Thetha AI
PRIVACY POLICY
Thetha AI (Pty) Ltd · SpazaOS
Effective date: 2 September 2026 · Version 1.0
1. Who we are
Thetha AI (Pty) Ltd (registration number 2026/279930/07) (“we”, “us”) operates SpazaOS. We are the responsible party for the personal information described in this policy, as defined in the Protection of Personal Information Act, 4 of 2013 (“POPIA”).
Information Officer: Mojalefa Boikanyo
Email: boikanyo.m@thethaai.co.za
Address: 14 South Park Lane, Johannesburg, Gauteng, 2094
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account information | Name, mobile number, email, shop name and trading address | To create and secure your account, and to support permit and funding applications where you ask us to |
| Business records | Sales, stock levels, supplier and pricing information | The core function of the service |
| Credit ledger | Names and amounts owed, entered by the shop owner | To operate the shop’s credit book on the shop’s behalf |
| Compliance documents | Municipal registration references, permits and certificates you upload, and — where you choose to add one to your application pack — a photograph of an identity document or passport | To assemble your application pack |
| Technical information | Device type, app version, IP address, error logs | Security, support and reliability |
We collect information directly from you. We do not buy personal information from third parties.
Identity numbers. There is no field for an identity number anywhere in SpazaOS — not for you, and not for anyone in your credit book. Where you upload a photograph of an identity document to your compliance pack, it is encrypted at rest, the number in it is never read, extracted or indexed, and you can delete it at any time.
3. Why we may lawfully process it
- Consent — which you may withdraw at any time
- Performance of a contract with you
- Compliance with a legal obligation
- Our legitimate interests, where these do not override your rights — for example, securing the service and preventing fraud
4. The credit ledger — a specific commitment
The credit ledger contains personal information about your customers, who have not dealt with us directly. We treat it as the most sensitive information in the service.
We will never sell, share, license or include credit ledger information — including customer names, amounts owed and repayment behaviour — in any dataset, report or product supplied to any third party. This applies whether the information is identified, de-identified or aggregated. It applies regardless of any other consent you give us.
Where you record another person’s details in the ledger, you are responsible for having a lawful basis to do so. We process that information as an operator on your behalf.
5. Who we share information with
| Recipient | What | On what basis |
|---|---|---|
| Service providers — hosting, messaging, error monitoring | The minimum necessary | Under a written operator agreement requiring POPIA-compliant processing |
| Municipalities and funding bodies | Your compliance documentation | Only where you ask us to submit it |
| Manufacturers, lenders and researchers | Aggregated, de-identified insight about product movement | Only with your separate, specific consent, and never including clause 4 information |
| Regulators, courts and law enforcement | As compelled | Only where required by law or a court order, and we will tell you where we lawfully may |
We do not sell information that identifies you or your shop.
We will not provide your information to the South African Revenue Service, the Department of Home Affairs, the South African Police Service or any municipality except where you ask us to, or where we are compelled by law or court order.
6. Where information is stored
Information is stored on secure servers. Where any processing occurs outside South Africa, we do so only in accordance with Section 72 of POPIA, meaning the recipient is subject to a law, binding rules or an agreement providing an adequate level of protection.
7. How long we keep it
| Information | Retention |
|---|---|
| Account and business records | For as long as your account is active, and 5 years thereafter unless you ask for earlier deletion |
| Credit ledger | For as long as your account is active. Deleted within 30 days of account closure |
| Compliance documents | 5 years, to support any query about a submitted application |
| Technical logs | 12 months |
8. Security
We apply appropriate technical and organisational measures. Personal information is encrypted in transit and at rest; credit ledger names and uploaded documents are encrypted under a key held separately for each shop, so support access cannot read them. Access is controlled by individual credentials. No system is perfectly secure. If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as soon as reasonably possible, in terms of Section 22 of POPIA.
9. Your rights
You may:
- Ask what we hold about you, and get a copy
- Correct or complete information that is inaccurate
- Ask us to delete information we no longer have a lawful basis to keep
- Object to processing on legitimate-interest grounds
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Export your data in a usable format, at any time, free of charge
- Complain to the Information Regulator
To exercise any of these, email boikanyo.m@thethaai.co.za. We respond within 30 days.
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
POPIAComplaints@inforegulator.org.za · www.inforegulator.org.za
10. Children
SpazaOS is not intended for people under 18. We do not knowingly collect information about children. Where a person under 18 works in a shop, we ask that their personal information is not entered into the service.
11. Changes
We may update this policy. Material changes will be notified in the app and by message at least 14 days before they take effect. The version and effective date at the top of this page always reflect the current policy.
12. Contact
Mojalefa Boikanyo, Information Officer
boikanyo.m@thethaai.co.za
Thetha AI (Pty) Ltd, 14 South Park Lane, Johannesburg, Gauteng, 2094