Privacy Policy

In POPIA, an operator is the party that processes personal information for a responsible party. On this page, “operator” has that meaning. It does not mean the person who runs a community.

For message content inside a Telegram group or Discord server you connect, you are the controller and the responsible party. Your members are the data subjects. We process that content as your processor and operator, and only on your instructions: to moderate, to answer from your material, to escalate a case to your admins, and to compile your reports.

For the website, the early-access and contact forms, billing records, security logs and optional product email, we are the controller and the responsible party.

Before we process community content in production, the instructions and the duties in this policy form the processing terms between you and us. Those duties are the ones a GDPR processor contract and a POPIA operator agreement require: process only on documented instructions, keep the information confidential, apply appropriate security, use the subprocessors listed below, help you with data-subject requests and with a breach notice, delete or return the information when the service ends, and make available the information needed to show compliance. We will sign a separate data-processing agreement on request through the contact form. Until that document is signed, this section is the written instruction.

When you request early access, we collect your work email, project name, community link or size, and any message you write. We use them to contact you about setting up your free month. We store them securely. We do not sell them or share them for marketing. With that request we store the consent text, the consent-text version, and the time you agreed. The current consent text, version 2026-10-21.1, is: “I agree that Community on Call (Zaber Import Export (Pty) Ltd) may store these details to contact me about my free month, per the Privacy Policy.” To ask for deletion, use the contact form. You can also write to Zaber Import Export (Pty) Ltd, reg. 2016/292563/07, 25 Catherine Street, Pretoria, Gauteng, 0081, South Africa. These records follow the application retention period in section 5. The server may also keep the IP address and user agent of the submission in the security log described there.

When you use the contact form, we process:

• your name and work email
• the project name, community links, platforms and segment
• the member count, daily message estimate and languages you enter
• the note you write about what is hurting the community
• the time you agreed to this policy, and, only if you tick the optional box, the time you agreed to product email

Leaving the product-email box unticked means we do not record a marketing consent. A hidden field on the form is used to reject automated submissions. If you fill it, we discard the application and do not store it as a lead.

When the service is on, we process:

• message content in the communities you connect, including the sender’s platform username and user id, to the extent the platform gives that to the bot
• the FAQ, documents and moderation settings you upload
• moderation actions the bot takes, and the escalation notices sent to your admins
• the weekly and monthly reports generated for you
• billing status once a paid month is agreed: the USD amount, the stablecoin or alternative method used, and the invoice. Prices are in USD. After the free month, payment is made in USD stablecoins (USDT/USDC) as the payment method only. The client pays network fees. There is no automatic charging. Some countries may be served through an alternative payment method. Early-access requests do not include payment details. We do not store card numbers

The website also stores a theme choice (light or dark) in your browser’s local storage, and the server may log an IP address and a user agent to rate-limit forms and to investigate abuse. We do not run advertising cookies, and we do not sell personal information.

We do not ask you to send special-category information (for example health, religion or biometrics). A member’s message might include that kind of information anyway. We process it only to moderate or answer, on your instructions, and we do not use it to build a profile for any other purpose. You must not instruct us to process special-category information unless you have a lawful ground to do so.

We process personal information for a stated purpose, and we do not use it for a further purpose that is incompatible with the one below. Under POPIA that is the purpose specification and further-processing limit. Under the GDPR the legal ground is named in the same row.

• Setting up the free month and then the paid service, including the early-access request you submit. GDPR: steps taken at your request before a contract, and then the contract (Article 6(1)(b)). POPIA: processing needed to carry out a contract with you, or requested pre-contract steps.
• Storing the early-access details so we can contact you about setting up your free month. GDPR: consent (Article 6(1)(a)). POPIA: consent. The stored record includes the consent text, its version, and the time you agreed. You can ask for deletion through the contact form. We do not sell these details or share them for marketing.
• Moderating and answering inside your community, and writing your reports. GDPR and POPIA: we do this as your processor and operator. You choose the lawful ground for your members. For most communities that ground is the legitimate interest in keeping the community usable, or the contract between you and your members. You are responsible for that choice and for telling members.
• Security, rate limits, fraud prevention and debugging a failed request. GDPR: our legitimate interests (Article 6(1)(f)), balanced against the person’s rights. POPIA: the legitimate interest of the responsible party, which a data subject may object to.
• Invoices, tax and accounting. GDPR: the contract and a legal obligation (Article 6(1)(c)). POPIA: a legal obligation and the contract.
• Optional product email. GDPR: consent (Article 6(1)(a)). POPIA: consent. You withdraw it anytime through the contact form. Withdrawal does not affect the service, and it does not affect processing that happened before you withdrew.

