Product Privacy Notice

Plain-language notice, not yet reviewed by an admitted attorney. It is written to meet the requirements of South Africa's Protection of Personal Information Act, 2013 (POPIA). We will update it after legal review.

Who is responsible

LeBitsi AI is the responsible party for the accounts people use to sign in to our products and for everything held in LeBitsi AI Life. Where an organisation uses LeBitsi OS, LeBitsi Resolve, LeBitsi CRM or the AI Employee to process information about its own customers or staff, that organisation is the responsible party and LeBitsi AI acts as its operator (POPIA section 21): we process that information only on the organisation's instructions and under a written agreement. Information Officer: Makhuto Mabitsela. Contact for all privacy matters: support@lebitsi.com.

What each product processes

Every product: your name, email address, role and sign-in records. Passwords are stored only as secure hashes, and new passwords are checked against known data breaches without sending the password anywhere.
LeBitsi OS: missions, the work and approvals recorded against them, and an audit trail of who did what.
LeBitsi Resolve: tickets, incidents and change requests, including the requester's name and contact details, the messages exchanged, and service-level timings.
LeBitsi CRM: leads, contacts and organisations, meetings, proposals, and the emails sent from it. Each lead records the privacy notice version that applied when it was created.
AI Employee: the tasks staff give it, and the records it reads from OS, Resolve and the CRM, only within the permissions the organisation grants. It sends its owner notices and a daily briefing by email.
LeBitsi AI Life: your goals, plans, habits, tasks, study and career records, journal entries, savings goals and the transactions you choose to add, and, if you use them, mood and recovery logs.

Special personal information in LeBitsi AI Life

Mood and recovery logs, and anything you write about your health in your journal, can reveal information about your health. POPIA treats this as special personal information (section 26). We process it only with your explicit consent (section 27(1)(a)), which you give when you create your account. Recording it is optional: you can leave those modules switched off, delete entries, and withdraw your consent at any time by writing to us. Withdrawing consent does not affect processing that took place before.

Artificial intelligence

LeBitsi AI Life and the AI Employee send the text needed for a task to AI models. These run on Cloudflare Workers AI. An organisation's administrator can also switch on Groq or Google Gemini for the AI Employee; neither is used unless switched on. Only the information the task needs is sent. No decision with legal or similarly significant effect on a person is made by automated means alone (section 71): actions that reach a customer or change another system wait for a person's approval, unless the organisation's administrator switches on a specific, limited automation.

Service providers and where information is kept

We use these operators, who process information on our instructions only: Cloudflare (hosting, security and Workers AI, for all products); Neon (databases for LeBitsi OS and LeBitsi Resolve, in London, United Kingdom); Supabase (databases for LeBitsi CRM and LeBitsi AI Life, in London, United Kingdom); Resend (email delivery). Cloudflare, Resend and, if switched on, Groq and Google may process information in other countries, including the United States. We transfer information outside South Africa only to providers bound by data protection law or contractual terms that give protection substantially similar to POPIA (section 72). We do not sell personal information.

How we protect it

Data travels over encrypted connections; access is restricted by role and organisation; important actions are recorded in audit trails; sign-in is protected against automated attacks; and staff see only what their role needs. If we believe personal information has been accessed without authorisation, we will notify the people affected, the responsible organisation where we are its operator, and the Information Regulator, as POPIA section 22 requires.

How long we keep it

Organisation data is kept for as long as the organisation uses the product and then returned or deleted as agreed. In the CRM, leads that do not become customers are reviewed for deletion or anonymisation after the retention period the organisation sets. In LeBitsi AI Life, your information is kept until you delete it or close your account.

No marketing

Our products send only service emails, such as sign-in links, invitations, notices and briefings. They never send marketing (section 69).

Your rights

You may ask whether we hold information about you and for a copy of it, ask us to correct or delete it, object to its processing, and withdraw consent. In LeBitsi AI Life you can download all your data yourself from Settings. If your information is held by an organisation that uses our products, contact that organisation first; we will help it respond. Write to support@lebitsi.com; we will confirm your identity before acting and respond within a reasonable time. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.

Children

Our products are not directed at children under 18, and we do not knowingly collect their information.

Changes

We may update this notice. The current version and its date are always published on this page.