Last updated: 12 March 2026

Privacy Policy

This privacy policy explains how AmbitX.ai (Pty) Ltd ("AmbitX", "we", "us", or "our"), operating the Conversio platform ("the Service"), collects, uses, stores, and protects your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) of the Republic of South Africa.

1. Personal Information We Collect

We collect the following categories of personal information when you use Conversio:

• Contact details: Full name, email address, phone number (in E.164 format)
• WhatsApp messages: Message content, timestamps, delivery and read receipts exchanged through the platform
• Lead data: Lead scores, qualification status, pipeline stage, assigned staff member, and sales activity history
• Account information: Organisation name, billing details, user roles and permissions
• Device and usage data: Browser type, IP address, pages visited, feature usage patterns, and session duration
• Consent records: Opt-in and opt-out timestamps, consent method, and policy version accepted

2. Why We Collect Your Information

We process your personal information under the following lawful bases as defined by POPIA Section 11:

• Contractual necessity: To provide the Conversio CRM service you have subscribed to, including lead management, message routing, and staff assignment
• Legitimate interest: To improve our platform, detect fraud, ensure security, and provide customer support
• Consent: For optional features such as marketing communications and analytics tracking, where we obtain your explicit opt-in consent
• Legal obligation: To comply with applicable laws, regulations, and lawful requests from authorities

3. How We Use Your Information

Your personal information is used for the following purposes:

• Automated lead qualification and scoring using AI models
• Smart routing of leads to the appropriate sales staff
• Sending and receiving WhatsApp messages on your behalf via the WhatsApp Business API
• Sequence-based automated follow-up messaging
• Generating sales analytics, pipeline reports, and performance dashboards
• Processing subscription payments and managing billing
• Providing customer support and resolving technical issues
• Improving the Service through anonymised usage analytics

4. Who We Share Your Information With

We do not sell, rent, or trade your personal information. We share data only with the following parties, strictly as required to operate the Service:

• Meta / WhatsApp: Message content is transmitted via the WhatsApp Business API for delivery. Meta's privacy practices are governed by their own policies.
• Supabase (hosting provider): Your data is stored in a PostgreSQL database hosted by Supabase in the af-south-1 (Cape Town) region.
• Payment processors: Billing information is shared with our ZAR payment providers (Paystack, Yoco, or PayFast) to process subscription payments.
• Legal authorities: Where required by law or a valid court order issued in the Republic of South Africa.

5. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy:

• Active account data: Retained for the duration of your active subscription
• WhatsApp message content: Retained for 12 months from the date of the message, then permanently deleted
• Account closure: All personal data is deleted within 30 days of account closure, unless retention is required by law
• Audit logs: Retained for 24 months to support compliance and dispute resolution
• Anonymised analytics: May be retained indefinitely as they do not constitute personal information

6. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights:

• Right of access: Request a copy of the personal information we hold about you
• Right to correction: Request that inaccurate or incomplete information be corrected
• Right to deletion: Request that your personal information be deleted, subject to legal retention requirements
• Right to object: Object to the processing of your personal information on reasonable grounds
• Right to data portability: Request your data in a structured, machine-readable format
• Right to withdraw consent: Withdraw previously given consent at any time, without affecting the lawfulness of prior processing

7. How to Exercise Your Rights

To exercise any of your rights under POPIA, contact our Information Officer at privacy@ambitx.ai. We will respond to your request within 30 days, as required by POPIA. You may be asked to verify your identity before we process your request.

8. Information Officer

9. Cross-Border Data Transfers

Your data is stored in South Africa (af-south-1, Cape Town region). However, certain third-party services may process data outside of South Africa:

• WhatsApp / Meta: Message delivery infrastructure may route data through servers outside South Africa. Meta's data processing is governed by their own data processing agreements.
• AI processing: Lead qualification models may process data on servers outside South Africa. No personal information is retained by AI providers after processing.

Where cross-border transfers occur, we ensure that adequate safeguards are in place as required by POPIA Section 72, including contractual protections and data processing agreements with all third-party providers.

10. Children's Data

Conversio is a business-to-business service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row Level Security (RLS) enforcing multi-tenant data isolation at the database level
• Role-based access controls for all staff and user accounts
• Regular security audits and vulnerability assessments
• Immutable audit logs for all data access and modifications

12. Updates to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email or a prominent notice within the Conversio dashboard. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For general enquiries about this privacy policy, contact us at support@ambitx.ai. For data subject access requests or privacy-related matters, contact our Information Officer at privacy@ambitx.ai.