We collect the minimum the form and the bot need for those purposes. We do not use community message content to train our own models, and we contractually prohibit the LLM provider from using it to train a general-purpose model.

The bot reads messages in the communities you connect so it can moderate, answer, escalate and report. That is the reason the message content is processed. It is not processed to advertise to members, to score them for other companies, or to contact them outside your community.

You must tell members, in the community rules or a pinned notice, that an automated service processes messages for moderation and answers, and how a member reaches your admins. We will send you short wording for that notice if you ask through the contact form.

Direct messages that members send to each other outside the group are not processed, because the bot cannot see them. Telegram and Discord also process the same messages under their own terms. They are separate controllers of their platforms, not our subprocessors.

We keep personal information only for the period below, then we delete it or irreversibly anonymise it. A longer period applies only where the law requires us to keep a record, or where a record is needed for an open dispute, and only for that record.

• Early-access and contact-form records, including the consent text, its version and the time you agreed: for the life of the request and, if you become a client, for the subscription plus 24 months.
• Marketing-consent records: until you withdraw consent, then for 3 years so we can show what was agreed.
• Message content processed to moderate or answer: 30 days, then deleted or irreversibly anonymised. If a message is part of an open escalation or an abuse review, we keep it until that matter is closed, and then delete it. You may ask for a shorter window through the contact form.
• Documents you upload: for the subscription, then deleted within 30 days after it ends, or sooner if you ask.
• Weekly and monthly reports: for the subscription plus 12 months, so you can still retrieve them.
• Help-desk questions and the automatic reply: 12 months.
• Billing records, once a paid month is agreed: for as long as tax and accounting law requires. If a checkout consent is recorded, that includes the consent text, its version, the amount, and, where we may lawfully store them, the IP address and user agent of the browser that accepted. We do not store card numbers. Prices are in USD. After the free month, payment is made in USD stablecoins (USDT/USDC) as the payment method only. The client pays network fees. There is no automatic charging. Some countries may be served through an alternative payment method.
• Security and rate-limit logs, including IP address: 90 days.
• Theme preference: in your browser until you clear local storage.

We use the following categories of subprocessor. The legal name is completed in this list before that provider processes personal information in production. Each one is bound by a written contract to process only on our instructions, to keep the information confidential, to apply appropriate security, to delete or return it when the work ends, and to pass the same duties to any further subprocessor. For client community content, the contract also prohibits use of that content to train a general-purpose model.

• LLM provider: [TO FILL: LLM provider]. Receives the message text, the documents you upload, and the prompt needed to moderate or draft an answer. The contract prohibits using that content to train a general-purpose model.
• Hosting provider: [TO FILL: hosting provider]. Hosts the website and the systems that run the service.
• Database provider: [TO FILL: database provider]. Stores applications, service settings, reports and the operational records described in this policy.
• Payment processor: [TO FILL: payment processor]. Prices are in USD. After the free month, payment is made in USD stablecoins (USDT/USDC) as the payment method only. The client pays network fees. There is no automatic charging. Some countries may be served through an alternative payment method. Early-access requests do not include payment details. We do not store card numbers.
• Email provider: [TO FILL: email provider]. Sends the reply to an early-access request, a contact-form message, or a service notice.

We remain responsible to you for a subprocessor’s processing of community content under our instructions. If we add or replace a subprocessor that handles community content, we update this page at least 14 days before the change. You may object through the contact form before that date. If we cannot reasonably offer the service without the new subprocessor, you may cancel before the change takes effect.

