Legal

Privacy Policy

This policy explains what personal information AI Wingman collects, why we collect it, who we share it with, and the choices and rights you have. It covers our website, our email and our WhatsApp Business messaging.

Effective 22 September 2026 · Last updated 22 September 2026

1. Who we are

AI Wingman (Pty) Ltd (registration number 2026/665295/07), trading as AI Wingman (“AI Wingman”, “we”, “us” or “our”), is an AI consulting practice based in Cape Town, South Africa, working with owner-led businesses locally and internationally. We help businesses assess where AI fits, build working tools, and keep them running.

For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”) we are the responsible party for the personal information described in this policy. For the purposes of the EU General Data Protection Regulation and the UK GDPR (together, the “GDPR”) we are the controller of that information.

Where we handle personal information on behalf of a client as part of a project, the client is the responsible party or controller and we act as an operator or processor. See section 13.

Privacy contact: info@aiwingman.co.za — use this address for any question, request or complaint about how we handle your personal information.

2. What this policy covers

This policy applies to personal information we collect when you:

  • visit this website or submit the waiting-list or contact form on it;
  • email us, call us, or message us on WhatsApp;
  • meet with us about a possible engagement, or work with us as a client;
  • receive updates or other communications from us that you have asked for.

It does not cover third-party websites or services we link to. Those have their own privacy policies, and we encourage you to read them.

3. Information we collect

3.1 Information you give us

  • Waiting-list and contact forms. Your name, email address, business name, and whatever you tell us you are hoping AI can help with.
  • Messages. The content of emails, WhatsApp messages, contact-form submissions and call notes, including any personal information you choose to include in them.
  • Engagement information. If you become a client: contact details for you and the people we work with, billing and invoicing details, and information about your business and systems that is necessary to do the work.

3.2 Information we collect automatically

  • Server and platform logs. Our hosting provider records standard technical data such as IP address, browser type, pages requested, referring page and timestamps. This is used to keep the site running, secure and reasonably fast.
  • Local storage in your browser. When you submit the waiting-list form, a copy of the entry is saved in your own browser's local storage so a submission is never lost if delivery fails. It stays on your device and is not transmitted to us separately. See section 12.

We do not use advertising trackers, third-party marketing pixels, or cross-site profiling on this website.

3.3 Information from other sources

  • WhatsApp. When you message our WhatsApp Business number we receive your phone number, your WhatsApp profile name and profile photo (if you have set them), and the content of your messages — see section 4.
  • Referrals and public sources. Business contact details passed on by a mutual contact, or publicly available business information such as a company website or a professional profile.

We do not intentionally collect special personal information (such as health, race, religious or biometric data) or the personal information of children, and we ask that you do not send it to us.

4. WhatsApp Business messaging

AI Wingman operates a WhatsApp Business account so that clients and prospective clients can reach us the way they already work. This section explains, specifically, how we handle information you send us on WhatsApp.

4.1 What we receive when you message us

  • Your mobile number and your WhatsApp profile name (and profile photo, if you have set one).
  • The content of the messages you send us — text, images, documents, voice notes and any other attachments.
  • Message metadata such as timestamps and delivery, read and failure status.
  • Your opt-in status, and any opt-out request you send us.

4.2 Why we use it

  • To answer your enquiry and continue a conversation you started.
  • To arrange, confirm and follow up on calls and meetings.
  • To provide support and updates during an active engagement.
  • To send you service or account information you have asked for, and — only if you have opted in — occasional updates about our services.
  • To keep a record of what was agreed, and to meet our legal and accounting obligations.

4.3 Opt-in and opt-out

We only send WhatsApp messages to people who have given us their number and agreed to be contacted there — by messaging us first, by giving us the number for that purpose, or by opting in through a form or in conversation. We do not buy phone number lists and we do not send unsolicited WhatsApp marketing.

To stop receiving WhatsApp messages from us, reply STOP to any message, tell us in your own words, or email info@aiwingman.co.za. We will action it promptly and will not need a reason. You can also block or report the number inside WhatsApp at any time.

