Privacy Policy

1. Responsible party

Lonwabo Petse, trading as TechnoMagic Innovations, is the responsible party (data controller) for the AIACTION service. This notice explains processing in the South African POPIA context; it is not a certification of compliance.

Formal Information Officer designation and any required registration remain to be confirmed before commercial launch. Meanwhile, direct privacy requests to the operator using the public phone or business/contact address above.

2. What we collect

Needed for the core service

• Account: email, display name, sign-in identifiers (including Google sign-in if you use it).
• Preferences: language, simple-language and accessibility settings, country, display currency.
• Conversations and actions: what you type or say (as text), AIA's replies, detected language, action plans, confirmations and results.
• Consent records: which Terms/Privacy version you accepted and when, and your marketing choice.
• Security and audit records: sign-in, permission, action and security events, and suspected prompt-injection attempts.
• Support and reports: information you submit about account issues, privacy, harmful content, security or intellectual-property concerns; used to investigate and respond. Browser, device, IP address and request information may be processed by service providers for delivery and security.
• Billing: plan, subscription status, credit balance and provider transaction references. We never receive or store card details.

Optional — only when you use the feature

• Voice: speech is converted to text by your browser's speech service; we store the text, not audio. Pronunciation recordings are stored only when an admin saves one.
• Location: only if you allow it in chat. AIA receives your approximate device location (about 1 km) to answer nearby-type questions; it is sent with that request and not saved — see section 3.
• Documents, projects and memory you choose to save. Memory can be turned off in Settings.
• Product analytics — we do not currently run any analytics service; the Settings switch records your preference for the future.

The current service does not automatically access your contacts, calendar or advertising identifiers. Content you choose to upload or type may itself include personal information; only provide information you have permission to share. Future integrations needing additional access require permission and updated disclosures.

3. Location

When you allow it in chat, AIA can use your device location so it can answer location-related requests without asking where you are each time. The app sends only an approximate position (about 1 km) with the specific request you make; it is not stored, and it is not used for advertising or sold. Your choice is kept in your browser and you can change or withdraw it at any time in your browser settings. You can also decline — AIA then simply asks for the area you are asking about. Turning location off does not limit the rest of the service.

4. Why we use it (lawful basis)

• To provide the Service and carry out actions you ask for — performance of our contract with you.
• To keep accounts secure, prevent fraud and abuse — legitimate interest and legal obligation.
• To bill you and keep tax records — contract and legal obligation.
• Analytics and marketing — only with your consent, which you can withdraw at any time.
• Support messages and rights requests — to respond, investigate and meet applicable legal obligations; contract performance, legitimate interests and legal obligation as appropriate.

5. AI processing and automated decisions

To generate replies, your message and relevant conversation context are sent through the built-in Lovable AI gateway to its model service. That gateway is the current AI service; switching to a separately configured provider is disabled. Provider retention, downstream model recipients and training terms must be confirmed before commercial launch; this notice does not promise zero retention or no training by providers. Do not submit secrets or sensitive material you are not authorised to share.

AIA outputs can be inaccurate. High-impact actions require explicit confirmation; outputs are not regulated professional advice. Contact the operator to request human review of a concern.

6. Who processes it

• Lovable Cloud — current hosting, database, authentication and file storage service providers, for delivering and securing the service.
• Lovable AI gateway and its model service — for generating replies from messages and relevant context. Downstream processing details require confirmation before launch.
• Paddle.com — Merchant of Record for sales, subscriptions, payments, tax and invoicing.
• Google — only if you choose "Sign in with Google".
• Apple — where an enabled Apple sign-in or future native App Store purchase is used; native distribution and purchase approval are not complete.
• Professional advisers, and authorities where the law requires.

A provider register is being completed for commercial launch; this is not a claim that all downstream recipients have been verified. The service is not offered as a personal-data resale service.

7. Cross-border transfers

Service providers may process information outside South Africa. Exact processing locations and appropriate contractual or other transfer safeguards must be confirmed before commercial launch. The operator must assess applicable cross-border requirements, including POPIA section 72; this page does not assert that an unverified provider agreement already meets them.

8. How long we keep it

• Account, conversations, documents, actions: while your account is active; deleted when a verified deletion request is processed.
• Consent records, security and audit logs: kept as evidence for as long as needed for legal and security purposes after account closure.
• Payment and tax records: kept as required by tax law (generally 5 years in South Africa).

Deletion requests are verified by an administrator, then processed by the deletion worker. Retained account references are pseudonymised and core personal content is removed; limited payment, consent and security evidence may remain where genuinely necessary. Exact retention periods and provider backup-deletion timing require legal/provider confirmation. Records should be deleted or anonymised when no longer needed; no fixed completion timeframe is promised.

9. Security

The operator is committed to appropriate technical and organisational safeguards, including access controls and encryption where appropriate. This is not an independently audited encryption, certification or security guarantee. No system is perfectly secure. Potential incidents should be reported to the operator, who must assess applicable notification obligations, including those under POPIA.

10. Your rights

You may request access, correction or deletion, object to processing and withdraw optional consent, subject to applicable law and necessary retention. You may complain to the Information Regulator. Use Settings to export your data (JSON) or request deletion, or contact the operator. Identity verification may be necessary; do not send identity documents unsolicited. Rights available in other regions can be requested through the same contact, without implying certification under those laws.

11. Children

AIACTION is not designed for children. Users under 18 need a parent or guardian's consent; children under 13 may not use it. If we learn a child's data was collected without consent we will delete it.

12. Marketing

We only send marketing with your opt-in consent, separate from accepting the Terms. Every message has an unsubscribe option, and you can switch it off in Settings.

13. Cookies and local storage

Essential browser storage keeps you signed in and remembers settings. No app-run analytics or marketing-cookie service is currently enabled; the analytics setting records a preference for future use, not consent to an already active tracker. Third-party sign-in and checkout services may use their own necessary storage under their notices. You can manage site storage in your browser; removing it can sign you out. Optional marketing preferences can be withdrawn in Settings.

14. Deleting your account

In the app: Settings → Your data → Request account deletion. Without the app: see the account deletion page.

15. Changes

We record each version. Material changes are shown in the app and you will be asked to accept again before continuing.