Privacy Policy

Effective date: 6 October 2026

This policy explains how MChat (Pty) Ltd ("M-Chat", "we", "us") collects, uses, shares and protects personal information when you use M-Chat Platform, our website at m-chat.ai, the MChat Inbox mobile app, and products built on our platform, including Manna and Aura. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA) and the policies of Meta Platforms, Inc. for WhatsApp Business and Facebook.

1. Who we are

MChat (Pty) Ltd is a South African company based in Durban, KwaZulu-Natal. We provide a WhatsApp-native conversational platform that businesses and organisations ("our clients") use to communicate with their customers, members and contacts.

Our Information Officer is Ransley Bhimsan. You can reach us at privacy@m-chat.ai.

2. Our role: responsible party and operator

When a client uses M-Chat to talk to their own contacts, that client decides why and how the contact's information is used. Under POPIA the client is the responsible party and M-Chat acts as an operator processing information on the client's behalf. If you are a contact of one of our clients, please also read that organisation's privacy policy.

For information about our own clients, account users and website visitors, M-Chat is the responsible party.

3. Information we collect

From people who message a business through M-Chat

WhatsApp profile name and phone number
Message content you send, including text, images, documents, voice notes and responses to forms or flows
Information you choose to give, such as your name, email, booking details, prayer requests or preferences
Message metadata such as timestamps and delivery and read status
If you arrive from a Facebook or Instagram ad, the ad referral information Meta passes with your first message

From our clients and account users

Name, email, phone number, business name and billing details
Login credentials and account settings
Information about connected WhatsApp Business accounts, Facebook Pages and Meta Business accounts, obtained when you authorise access through Facebook Login or Meta's embedded signup

From website visitors

Details you submit in our contact or enquiry forms
Basic technical data such as browser type, device and pages visited

4. How we use information

To deliver, route and store messages between businesses and their contacts on WhatsApp
To run automated replies, AI assistance, bookings, reminders and other features our clients configure
To provide, maintain, secure and improve the platform
To manage client accounts, billing and support
To respond to enquiries and send service communications
To meet legal, regulatory and Meta platform obligations

We do not sell personal information. We do not use the content of our clients' conversations to advertise to their contacts.

5. Data from Facebook and WhatsApp

M-Chat connects to Meta services through the WhatsApp Business Platform (Cloud API) and the Facebook Graph API. When a client connects their accounts, we access only the permissions they approve, such as managing WhatsApp Business messaging, reading business account and phone number details, and managing Page messaging where enabled.

We use this data only to provide the messaging services the client has requested. We do not use it for any purpose that is not permitted by Meta's Platform Terms and Developer Policies, and we do not transfer it to data brokers or advertising networks.

6. Lawful basis

We process personal information where it is necessary to perform a contract, where our clients have obtained the consent of their contacts or have another lawful basis, where we have a legitimate interest in running and securing our service, or where the law requires it. People who message a business on WhatsApp can opt out of further messages at any time by replying STOP or by blocking the business.

7. Sharing

We share personal information only as needed to run the service:

With the client organisation you are communicating with
With Meta Platforms, Inc., which delivers WhatsApp messages
With service providers that host, process or support our platform, including cloud hosting, conversational AI and chatbot infrastructure, and payment providers, all under confidentiality and data protection obligations
With authorities where required by law

8. Cross-border transfers

Some of our service providers, including Meta, store or process data outside South Africa. Where this happens we rely on the provider's data protection commitments and the safeguards required by section 72 of POPIA.

9. Retention

We keep personal information only for as long as it is needed for the purposes above, for as long as a client account is active, or as required by law. When a client closes their account, their conversation data is deleted or anonymised within 90 days unless we must keep it longer for legal reasons.

10. Security

We use reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls and restricted staff access. WhatsApp messages are protected in transit by Meta's infrastructure. No system is perfectly secure, and we will notify affected parties and the Information Regulator of any security compromise as POPIA requires.

11. Your rights and data deletion

You have the right to ask what personal information we hold about you, to have it corrected or deleted, to object to processing, and to withdraw consent.

How to request deletion of your data

Email privacy@m-chat.ai with the subject "Data deletion request".
Include the phone number or email address linked to your data, and the business you were communicating with if you know it.
We will confirm receipt, verify the request, and delete your information within 30 days, or tell you if a legal reason prevents us from doing so.

If you connected M-Chat through Facebook Login, you can also remove our app at any time in your Facebook settings under Apps and Websites. This also stops our access to your Facebook data.

If you are a contact of one of our clients, we may pass your request to that client, as they control your information. You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

12. Children

Our platform is not directed at children under 18. Clients whose services involve minors are responsible for obtaining consent from a parent or guardian.

13. Cookies

Our website uses only the cookies needed for it to work and, where used, basic analytics. You can control cookies in your browser settings.

14. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed.

15. Contact us

MChat (Pty) Ltd
Durban, KwaZulu-Natal, South Africa
Information Officer: Ransley Bhimsan
Email: privacy@m-chat.ai