Privacy Policy

Seeded Systems (Pty) Ltd
Registration number: 2026/675044/07

Effective date: 15 September 2026
Last updated: 16 October 2026

1. Who We Are

Seeded Systems (Pty) Ltd ("Seeded Systems", "we", "us", "our") builds websites and AI automation systems — including conversation agents and voice agents — for businesses in South Africa.

This policy explains what personal information we collect when you visit seededsystems.co.za, enquire about our services, or become a client; why we collect it; who we share it with; and what you can do about it.

We are the responsible party for this information as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our details

2. Information We Collect

2.1 Information you give us

Questionnaire. Our home page has a five-question questionnaire about how your business handles its customers. Your answers stay in your browser (see Section 2.2) and are not sent to us unless you go on to book a call. If you book a call, your answers are added to your booking record. The agent on our website does not see them.

Booking a call. When you book a call through our website, you provide your name, email address, phone number, business name, the services you are interested in, any message you add, how you prefer us to contact you, and whether you would like to receive updates from us. We record these as soon as you finish the questions, before you pick a time, so we can follow up if you do not finish booking.

Newsletter and marketing. If you sign up for updates, you provide your name and email address.

Becoming a client. If you engage us, we collect the information needed to run the project and bill you: contact person's name, business name, billing details, VAT number, project requirements, and the credentials or access we need to do the work (for example, access to your website or your existing systems).

2.2 Information collected automatically

Conversation and voice agent conversations. If you interact with a conversation agent or voice agent, the content of that conversation is processed so the agent can respond. This may include anything you choose to type or say.

The agent on our website. Bella, the chat agent on our website, runs on Sprout, the platform we build and run our clients' agents on. The chat window loads from Sprout's own address (seeded-sprout.vercel.app), so our website itself never sees what you type in it.

• Your messages. Each message you send is stored and sent to Anthropic, whose AI model writes the reply. If the agent needs to search our business information for the answer, your question is also sent to Voyage AI. Before a message is stored or sent anywhere, ID numbers, card numbers, bank account numbers and passwords are removed wherever our system recognises them. Please do not send them.
• Where and for how long. Conversations are stored in the European Union, in Germany (Supabase, Frankfurt), and deleted 90 days after the last message. The AI models that write the replies run in the United States.
• Details you give the agent. If you give the agent your name, email address or phone number, for example so that we can call you, it saves them as an enquiry for our team. When it passes your enquiry on, our team gets an email with those details and a link to the conversation, never the conversation itself. Enquiries are kept as set out in Section 9.
• Notes from earlier conversations. Once you have given the agent your details, it may keep short notes from your conversations so that it does not ask you the same things twice: your name, what you are interested in, your preferences, your plans, the times that suit you, and how earlier enquiries turned out. The notes are written by the same AI model from your messages, and each one links to the message it came from. A note the agent guessed, rather than something you said, is used only once our team approves it. The agent uses the notes only when it knows it is talking to you again: from the same browser, or after our team has matched a new conversation to your details. Our system is built to keep ID, card and bank numbers, passwords and special personal information (such as health, religion or political views) out of them. Each note is deleted 12 months after it was last confirmed. Our team can read, correct and delete your notes at any time, and you can ask us to delete them (see Section 10).
• A visitor id in your browser. So that a conversation can carry on where you left it, the chat window keeps a random visitor id in your browser's local storage, under Sprout's address rather than ours. It is not a cookie and holds nothing about you. It lasts 30 days from your last visit. If you have given the agent your details, it is how the agent knows you are the same visitor next time.

Anthropic may keep messages for a limited period under its commercial terms to detect misuse, and does not use them to train its models.

Our WhatsApp helpline. If you message our WhatsApp number, +27 66 006 3473, your message goes through WhatsApp, which is run by Meta, and Meta delivers it to us through its WhatsApp Business Platform. WhatsApp's own privacy policy covers your use of the app itself. We receive your WhatsApp number, your WhatsApp profile name, your messages, any voice notes, photos, videos or documents you send, and delivery receipts for our replies. Bella, our AI agent, answers using Anthropic's AI model, and our team can read the conversation and step in to reply. We keep the conversation and its files in our agent platform's database (Supabase, in Frankfurt, Germany) and delete them 90 days after the last message. If you message us again from the same number, the agent recognises it and can pick up where you left off, using the notes described in Section 4.3. Reply STOP at any time and we will stop messaging you.

Technical information. Our website hosting and the third-party tools embedded on our site record standard technical data such as IP address, browser type, device type, pages viewed, and the date and time of your visit. This is generated by your browser automatically whenever you visit any website.