A subprocessor may process personal information in a country other than the one where you, or a member, live. That can include a country outside the European Economic Area, the United Kingdom and South Africa.

Where the GDPR applies, we transfer personal information only on an adequacy decision, or on Standard Contractual Clauses (and the UK addendum where the UK GDPR applies), together with any extra measure the transfer needs.

Where POPIA applies, we transfer personal information across a border only when section 72 is met. In practice that means the recipient is subject to a law, binding corporate rules or a binding agreement that provides protection substantially similar to POPIA, and the data subject can enforce comparable rights. If another ground in section 72 is the one we rely on, we record it.

We protect personal information with access limited to the systems that run the service, encryption in transit, and separation between communities. No method of transmission or storage is perfect. If we learn of a breach that affects community content, we tell you without undue delay so you can meet your own notice duty. Where we are the controller and the GDPR requires notice to a supervisory authority, we do that within 72 hours of becoming aware, where the breach meets the threshold. Where POPIA section 22 requires notice to the Information Regulator and the data subject, we give that notice.

The theme control stores your light or dark choice in local storage on your device. The site does not set advertising cookies and does not use a third-party analytics cookie. A strictly necessary session or security cookie may be set by the hosting platform so the site can load and so forms can reject abuse. You can clear local storage in your browser. The site still works if you do.

Where the GDPR applies, you have the right to:

• access the personal information we hold about you, and to receive a copy
• correct inaccurate information
• erase information, or restrict processing, in the cases the GDPR allows
• receive portable information you provided to us, where the GDPR requires it
• object to processing based on legitimate interests
• withdraw consent, where consent is the ground
• ask for human review of a decision based solely on automated processing that produces a legal effect or a similarly significant effect

A moderation action inside your community is taken on your instructions. Your admins are the people who review a ban, a restriction or a deleted message. Members should contact those admins first. If a member writes to us, we refer the request to you or we act when you instruct us to. We help you answer that request.

Where POPIA applies, a data subject has the right to:

• ask whether we hold personal information about them, and to request access
• ask for correction or deletion
• object to processing on a legitimate-interest ground
• withdraw consent

We respond to a GDPR request within one month, and to a POPIA request within a reasonable time. We may ask you to confirm that you control the email address on the request. We do not charge a fee unless a request is manifestly unfounded or excessive. We may refuse a request the law allows us to refuse, and we will explain the reason and how to complain.

Send access, correction, deletion, objection and consent requests through the contact form. We reply by email to the address you submit. We do not take these requests by phone, and the form does not book a call.

The information officer of Zaber Import Export (Pty) Ltd receives POPIA requests through that same form. Do not send copies of identity documents unless we ask for them, and then only the minimum needed to confirm it is your request.

You may complain to us first, through the contact form. You also have the right to complain to a regulator.

If the GDPR applies, you may lodge a complaint with a supervisory authority in the place where you live, where you work, or where you believe the issue occurred. If the UK GDPR applies, you may complain to the Information Commissioner’s Office.

If POPIA applies, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za. These complaint rights do not depend on the governing-law clause in the Terms of Service.

This website and this contract are for organisations and adults who administer communities. We do not knowingly offer accounts to children. If your community includes people under 18, you are responsible for the lawfulness of processing their messages, including any parental-consent rule that applies where they live.

A case about child safety, threats, money, legal process, or anything the service is not confident about is escalated to your own admins. We do not run a staffed review of those cases. The free month and the paid service do not include human moderation.

We post changes on this page with a new date. If a change materially affects how we process community content or how we use an email address, we email the address on the account at least 14 days before it applies. Where the law requires consent for the new use, we ask for it first.

Privacy questions and requests go through the contact form. We reply by email to the address you submit. We do not take these requests by phone, and the form does not book a call.

Controller (GDPR) and responsible party (POPIA) for the website and customer records: Zaber Import Export (Pty) Ltd, reg. 2016/292563/07, 25 Catherine Street, Pretoria, Gauteng, 0081, South Africa. The contract for the service is the Terms of Service.