Naledi Privacy Notice

1. Who We Are

Orion DevCore (operated by Graham Schubach) provides Naledi — an AI-powered WhatsApp assistant for businesses and individuals. We are the Responsible Party under South Africa's Protection of Personal Information Act (POPIA).

2. What Data We Collect

When you interact with Naledi via WhatsApp, we process:

• Your phone number — provided by Meta/WhatsApp when you message us
• Your name — if you provide it during conversation
• Message content — the text, voice notes (transcribed to text), images, and documents you send
• Naledi's replies — responses generated by our AI
• Usage data — timestamps, feature usage, AI model costs (aggregated, not content-linked)

We do not collect: location data, contacts from your phone, browsing history, or payment card details.

3. Why We Process Your Data

Your data is processed solely to:

• Provide the Naledi AI chat service (respond to your messages)
• Improve response quality through conversation history context
• Maintain service records for quality assurance and dispute resolution
• Comply with legal obligations (POPIA, ECTA)

4. Legal Basis

We process your personal data under the following lawful bases as set out in POPIA Section 11:

• Consent (Section 11(1)(a)) — by accepting this notice, you explicitly consent to the processing described
• Performance of a contract (Section 11(1)(b)) — processing necessary to provide the service you requested
• Legitimate interest (Section 11(1)(f)) — retaining conversation records for legal defence and quality assurance

5. How Long We Keep It

We retain your conversation data for 3 years from the date of your last message. After this period, records are automatically anonymised or deleted.

Extended retention may occur only if required by law, or if the data is needed for the establishment, exercise, or defence of a legal claim.

6. Who We Share It With

We use the following third-party operators (POPIA Section 1 — "operator"):

• Cloudflare, Inc. — Workers AI (AI inference), D1 (database), R2 (audio storage), Cloudflare Pages (web hosting)
• Meta Platforms, Inc. — WhatsApp Cloud API (message delivery)

Both operators have appropriate Data Processing Agreements in place. No data is sold or shared for advertising purposes.

7. Your Rights

Under POPIA, you have the following rights:

• Right to access — request a copy of your personal data
• Right to correction — request correction of inaccurate data
• Right to deletion — request deletion of your data (subject to legal retention requirements)
• Right to object — object to processing based on legitimate interest
• Right to complain — lodge a complaint with the Information Regulator

To exercise any of these rights, contact us at graham@oriondevcore.com or use our data deletion request page. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS) for all data transmission
• Encryption at rest for stored data
• Access controls limiting data access to the system owner only
• Cloudflare's enterprise-grade infrastructure security

9. Contact Us

For privacy-related enquiries:

Responsible Party

Graham Schubach

Email

graham@oriondevcore.com

Phone

+27 72 497 1810

WhatsApp

+27 64 549 9417

10. Information Regulator

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the Information Regulator (South Africa):