Privacy Policy

1. Who we are

Blueticked is a customer-messaging platform operated by Sinosa Trading (Pty) Ltd, a private company incorporated in the Republic of South Africa.

• Registration No.: 2013/053370/07
• VAT No.: 4650263488
• Registered address: Unit 58, Eden on the Bay, Big Bay, Cape Town, South Africa
• Information Officer: Shaun Schoeman
• Contact: privacy@blueticked.com

For purposes of the Protection of Personal Information Act, 2013 (POPIA), Sinosa Trading (Pty) Ltd is the responsible party. For purposes of the EU and UK General Data Protection Regulation (GDPR), it acts as data controller in respect of its own customers and as data processor in respect of end-user data customers route through the platform.

2. Information we collect

We collect personal information in three contexts:

Account holders (our customers)

• Name, email address, mobile number
• Business name, registration details, billing address
• Authentication credentials (hashed)
• Payment information (processed by our payment provider — we do not store card numbers)
• Logs of platform usage for security, billing and support

End-user contacts (your customers)

• Phone numbers and email addresses you upload or that initiate conversations
• Message content sent or received through Blueticked-connected channels (WhatsApp, SMS, email)
• Delivery receipts, read receipts and opt-out signals

Visitors to blueticked.com

• IP address, browser and device information, pages visited
• Information you submit through contact forms

3. How we use your information

• To deliver the Blueticked service: routing messages, maintaining inboxes, sending campaigns, generating AI replies
• To bill you and collect payment
• To provide support, prevent abuse and improve reliability
• To comply with legal obligations including POPIA, tax law and lawful interception requests
• To send service announcements (you cannot opt out of essential service emails)
• With your consent, to send product updates and marketing

4. Lawful basis (POPIA & GDPR)

We process personal information on the following bases:

• Contract — to deliver the services you have signed up for
• Legitimate interest — security, fraud prevention, service analytics
• Legal obligation — tax, accounting, lawful intercept, retention requirements
• Consent — for non-essential marketing and any optional analytics

5. Sharing with third parties

We share data only with operators (POPIA) / processors (GDPR) bound by written contracts to the same standards we are. We do not sell personal information.

• Meta Platforms, Inc. — WhatsApp Business message delivery and webhook processing
• SMSPortal (Pty) Ltd (South Africa) — SMS delivery
• Resend, Inc. — transactional email delivery
• Anthropic PBC and OpenAI OpCo, LLC — AI model inference for AI-agent replies (only when you enable AI agents)
• Supabase, Inc. — managed PostgreSQL hosting (EU region)
• Vercel, Inc. — application and marketing-site hosting
• Railway Corp. — background job processing (message sending, automations)
• Cloudflare, Inc. — bot protection on sign-in and sign-up
• Google LLC — address autocomplete in business profiles and generated sites
• Upstash, Inc. — Redis-backed job queue
• Paystack (Pty) Ltd — payment processing
• Sentry (Functional Software, Inc.) and PostHog, Inc. — error monitoring and product analytics
• Professional advisers, auditors, and law-enforcement authorities where legally required

6. Cross-border transfers

Some processors are located outside South Africa, the European Economic Area, and the United Kingdom. Where personal information leaves these jurisdictions we rely on Standard Contractual Clauses and ensure the recipient is subject to laws or binding agreements that uphold equivalent protection in line with section 72 of POPIA.

7. How long we keep information

• Active account data: while your account is open. Closing an account or deleting a workspace removes its data from the product immediately.
• End-user message content: for the period each business chooses in its settings, which is 6 months, or 1, 2, 3 or 5 years, and 2 years unless the business chooses otherwise. After that period we remove a message's content (the text, any media, and the personalisation values used to build it) and keep only the record that a message existed: who it went to, when, whether it was delivered, and what it cost. You can delete a conversation or erase a contact sooner at any time. When a business shortens its period, nothing is removed for at least 24 hours.
• Unread conversations keep their messages until someone reads them: if a conversation still has messages nobody in the business has opened, or a ticket that is still open, we do not remove its content when the period ends. We do this so a customer's message is never removed before the business has seen it.
• Delivery and engagement events (opens, clicks, bounces and complaints) follow the same period as the business's message content. The totals on campaign reports are kept.
• Blueticked is a messaging service, not a clinical or patient record. Healthcare practices should keep clinical notes in their own records system.
• Form answers submitted through WhatsApp forms: 90 days from submission, then permanently deleted. Export what you need to keep.
• Contacts you delete: removed from the product immediately and permanently purged 90 days later.
• Billing and tax records: 5 years (SARS requirement)
• Backups: daily database snapshots, retained for 7 days. Uploaded media files are not currently included in database backups.
• Suppression-list entries (opt-outs): retained indefinitely to honour the opt-out

8. Your rights

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention obligations
• Object to direct marketing
• Withdraw consent where consent is the lawful basis
• Lodge a complaint with the South African Information Regulator (inforegulator.org.za)

To exercise any of these rights, email privacy@blueticked.com. If you submitted your request via Meta's data-deletion flow, you can check status at /data-deletion.

9. Security

We use AES-256-GCM encryption for sensitive credentials at rest, TLS 1.2+ in transit, role-based access controls, and audit logging. We follow industry best practice but no system is impenetrable. If we become aware of a security compromise affecting your information we will notify you and the Information Regulator without unreasonable delay as required by section 22 of POPIA.

10. Cookies and similar technologies

blueticked.com uses essential cookies for session management and opt-in analytics cookies (PostHog). You can disable analytics in your browser; the site remains fully functional without them.

11. Children

Blueticked is not intended for users under 18. We do not knowingly collect personal information of children. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy. Material changes will be announced by email to account holders and posted at the top of this page. The effective date will always reflect the most recent version.

13. Contact

Sinosa Trading (Pty) Ltd
Unit 58, Eden on the Bay, Big Bay, Cape Town, South Africa
Email: privacy@blueticked.com