Privacy Policy.

Wozzel is a trading name of The Business Zone 1343 CC, registration number 2006/009864/23, of 122 Oostewal Road, Langebaan, Western Cape, 7357, South Africa.

Our Information Officer is Brett David Griffin, reachable at support@wozzel.ai.

1. Two roles

Wozzel holds two kinds of information, and our role is different for each.

People who use Wozzel. If you sign in to Wozzel as a member of a business, we are the responsible party for your account information. This policy applies to you directly.

Customers of a business that uses Wozzel. A business puts its customers, enquiries, quotes and mail into Wozzel. For that information the business is the responsible party and we are its operator under POPIA: we process it only to run Wozzel for that business, on its instructions. If you are a customer of a Wozzel business and want to know what it holds about you, ask that business first. We will help it answer.

2. What we hold

Your account. Your name, work email address, password (stored as a one-way hash, never readable), role and business. If you turn on two-step sign-in, we keep the secret your authenticator app uses, encrypted, and your recovery codes as one-way hashes. When you sign in we record the time, your last activity and the page you were on. If you turn on notifications on your phone or browser, we keep the subscription that lets us send them.

Your business’s records. Customers and contacts, enquiries, quotes with their prices and history, your product catalogue, documents you upload, and the conversations you have with Wozzel.

Connected mailboxes. If an owner connects Microsoft 365, Wozzel reads new mail in the mailboxes the owner chooses, every few minutes, and can send from them when a person approves. Microsoft grants this through an application permission your Microsoft administrator consents to (read and write mail, send mail, and read the list of users so mailboxes can be matched to people). We store the access Microsoft grants encrypted. If an owner connects a Gmail mailbox, they enter an app password that we store encrypted and use over IMAP and SMTP. Mail bodies we store are encrypted at rest. Attachments stay in your mailbox; Wozzel fetches a file only when someone opens it, and copies one only when a person passes a lead with files to a partner business.

Your website visitors.When someone chats with your website’s Wozzel widget or fills in a form, we store what they typed and the details they gave (name, email, phone). The widget keeps the visitor’s conversation in their own browser storage so it is still there when they come back. We do not record a visitor’s IP address or browser in the conversation.

Quote opens. A quote emailed through Wozzel carries a tiny tracking image. When the recipient opens the email, Wozzel records the time, the IP address and the browser that opened it, and marks the quote Viewed. This is the one place Wozzel itself records an IP address.

What Wozzel learns. To work the way you do, Wozzel keeps short notes about how you like to work and about your business, built from what you tell it and what it observes, each with a confidence score. It also stores the summaries and suggested actions it writes for inbox items. You can ask us to see or delete these.

Activity and security log.We keep a log of what happened in your business: who changed a role, who added an owner, who sent what, when mail synced. Entries hold ids and role words, not message text. Sensitive changes, such as a new owner or a change to banking details, also go by email to your business’s admins and to security@wozzel.ai.

Payments. When you buy credits we keep the payment reference, the amounts in USD and rand, the exchange rate, VAT, the payment method (card or EFT), and the email the payment was made under. If an owner saves a card for automatic top-up, we keep the last four digits, the card brand and the expiry, plus an encrypted card reference Paystack gives us. We never see or store the card number. Tax invoices are kept for the period tax law requires.

Platform logs. Our hosting provider keeps request logs that include IP addresses, for a limited period, for security and fault-finding.

3. Why we use it

• To run Wozzel for your business: the inbox, quotes, website, chat and the AI partner. This is needed to provide the service you asked for.
• To keep accounts safe: sign-in, two-step sign-in, roles, the owner gate, security emails, rate limits and the activity log. This is our legitimate interest in running a secure service and yours in a safe account.
• To bill you and keep tax records. This is needed to perform our contract and to meet tax law.
• To answer you when you write to us.

We do not sell personal information, and we do not use it for advertising. We do not send marketing to our users; the only emails you get from Wozzel are about your account, your business’s activity, security and billing.

