This Privacy Policy explains how BozzApp ("we", "the Service") and each business using it ("you", "the business") handle personal information, under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). It applies to business owners and admins, their team members (managers, finance users, job card users, field workers), and clients or other third parties whose details a business enters into BozzApp.
BozzApp is the Responsible Party for personal information collected to operate the platform itself — business owner account details, billing records, platform usage logs. For the client and team member data a business enters into BozzApp while using it, BozzApp acts as an Operator: the business itself is the Responsible Party. See section 4 for what this split means in practice.
Contact our Information Officer at antonmenne@gmail.com.
| Category | Examples | From whom |
|---|---|---|
| Account & business info | Owner's name, email, phone, company name, VAT number, address | Business owner, at signup |
| Team member info | Name, email, phone, role, department | Business owner/manager, when inviting a team member |
| Client info | Name, contact details, site address, job/equipment details | Entered by the business |
| Job & financial records | Job cards, quotes, invoices, price lists, photos, signatures | Business and team members |
| Worker location | Check-in/check-out GPS coordinates against a job | Field worker's device, during an active job |
| AI feature data | Chatbot conversations, uploaded manuals/training documents, AI-generated answers | Team members using Training or the Troubleshooting Assistant |
| Payment info | Subscription plan, billing cycle, payment status | Processed by PayFast — we never see or store card numbers |
| Technical logs | Error logs, activity logs, device/app version | Automatically, while using the app |
We only process personal information for a specific, defined purpose, consistent with POPIA's conditions for lawful processing: running the service (performance of our contract with the business), billing via PayFast (performance of the contract), worker location tracking (the business's legitimate interest in verifying attendance, disclosed to the worker before use), AI features (performance of the contract or legitimate interest in a feature the business opted into), security and fraud prevention (legitimate interest and legal obligation), and support (consent/legitimate interest). We do not sell personal information, and never use client or team member data for purposes unrelated to operating BozzApp.
When you enter your own clients' or team members' personal information into BozzApp, you are the Responsible Party for that data under POPIA, and BozzApp is your Operator — we process it only on your instructions and for the purpose of providing the service to you. This means you must have a lawful basis for collecting and entering that information, you're responsible for telling your own clients and team members how their information is used and for responding to their POPIA requests, and you must only use worker location data for legitimate attendance/job-verification purposes and tell your workers it's being collected. We process this data securely and only as instructed.
| Processor | Role | Location |
|---|---|---|
| Google Firebase / Google Cloud | Hosting, database, authentication, file storage, push notifications | Google Cloud |
| Anthropic (Claude) | Training Q&A, quiz generation, device identification from photos | United States |
| OpenAI | Troubleshooting Assistant replies and web-search manual lookups | United States |
| PayFast | Subscription and add-on payment processing | South Africa |
Where personal information is transferred outside South Africa, we rely on POPIA section 72: these providers are bound by data processing terms and safeguards at least equivalent to POPIA's conditions. We never share personal information with any other third party, and never for that third party's own marketing.
Under POPIA, every data subject has the right to be told what information is held about them and why, request a copy of it, request correction of inaccurate information, request deletion of information no longer needed for its original purpose, object to processing (including direct marketing), and lodge a complaint with the relevant Information Officer or with the Information Regulator of South Africa if unsatisfied with the response. A team member or client should direct a request to the business they deal with directly; we assist that business in responding within POPIA's required timeframes.
We do not use client or team member personal information for direct marketing. If we email a business owner about new features or offers, we rely on the existing customer relationship (POPIA section 69(3)) and always offer an unsubscribe option. We never market to a business's own clients or team members on its behalf without explicit instruction.
If we become aware of a security compromise that has, or may have, led to unauthorised access to personal information, we investigate and contain it as quickly as possible, notify the Information Regulator and affected businesses as soon as reasonably possible, and help affected businesses notify their own clients/team members where POPIA requires it.
BozzApp is a business tool, not intended for use by children. We do not knowingly collect personal information from children under 18, other than where a business records a client's minor dependant's name against a job — which falls under that business's own Responsible Party obligations, not ours.
We may update this Privacy Policy as the service changes. We'll notify business owners of material changes by email or an in-app notice before they take effect.
Questions about this policy, or POPIA requests, can be sent to antonmenne@gmail.com or via WhatsApp at +27 64 430 9599. You may also contact the Information Regulator of South Africa, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.