1. Introduction
This Privacy Policy describes how Sigma Mode (Pty) Ltd ("we", "us", "our"), trading as ChatReach, collects, uses, and protects personal information when you use our WhatsApp Business API platform ("the Service"). We are committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection legislation.
2. Information We Collect
Account Information: When you register, we collect your name, email address, company name, and phone number. This is necessary to create your account and provide the Service.
WhatsApp Configuration: You provide your Meta/WhatsApp Business Account credentials (WABA ID, access tokens) to connect the Service to your WhatsApp account. These credentials are stored encrypted in our database and are never shared with third parties.
Message Data: Messages sent and received through the platform are stored to provide conversation history, analytics, and reporting. Message content is accessible only to the tenant (your business) and is not accessed by Sigma Mode except for technical support purposes with your explicit consent.
Contact Data: Customer contact information (phone numbers, names) imported or received via WhatsApp is stored on behalf of your business. You are the data controller for your customer data; we are the data processor.
Payment Information: Payments are processed by PayFast (a PCI DSS Level 1 compliant payment gateway). We do not store credit card numbers or banking details. We store transaction references for reconciliation purposes.
Usage Data: We collect anonymised usage statistics (message volumes, API call counts, login times) to improve the Service and generate billing reports.
3. How We Use Your Information
We use your information to: provide and maintain the Service; process payments and generate invoices; send service-related communications (account alerts, billing notifications); provide customer support; comply with legal obligations; and improve the platform based on aggregated, anonymised usage patterns.
4. Data Sharing
We do not sell your personal information. We share data only with: Meta/WhatsApp — as required to send and receive messages via the WhatsApp Cloud API (Meta's own privacy policy governs their processing); PayFast — for payment processing; and law enforcement — only when required by valid South African legal process.
5. Data Security
We implement industry-standard security measures including: PBKDF2 password hashing (100,000 iterations, SHA-256); HMAC-SHA256 webhook signature verification; TLS encryption for all data in transit; per-tenant data isolation in the database; API key hashing (SHA-256); and regular security audits.
6. Data Retention
Account data is retained for the duration of your subscription plus 12 months. Message data is retained for 24 months unless you request earlier deletion. Financial records are retained for 5 years as required by South African tax legislation (Income Tax Act, VAT Act).
7. Your Rights Under POPIA
You have the right to: access your personal information; request correction of inaccurate data; request deletion of your data (subject to legal retention requirements); object to processing; and withdraw consent. To exercise these rights, contact us at info@sigmamode.co.za.
8. Information Officer
Sigma Mode (Pty) Ltd's Information Officer can be contacted at info@sigmamode.co.za for any POPIA-related queries or requests.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. Continued use of the Service after changes constitutes acceptance.
10. Contact
Sigma Mode (Pty) Ltd
Gauteng, South Africa
info@sigmamode.co.za