4.4 How WhatsApp itself handles your messages

WhatsApp is provided by Meta Platforms, Inc. and its affiliates (including WhatsApp Ireland Limited), not by AI Wingman. When you message us, your message travels through Meta's infrastructure and is also governed by WhatsApp's own terms and privacy policy. Messages to a business account may be stored and processed by Meta on the business's behalf, which means WhatsApp's standard end-to-end encryption does not give us the same protection as a personal chat once the message reaches our business inbox.

4.5 What we will never do with WhatsApp information

  • We do not sell your phone number, your messages or any other WhatsApp information.
  • We do not share WhatsApp information with third parties for their own marketing or advertising.
  • We do not use WhatsApp information to build advertising audiences or profiles.
  • We do not add you to a WhatsApp group, broadcast list or newsletter without your agreement.

4.6 Sensitive information on WhatsApp

Please do not send passwords, API keys, banking credentials, identity-document images or other highly sensitive material over WhatsApp. If credentials are needed for a project, we will agree a secure method with you instead.

4.7 Retention of WhatsApp conversations

We keep WhatsApp conversations for as long as needed for the enquiry or engagement they relate to, and then for up to five years as a business record, unless you ask us to delete them sooner. See section 9.

5. How and why we use your information

We use personal information only for the purposes set out below. The lawful basis under the GDPR is given alongside each purpose; under POPIA the equivalent justification is consent, performance of a contract, compliance with a legal obligation, or our legitimate interests, as applicable.

Responding to enquiries and joining the waiting list
To reply to you, understand what you need and let you know when a spot opens up. Basis: your consent, and our legitimate interest in responding to people who contact us.
Delivering our services
To scope, plan, build, support and invoice the work we do for you. Basis: performance of a contract with you, or steps taken at your request before entering into one.
Running and improving our business
To keep records, improve our website and services, and understand what kind of help businesses are asking for. Basis: our legitimate interests, balanced against your rights.
Security and abuse prevention
To protect the website and our systems from spam, fraud and misuse. Basis: our legitimate interests.
Updates about our services
To send occasional updates to people who have asked for them. Basis: your consent, which you can withdraw at any time.
Legal and accounting obligations
To meet tax, accounting, and other legal or regulatory requirements. Basis: compliance with a legal obligation.

We will not use your information for a materially different purpose without telling you first and, where the law requires it, obtaining your consent.

6. AI and automated processing

We use AI tools in our own work, including to help triage, summarise and draft replies to messages sent to us by email and on WhatsApp. This means the content of a message you send us may be processed by an AI service acting on our instructions, under a contract that prohibits that provider from using your information to train its models or for its own purposes.

A person remains responsible for our side of every conversation. We do not make decisions that produce legal effects for you, or that similarly significantly affect you, based solely on automated processing. If you would prefer that we handle your messages without AI assistance, tell us and we will.

7. Who we share information with

We do not sell personal information. We share it only with service providers who help us run our business, and only as far as they need it to do their job for us. Each is bound by a contract to keep it confidential and secure and to use it only on our instructions.

Hosting and website delivery
Vercel Inc. hosts this website and processes standard request logs.
Email delivery
Resend (Plus Five Five, Inc.) delivers waiting-list and contact form submissions to our inbox.
Email and productivity
Our email, calendar and document storage providers, which hold the correspondence and documents relating to an enquiry or engagement.
Messaging
Meta Platforms, Inc. and WhatsApp Ireland Limited, which operate WhatsApp and the WhatsApp Business Platform.
AI providers
Providers of the AI tools described in section 6, under terms that prohibit training on your information.
Accounting and payments
Our bookkeeping, invoicing and payment providers, for billing and statutory record-keeping.

We may also disclose personal information where we are required to:

  • to comply with a law, court order, or a lawful request from a regulator or law-enforcement authority;
  • to establish, exercise or defend a legal claim, or to protect the rights and safety of AI Wingman, our clients or others;
  • to a professional adviser (such as a lawyer or accountant) bound by a duty of confidentiality;
  • to a successor, if our business or part of it is ever transferred — in which case this policy continues to apply to the information transferred.

8. International transfers

We are based in South Africa and work with clients and providers around the world, so your personal information may be stored or processed outside your country — in particular in the United States and the European Union.

Where we transfer personal information across borders, we do so on a basis permitted by section 72 of POPIA and, where the GDPR applies, Chapter V of the GDPR — usually because the recipient is bound by a contract (including Standard Contractual Clauses) that provides an adequate level of protection, because the recipient is in a country recognised as providing adequate protection, or because the transfer is necessary to perform a contract with you. You can ask us for details of the safeguards that apply to a particular transfer.