Browser storage. Our website keeps four things in your own browser. None of them is a cookie, and none is sent anywhere except as described above:

• ss-motion (local storage) remembers whether you have switched animations off.
• seeded-diagnosis (local storage) remembers your questionnaire answers, so you can pick up where you left off and so they can go with your booking.
• seeded-booking (session storage) keeps your booking answers while you fill them in, so going back does not lose them. It is deleted when you finish booking or close the tab.
• The chat window's visitor id (local storage, under seeded-sprout.vercel.app) lets a conversation carry on where you left it. It lasts 30 days from your last visit.

You can clear all of them by clearing your browser data for our website.

2.3 Information we do not collect

We do not collect special personal information as defined by POPIA — such as health records, biometric data, religious or political beliefs, or criminal history — for our own purposes. We do not knowingly collect information from children under 18.

2.4 Information belonging to our clients' customers

When we build a conversation agent, voice agent, or automation for a client, that system may process personal information belonging to our client's customers — for example, a patient booking an appointment through a conversation agent we built for a medical practice.

In that situation our client is the responsible party and we act as their operator: we process that information only on the client's documented instructions, for the purpose of running the system they engaged us to build, and for no purpose of our own. Section 8 explains this in more detail.

This includes WhatsApp. When a client connects its WhatsApp Business number to the platform behind the agents we build and operate, we receive and send that business's WhatsApp messages through Meta's WhatsApp Business Platform. We process its customers' messages, names and phone numbers as the client's operator, as described above, and use them only to answer those customers and to show the conversations to the client's staff.

3. How We Use Your Information

We do not sell your personal information. We have never sold personal information and we do not share it for cross-context behavioural advertising.

4. Artificial Intelligence: How We Handle Your Data

Because AI is central to what we build, we set out our position on it plainly.

4.1 We do not train AI models on your data

We do not use your personal information, your conversations with our agents, or any client data to train, fine-tune, or otherwise improve any AI model — our own or anybody else's.

We use AI models supplied by third parties through their business APIs. Under those providers' terms, data sent through the API is not used to train their models. Where a provider would otherwise be allowed to, we have switched that off in our account with them. We do not opt into any arrangement that would change this.

If we ever want to change this position, we will ask for your explicit, separate, opt-in consent first. Continuing to use our website or our services will never be treated as agreement to have your data used for model training.

4.2 The AI providers we use

If we add or change a core AI provider, we will update this list.

4.3 Conversations with our conversation and voice agents

Voice agent calls are recorded. If you speak to one of our voice agents, the call audio and a written transcript of it are created and stored. The agent tells you at the start that it is an AI assistant and that the call is recorded, and asks whether you are happy to continue, before it asks for any of your details. If you would rather not speak to an automated system, say so and we will arrange for a person to contact you, or email us instead.

Conversations with our voice agents, and with agents we run for clients, are recorded and retained so the agent can hold a coherent conversation, so we can pick up the thread if you become a client, and so we can find and fix faults. Conversations with the agent on our website are kept for 90 days after the last message (see Section 2.2).

A human may read your conversation. We review conversations for quality control, debugging, and to follow up on enquiries. If you would prefer not to share something with a person, do not type or say it to an agent.

Do not send our agents payment card numbers, passwords, ID numbers, or medical details. We do not ask for them and our agents do not need them.

We keep agent conversation logs, call transcripts and call summaries for 90 days, after which they are deleted or irreversibly anonymised. Call audio stays with Vapi and is deleted after 14 days. A record that a call took place (its time, length, outcome and cost) is kept for our clients' reporting, without what was said. You can ask us to delete yours sooner — see Section 10.

Notes about returning customers. Our agents may keep short notes about a customer, taken from earlier conversations and calls (such as what they asked about), so the agent can greet them and pick up where they left off. Each note is labelled as what the customer said, is never treated as an instruction, and expires 12 months after it was last confirmed. You can ask to see or delete them — see Section 10.

4.4 Automated decision-making

We do not make decisions about you by automated means alone that have legal consequences for you or that affect you to a similar substantial degree. Section 71 of POPIA restricts that kind of decision-making, and we do not do it.

To be specific about the one place this question comes up: the result of the questionnaire on our website names the areas of your business worth discussing, based only on the answers you give. It is a starting point for a conversation, not a decision about you. It does not grant, refuse, or price anything. Any actual quote or decision to work together is made by a person.

4.5 Client automations

When we build an AI system for a client, we design it so that:

• personal information is only processed for the purpose the client has defined;
• the system's provider terms exclude the use of that data for model training;
• conversation logs are retained for the period the client instructs, not indefinitely; and
• access to those logs inside Seeded Systems is limited to the people working on that client's project.