4. AI

Wozzel’s AI runs on models from Anthropic, under Wozzel’s own account. When Wozzel does work for you, the information needed for that piece of work is sent to Anthropic: the conversation, the records you attached, the inbox item being read, the document you asked about, or the website chat and what you have taught the bot. Anthropic processes it to return the answer, under commercial terms that do not allow it to train on your data.

Wozzel never sends your card details, passwords or mailbox credentials to an AI model. The website chatbot is never given your buying prices or your suppliers. A supplier’s buying prices never cross into a partner business.

5. Who else processes it

We use a small number of providers to run Wozzel. Each one processes information only to provide its service to us.

A business can also connect its own email delivery service (Resend, SendGrid or SMTP). That is the business’s own account with that provider, used on the business’s instructions.

6. Where it is stored and cross-border transfers

Wozzel’s application servers run in Washington, D.C., USA. The database is in Amsterdam, Netherlands, and uploaded files are stored in Frankfurt, Germany. POPIA allows this where the recipient is bound by terms that protect the information in a way substantially similar to POPIA. Our providers are bound by their data processing terms and by contract with us. We do not claim that your data is held in South Africa.

7. Keeping it safe

• Everything travels over HTTPS.
• Passwords are hashed. Mailbox credentials, connection secrets and stored mail bodies are encrypted at rest with AES-256-GCM.
• Anyone can turn on two-step sign-in with an authenticator app, and business owners must use it.
• A sign-in lasts seven days from your last activity.
• Every request is scoped to your business on the server. Personal mailboxes are visible only to their owner, admins included. Owner-only actions ask the owner to confirm who they are again.
• Sensitive changes trigger a security email to your admins and to security@wozzel.ai.
• Public routes are rate-limited by a web application firewall.

No system is perfect. If you believe something is wrong, write to security@wozzel.ai.

8. How long we keep it

• Your business’s records: for as long as your business uses Wozzel.
• Mail from a connected mailbox: while the mailbox stays connected; a removed member’s mail and mail Wozzel can no longer see are deleted after 30 days.
• Tax invoices and payment records: for the period tax law requires.
• Request logs at our hosting provider: for a limited period.
• After your business stops using Wozzel: we delete its data 30 days after it leaves, except what we must keep by law. Copies in backups roll off on our hosting provider’s schedule. Until then a business can ask for a copy of its data, which we send as spreadsheets within 10 working days.

9. Your rights

Under POPIA you can ask us to tell you what we hold about you, correct it, delete it, or stop using it, and you can object to processing based on our legitimate interests. Write to support@wozzel.ai. We will answer within a reasonable time and in any case within the period POPIA allows.

If you are a customer of a business that uses Wozzel, that business is the responsible party. Ask it first; if you cannot reach it, write to us and we will pass your request on.

You can also complain to the Information Regulator (South Africa): inforegulator.org.za/contact-us.

10. Cookies and browser storage

The Wozzel website (www.wozzel.ai) sets no cookies and uses no analytics or advertising trackers. The chat widget in the corner keeps your conversation in your browser’s local storage so it is there when you come back.

The Wozzel app sets a sign-in cookie, and a short-lived cookie during the Microsoft 365 connection flow. The app and the phone app also use browser storage to remember your settings and drafts on your own device.

11. Children

Wozzel is for businesses. It is not meant for anyone under 18, and we do not knowingly hold information about them.

12. Direct marketing by businesses

Businesses that use Wozzel to email their customers are responsible for following POPIA’s direct-marketing rules. Wozzel sends nothing on a business’s behalf until a person in that business approves it.

13. Changes

If we change this policy we will email your business’s owners and update the date at the top. The Terms say how Wozzel is provided.

14. Contact

The Business Zone 1343 CC, trading as Wozzel
122 Oostewal Road, Langebaan, Western Cape, 7357
Privacy and support: support@wozzel.ai
Security: security@wozzel.ai