Data processing terms

You (the business using Howsit) are the responsible party for the personal information of your customers, contacts and staff that you process through Howsit, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).

Howsit acts as your operator. We process that personal information only on your documented instructions — which include your use of the Howsit product — and for no other purpose.

Contact details (names, phone numbers, platform user IDs, email addresses), message content and media exchanged on WhatsApp, Instagram and Messenger, custom fields and tags you create, consent records, and usage metadata such as delivery and read status.

You will only message people who have opted in, in line with POPIA section 69 and Meta's Business Messaging policies, and you will keep evidence of that consent. Howsit records opt-in and opt-out events and blocks marketing sends to contacts without opt-in, but you remain responsible for the lawfulness of the consent you collect.

You will honour data subject requests. Howsit provides per-contact export and deletion to help you do so.

We apply appropriate, reasonable technical and organisational measures (POPIA section 19), including encryption of access tokens and secrets at rest, encryption in transit, role-based access, two-factor authentication, audit logging and strict logical separation between workspaces.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a security compromise affecting your personal information (POPIA section 22).

We use Meta Platforms (WhatsApp Business Platform, Instagram and Messenger APIs) to deliver messages, an AI model provider to generate AI agent replies, payment processors (Paystack, PayFast) for billing, and cloud hosting providers. We bind each to obligations no less protective than these terms. Some of these process information outside South Africa under POPIA section 72 safeguards.

We keep your workspace data for as long as your workspace is active. When you delete a contact we delete their personal information, except where we must retain records by law (for example tax invoices). When you close your workspace we delete or anonymise your data within 30 days, unless you ask us to export it first.

Data subjects may lodge complaints with the Information Regulator (South Africa). We will cooperate with you and the Regulator on any enquiry relating to processing we perform for you.