Privacy Policy

1. Introduction

Service OS (Pty) Ltd (“Service OS”, “we”, “us”, or “our”) operates the Service OS platform, a business management tool for South African trade companies (the “Service”).

This Privacy Policy explains what personal information we collect, how we use it, and the rights you have under the Protection of Personal Information Act, 2013 (“POPIA”) and other applicable laws. By using the Service you agree to the practices described here.

If you do not agree with this policy, please do not use the Service.

2. Information We Collect

Account and profile information

• Name, email address, and password when you register.
• Company name, VAT number, and business address.
• Mobile phone number (used for WhatsApp notifications).
• Your role within the company (owner, manager, or field worker).

Business and operational data

• Job records: descriptions, statuses, scheduling dates, and assigned team members.
• Client records: names, contact details, and addresses.
• Quotes and invoices: line items, amounts, and payment statuses.
• Team member profiles and assignment records.

WhatsApp and messaging data

• Phone numbers used to send and receive WhatsApp messages via the Meta Cloud API.
• Message content and delivery status logs.
• Button payloads and reply content when you interact with automated messages.

Technical and usage data

• IP address, browser type, and device information.
• Pages visited, features used, and session duration.
• Error logs and diagnostic data.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Send WhatsApp notifications about jobs, invoices, and business summaries you have configured.
• Generate SARS-compliant quotes and invoices on your behalf.
• Authenticate users and manage access to company accounts.
• Respond to support requests and provide customer service.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations, including POPIA and tax regulations.
• Send service-related communications (e.g. billing, security alerts).

We do not use your data for advertising, and we do not sell or rent your personal information to any third party.

4. WhatsApp and Meta Integration

The Service integrates with the Meta Cloud API (WhatsApp Business API) to deliver automated notifications to your registered WhatsApp number and to your team members' numbers that you provide. By enabling WhatsApp notifications you acknowledge:

• Phone numbers and message content are transmitted to Meta Platforms, Inc. in accordance with Meta's WhatsApp Privacy Policy.
• You are responsible for obtaining valid consent from team members and clients before adding their phone numbers to the Service.
• You must use WhatsApp notifications only for legitimate business communications and in compliance with Meta's Business Policy.
• Service OS retains logs of sent messages (phone number, message type, delivery status) for operational and audit purposes.

5. How We Share Your Information

We share personal information only in the following circumstances:

• Service providers: We use Supabase (database hosting), Vercel (application hosting), and Meta (WhatsApp delivery). These providers process data on our behalf under confidentiality obligations.
• Legal requirements: We may disclose information when required by law, court order, or regulatory authority, including SARS requests.
• Business transfers: If Service OS is acquired or merges with another entity, your information may be transferred as part of that transaction.
• With your consent: We will share information in any other circumstance only with your explicit consent.

We do not sell, trade, or rent personal information to third parties for marketing purposes.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Business records (invoices, quotes, job records) are retained for a minimum of five years to comply with SARS record-keeping requirements.

WhatsApp message logs are retained for 12 months. When you close your account, personal profile data is deleted within 30 days, subject to legal retention obligations.

7. Data Security

We implement industry-standard security measures including TLS encryption in transit, encryption at rest, row-level security in our database, and role-based access controls. Access to production systems is restricted to authorised personnel.

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security of your information.

8. Your Rights under POPIA

As a data subject under POPIA, you have the right to:

• Access the personal information we hold about you.
• Correction of inaccurate or incomplete information.
• Deletion of your personal information, subject to legal retention requirements.
• Object to the processing of your personal information.
• Complain to the Information Regulator of South Africa if you believe your rights have been violated.

To exercise any of these rights, contact us. We will respond within 30 days.

9. Cookies and Tracking

The Service uses essential session cookies to authenticate users and maintain login state. We do not use advertising cookies or third-party tracking pixels. You can disable cookies in your browser, but this will prevent you from logging in.

10. Children's Privacy

The Service is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

Service OS (Pty) Ltd
South Africa
WhatsApp: available via the contact details on our website

Information Regulator (South Africa): inforegulator.org.za