Effective 25 August 2026 · version 2026-08-25.1
SAYDO Privacy Notice
This notice explains how Amax Digital (Pty) Ltd, registration number 2021/365987/07, trading as SAYDO and acting as the responsible party, collects and uses personal information when you register, use the dashboard, communicate through the official SAYDO WhatsApp number, make payments or contact support.
1. Information we collect
We collect your name, email, password hash, linked WhatsApp number and verification and consent records; the messages, voice notes, images and files you choose to send; transcripts and AI responses; quoted-message references and optional searchable memory; OpenAI conversation references; plan, credit, usage and payment references; device, IP-derived security hashes, session and audit events; and support, objection, correction or deletion requests. Required signup fields are needed to create, secure and link the account; if you do not provide them, SAYDO cannot supply WhatsApp service. Searchable memory is optional. We do not store your card number or CVV; PayFast processes card details.
Your submitted content may contain information about other people or special personal information that you choose to provide. Do not submit it unless you have authority and a lawful basis. SAYDO does not use a voice recording to identify you biometrically; it processes supported audio for transcription or the requested AI task.
2. Why we process it
We process information to create and secure your account, confirm that you control the submitted number, provide transcription, AI, file analysis, memory and search, isolate each customer’s information, manage credits and billing, respond to support and deletion requests, prevent abuse and fraud, keep required records and comply with law. Processing is based, as applicable, on your consent, performance of the service agreement, legal obligations and legitimate interests in operating and securing SAYDO.
3. WhatsApp choice and direct collection notice
You provide your number directly and separately consent during signup to account, verification, service, usage, credit and billing messages. We send the post-link welcome only after you send the LINK code from that exact number. We do not send unsolicited marketing. If an unregistered number first contacts SAYDO, it may receive one limited registration/help response. Send STOP to withdraw WhatsApp consent immediately. This suspends WhatsApp processing and queued work for the number but keeps dashboard access and retained records. Reconnection requires fresh consent and a new LINK proof. You may also email info@saydo.co.za or close your account.
4. Recipients, operators and international processing
Only information reasonably needed for the service is disclosed to Meta/WhatsApp for message delivery, OpenAI for transcription and AI processing, PayFast for payments, the hosting and database provider, and the email provider. They may process information outside South Africa, including through their subprocessors. SAYDO must maintain written operator arrangements where POPIA requires them and may transfer personal information outside South Africa only where section 72 of POPIA or another lawful transfer basis permits it.
OpenAI states that API data is not used to train its models unless the customer opts in. Its default abuse-monitoring logs may retain content for up to 30 days, while OpenAI Conversations and conversation items are retained until SAYDO deletes them. Meta/WhatsApp applies its Business Data Processing Terms where it acts as SAYDO’s operator and may use global subprocessors. Provider exceptions for law, safety, abuse, backups or reported content may apply under their terms.
5. Retention
Downloaded media is held in memory or temporary processing storage only while a job is processed and is removed after processing; SAYDO does not keep the original audio as searchable memory. Encrypted operational payloads and delivery metadata are kept for limited recovery, security and troubleshooting periods. Referenced voice transcripts and attachment context are normally retained for up to 30 days. Operational message records are normally retained for up to 90 days. While searchable memory is on, SAYDO keeps an encrypted sender-owned archive of user-visible WhatsApp messages, voice transcripts, attachment references, selected actions, commands and SAYDO replies. This archive and searchable memory are retained for the period shown in your account, normally up to 365 days, unless you disable, clear or delete them sooner. OpenAI conversation state and conversation items remain until SAYDO successfully resets or deletes the provider conversation; a failed provider deletion is queued for bounded retry and surfaced operationally.
Account information is retained while the account is active and operational account data is deleted or de-identified within 30 days after a verified closure request, unless a longer period is required for security, disputes or law. Payment and tax records may be retained for at least five years or another legally required period, separated from active conversational data. Backups and fraud-prevention records are access-restricted and expire on documented schedules. SAYDO periodically deletes or de-identifies information that is no longer authorised or necessary.
6. Your choices and rights
You can access and search your own retained information in the dashboard, turn searchable memory on or off, clear memory, reset AI context and request history or full account deletion. You may request access, correction, deletion, destruction, restriction or objection where POPIA permits, and withdraw consent without affecting prior lawful processing. We verify requests to protect your account and ordinarily complete verified deletion requests within 30 days, subject to lawful retention. Contact the Information Officer through info@saydo.co.za, telephone +27 12 761 7894, or the registered address below. Access-to-records requests are explained in the PAIA Manual.
You may lodge a POPIA or PAIA complaint with South Africa’s Information Regulator after using the applicable internal process: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone 010 023 5200 or 0800 017 160; POPIAComplaints@inforegulator.org.za or PAIAComplaints@inforegulator.org.za.
7. Security, isolation and incidents
SAYDO uses HTTPS, verified WhatsApp sender routing, tenant and conversation isolation, encrypted private payloads, parameterised database access, signed Meta webhooks, bounded jobs, restricted administrator access, audit records and password/session controls. Administrators may access customer data only for authorised support, security and operations, and that access is audited. No system is risk-free; report suspected compromise promptly. Where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, SAYDO will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay or direction.
8. Children, automated output and changes
SAYDO is for people aged 18 or older and is not knowingly offered to children. AI assists with content processing but should not be used as the sole basis for decisions that significantly affect a person. We will publish and, where required, notify users of material changes to this notice.
9. Responsible party and Information Officer
Responsible party: Amax Digital (Pty) Ltd, registration 2021/365987/07, registered in the Republic of South Africa. Registered and legal-service address: 262 Jack Hindon Street, Pretoria, Gauteng, 0182, South Africa. Information Officer: the head of Amax Digital (Pty) Ltd acting in the statutory capacity assigned by POPIA and PAIA. Contact: info@saydo.co.za or +27 12 761 7894. SAYDO does not represent that a named individual or deputy has been registered with the Information Regulator until the Regulator issues or confirms that registration.
Amax Digital must keep its Information Officer registration, operator agreements, cross-border assessments, incident procedure and processing records current. Independent South African POPIA review remains recommended and may require amendments; this notice does not remove statutory rights or provider verification controls.