Privacy Policy

Last updated: 23 September 2026

1. Introduction

This Privacy Policy describes how Sigma Mode (Pty) Ltd ("we", "us", "our"), trading as ChatReach, collects, uses, and protects personal information when you use our WhatsApp Business Platform service, including the ChatReach website, dashboard, API, mobile app, and the WhatsApp features we provide inside partner products such as SmartManager ("the Service"). We comply with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African data protection law.

2. Who is responsible for which data

Your account data (the business and people who use ChatReach): we are the responsible party.

Your customers' data (the WhatsApp users your business chats with): your business is the responsible party and we process it on your behalf as an operator, only on your instructions and to provide the Service.

3. Information we collect

Account information: name, email address, company name, phone number, and team member details, needed to create and run your account.

Information from Meta when you connect WhatsApp: when you connect a WhatsApp number through Meta's Embedded Signup (Facebook Login for Business), Meta shares with us, with your permission: your Facebook user ID, name and email (the public_profile and email permissions), your WhatsApp Business Account ID, phone number IDs and display names, your business profile, and an access token that lets the Service manage your WhatsApp assets and send and receive messages for you (the whatsapp_business_management and whatsapp_business_messaging permissions). We use this only to operate your WhatsApp number in the Service.

Message and contact data: messages, media, templates, forms and their answers, and contact details (phone numbers, names, tags, consent records) sent or received through your WhatsApp numbers. This is stored so your team can see conversation history, run campaigns and automations, and view reports.

Payment information: payments are processed by PayFast. We do not store card numbers or banking details; we keep transaction references for reconciliation.

Usage and device data: usage statistics (message volumes, API calls, logins) for billing, security and improving the Service, and, if you use our mobile app, a push notification token for your device.

4. How we use information

We use information to: provide and maintain the Service; send and receive WhatsApp messages for your business; process payments and invoices; send service communications (account and health alerts, billing notices); provide support; keep the Service secure; comply with law; and improve the Service using aggregated usage information. We do not use your customers' data for our own marketing, and we do not sell personal information.

5. Who we share information with

We share information only with:

  • Meta Platforms (WhatsApp), to send and receive messages through the WhatsApp Cloud API. Where you choose local storage, Meta stores message content at rest in the selected region (for example South Africa). Meta's own terms and privacy policy govern its processing.
  • Partners you use ChatReach through, such as iX Online Motoring's SmartManager, to show your conversations and create leads inside that product for your business only.
  • OpenAI, only when your business switches on AI features (reply suggestions, summaries, the AI assistant). The relevant conversation text is sent to generate the result. OpenAI does not use API data to train its models.
  • Google Firebase Cloud Messaging, to deliver push notifications to our mobile app. Notifications contain minimal message details.
  • PayFast, for payment processing.
  • Authorities, only when required by valid South African legal process.

6. Security

We protect data with: TLS encryption for all data in transit; hashed passwords and API keys; signed and verified webhooks; strict per-business data isolation; access to WhatsApp access tokens limited to the systems that need them to send messages; and regular security reviews. No system is perfectly secure, and we will notify you and the Information Regulator of any security compromise as POPIA requires.

7. Retention

Account data is kept while you are a customer and for 12 months afterwards. Message data is kept for 24 months unless your business sets a shorter retention period in its settings, after which message text and media are removed; consent records are kept as proof of opt-in. Financial records are kept for 5 years as South African tax law requires.

8. Your rights under POPIA

You may ask to access, correct or delete your personal information, object to processing, and withdraw consent. If you are a customer of a business that uses ChatReach, please contact that business first; we will help them respond. You may also complain to the Information Regulator (inforegulator.org.za).

9. Deleting your data

To have your data deleted, including data we received from Facebook or WhatsApp, follow the steps on our Data Deletion page.

10. Information Officer

Sigma Mode (Pty) Ltd's Information Officer can be contacted at info@sigmamode.co.za for any privacy request or question.

11. Changes to this policy

We may update this policy. Material changes will be emailed to registered users before they take effect.

12. Contact

Sigma Mode (Pty) Ltd
Gauteng, South Africa
info@sigmamode.co.za