notify the Information Regulator and affected parties as required by section 22 of POPIA.

9. Your rights

Business users can, at any time:

  • access a copy of their personal information (use the in-app data export, or email us).
  • ask us to correct or delete personal information (account deletion is available in the app under Settings).
  • object to processing, or withdraw consent where processing is based on consent.
  • complain to the Information Regulator (details below).

Customers of business users should direct requests to access, correct, or delete their information to the business they contacted, which is the responsible party. If you contact us directly, we will pass your request to the relevant business and assist it in responding.

10. Direct marketing

We will only send you direct marketing about Thirdhand with your consent or as permitted by section 69 of POPIA, and every message will include a way to opt out. We do not use the customer data we process as an operator for our own marketing.

11. Children

Thirdhand accounts are for business use by people 18 or older. We do not knowingly process children's personal information for our own purposes.

12. Changes to this policy

We may update this policy. Material changes will be announced in the app or by email at least 30 days before they take effect, and the current version will always be available at https://thirdhand.co.za/privacy.

13. Contact and complaints

Questions or requests: raaid@westernambition.co.za | HANDY LABS (PTY) LTD, 19 Burwood Road, Crawford, Cape Town, Western Cape, 7780.

You have the right to complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; complaints.IR@inforegulator.org.za; https://inforegulator.org.za.