9. How long we keep information

We keep personal information only as long as we have a reason to, then delete it or anonymise it.

Waiting-list entries
Until we have worked through the list and you have told us you are no longer interested, or two years after the last contact, whichever comes first.
Enquiries that do not become engagements
Up to two years after the last contact, so we can pick up the conversation if you come back.
Client records and correspondence
For the life of the engagement, then up to five years, to meet South African tax and record-keeping requirements and to handle any later query or claim.
WhatsApp conversations
As set out in section 4.7.
Website server logs
Short-term only, as retained by our hosting provider for security and operational purposes.
Local storage in your browser
Until you clear your browser's site data — it is on your device and under your control.

If you ask us to delete your information we will do so, except where we are required to keep it by law or need it to establish, exercise or defend a legal claim.

10. How we protect information

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse, as required by section 19 of POPIA. In practice this means encryption in transit, access limited to the people who need it, multi-factor authentication on the accounts that hold your information, reputable providers with their own security programmes, and keeping as little information as we need for as short a time as we can.

No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA, and the relevant supervisory authority where the GDPR applies.

11. Your rights

Whatever your location, you can ask us to do any of the following, and we will honour the request as far as the law allows:

  • Access — ask whether we hold personal information about you, and get a copy of it.
  • Correction — have inaccurate or incomplete information corrected or completed.
  • Deletion — have information deleted or destroyed where we no longer have a lawful reason to keep it.
  • Objection — object to our processing of your information on legitimate-interest grounds, and to direct marketing at any time.
  • Withdraw consent — where we rely on your consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.
  • Restriction and portability — where the GDPR applies, ask us to restrict processing, or to provide your information in a structured, commonly used, machine-readable format.

To exercise any of these rights, email info@aiwingman.co.za. We may need to confirm your identity before we act. We will respond within a reasonable period and, where the GDPR applies, within one month. Our response is free; we may charge a reasonable fee only for a manifestly unfounded or excessive request, or for additional copies.

Complaints

We would rather hear from you first, so please give us the chance to put things right. You also have the right to complain to a regulator:

South Africa — the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001. inforegulator.org.za

EU / UK —your local data protection supervisory authority, or the UK Information Commissioner's Office at ico.org.uk.

12. Cookies and local storage

This website does not use advertising or analytics cookies, and we do not track you across other websites.

We do use your browser's local storage for one thing: when you submit the waiting-list form, a copy of your entry is kept on your device (under the key aiwingman_waitlist) so that nothing is lost if the submission fails to reach us. You can remove it at any time by clearing site data for this website in your browser settings.

Our hosting provider may set strictly necessary cookies required to serve and secure the site. If we ever add analytics or other non-essential cookies, we will update this policy and ask for your consent first.

13. Information we handle for clients

When we build or run AI tools for a client, we often process personal information that belongs to the client's own customers, employees or contacts. In that situation the client is the responsible party (controller) and decides what is done with that information; AI Wingman acts as an operator (processor) and handles it only on the client's documented instructions, under a written agreement covering confidentiality, security, sub-processors and deletion at the end of the engagement.

If you are a customer or contact of one of our clients and you want to exercise your rights over that information, please contact that business directly — they hold the relationship and the record. If you reach us instead, we will pass your request on to them and support them in answering it.

14. Children

Our website and services are intended for businesses and the adults who run them. We do not knowingly collect personal information from children under 18. If you believe a child has given us personal information, contact info@aiwingman.co.za and we will delete it.

15. Changes to this policy

We may update this policy as our business, our tools or the law change. The version published on this page is always the current one, and the effective date at the top tells you when it last changed. If a change materially affects how we use your personal information, we will take reasonable steps to tell you directly — by email or on WhatsApp — before it takes effect.

16. How to contact us

For any question, request or complaint about this policy or about how we handle your personal information:

AI Wingman (Pty) Ltd
Registration number 2026/665295/07
Cape Town, South Africa

Email: info@aiwingman.co.za

We aim to respond to every privacy request within a reasonable period, and in any event within the time limits set by the law that applies to you.

← Back to home