Privacy Policy

SmartChat Privacy Policy

Last updated 1 January 2026.

We take privacy seriously. This explains, in plain language, what we do with your data and your end users' data. Ruka (Pty) Ltd, registration number 2024/761584/07, is the responsible party for the account data we hold about you. For the data you put through SmartChat about your own customers, you are the responsible party and we are your operator.

What we collect

• Account data: your name, email, business name, and billing details.
• Conversation data: messages exchanged through SmartChat, which is needed to deliver the service.
• Technical data: logs, device and usage information, for security and debugging.

Why we process it, and our lawful basis

• To provide the service and bill you, on the basis of our contract with you.
• To keep the service secure and to comply with the law, on the basis of our legal duties and legitimate interest.
• For end-user conversation data, we process only on your instruction as your operator.

Special personal information

Some customers, such as health clinics, process health information through SmartChat, and the service supports this. Health and other special personal information carry extra duties. If you process it, you must have a proper legal basis and, where the law requires, explicit consent. We protect it with our full security measures plus tighter access limits, and our Data Processing Agreement sets out how we handle it.

Who we share it with

We use trusted providers who process data on our behalf:

• Google Cloud (Johannesburg region) for hosting.
• Meta Platforms (WhatsApp) when you send or receive WhatsApp messages.
• Google Analytics for understanding how our website is used.
• Any other tools you connect, such as calendars or CRMs.

We do not sell your data, we do not share it with advertisers, and we do not use your data to train public AI models.

Where we keep it

We store your account and conversation data on Google Cloud in the Johannesburg region, on South African soil. Messages you send or receive over WhatsApp are also processed by Meta under Meta's own terms, which may involve processing outside South Africa. We do not control Meta's infrastructure. We do not yet serve European customers. Before we do, we will put the right transfer safeguards in place, including Standard Contractual Clauses for moving European data to South Africa.

How long we keep it

Conversation data is kept while your account is active. After cancellation we delete it within 90 days, unless the law requires us to keep it longer.

Your rights

Under POPIA, and under the GDPR if you are in the EU, you can ask to access, correct, or delete your data, and you can object to certain processing. Write to privacy@ruka.africa. If you are not satisfied, you may complain to the Information Regulator of South Africa, or to your EU supervisory authority.

Security

We protect data with encryption in transit and at rest, role-based access control, and audit logs. If a breach affects you, we will tell you as soon as reasonably possible and help you meet your own notification duties.

Changes

We may update this policy. We will change the version number and the date, and we will tell you about material changes.

Contact: privacy@ruka.africa. Information Officer: Dean Kabasa, Chief Operating Officer, dean@ruka.africa.