5. Cookies and Similar Technologies

We do not set any cookies. Our website has no tracking of its own and, as at the date this policy was last updated, no analytics software installed. The booking calendar runs through our own server and the agent on our website through our own agent platform, so no third-party tool on our pages sets cookies in your browser. The only things our website keeps in your browser are listed under "Browser storage" in Section 2.2.

If your browser cannot run our booking page, we link to GoHighLevel's own booking page instead. That page is run by GoHighLevel and sets its own cookies and identifiers to operate the calendar and attribute the booking. You can block or delete cookies through your browser settings — every major browser allows this.

If we later add analytics, we will update this section before doing so, and we will choose a tool that does not track you across other websites.

6. Who We Share Your Information With

We share personal information only with the service providers we need to run the business. Each one is bound by contract to protect it, to use it only for the service they provide us, and not to use it for their own purposes.

We may also disclose personal information where the law requires it — for example in response to a court order, a lawful request from a regulator, or to establish or defend a legal claim.

We will never sell, rent, or trade your personal information.

7. Sending Information Outside South Africa

Several of the providers listed above are based outside South Africa, mainly in the United States and the European Union. This means your personal information is transferred across borders.

Section 72 of POPIA permits this, and we rely on the following:

• the provider is bound by a written agreement with us that imposes data protection obligations substantially similar to POPIA; and/or
• the transfer is necessary for the performance of a contract with you, or for a contract concluded in your interest; and/or
• you have consented to the transfer.

We check the data protection terms of every provider before we adopt it, and we do not use a provider that will not commit to protecting the information in writing.

8. When We Work on Client Projects

If you are a customer of one of our clients and you have reached this policy because of a conversation agent, voice agent, or automation we built:

• Our client is the responsible party, not us. They decide what is collected and why.
• We are their operator. We process that information only on their written instructions.
• This policy does not govern that processing. Our client's own privacy policy does.
• Send your request to them. If you want access to your information, or want it deleted, contact the business you dealt with. If you contact us instead, we will pass your request on to them and tell you that we have done so.

We enter into a written data processing agreement with each client that covers confidentiality, security, use restrictions, retention, sub-processors, breach notification, and what happens to the data when the engagement ends.

9. How Long We Keep Your Information

We keep personal information only for as long as we need it, then delete it or anonymise it.

Where a longer period is required by law, or where information is needed for a legal claim that is live, we keep it for as long as that requires and no longer.

10. Your Rights

Under POPIA you have the right to:

• Be told what personal information we hold about you, and to receive a copy of it.
• Correct information that is inaccurate, misleading, out of date, or incomplete.
• Have information deleted where we no longer have a lawful reason to keep it.
• Object to us processing your information on the basis of legitimate interests, on reasonable grounds relating to your situation.
• Withdraw consent at any time, where we relied on your consent. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
• Opt out of direct marketing at any time, with no reason given and at no cost.
• Complain to the Information Regulator (see Section 11).

How to exercise a right

Email support@seededsystems.co.za with the words "Privacy Request" in the subject line and tell us what you want.

• We will acknowledge your request within 7 business days.
• We will complete it within 30 days. If it is complicated and we need more time, we will tell you within those 30 days, explain why, and give you a date.
• There is no charge, unless a request is clearly excessive or repetitive, in which case we will tell you the fee before we do any work.
• We may need to confirm your identity first, so that we do not hand your information to somebody else. We will only ask for what is necessary to do that.

This includes your conversations with the agent on our website and the notes it keeps about you. If you did not give the agent your details, tell us roughly when you chatted and what about, so that we can find the conversation.

This also covers your WhatsApp conversations with our helpline. Tell us the number you messaged from, so that we can find them. To stop the agent messaging you on WhatsApp, reply STOP in the chat. That stops our messages; to have the conversation deleted as well, send us a request as above.

Direct marketing

We send marketing emails only to people who have asked for them, or to existing customers about services similar to the ones we already provide. Every marketing email has a working unsubscribe link. You can also email support@seededsystems.co.za and ask us to stop. We will action it within 7 business days.

11. How to Complain

We would rather hear from you first — email support@seededsystems.co.za and we will try to put it right.

You also have the right to complain directly to the regulator at any time:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries.IR@justice.gov.za
Complaints: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za

12. How We Protect Your Information

We take the following measures to keep personal information safe:

• Encryption in transit. Our website and every service we use is served over HTTPS/TLS. Information sent between your browser and us is encrypted.
• No unnecessary storage. Our website itself has no database, which means there is no customer database on our website to attack. Bookings pass straight through to our CRM. Conversations with the agent on our website and on our WhatsApp helpline, and the details and notes the agent keeps, are stored only in our agent platform's database, which our team can reach only with a second login step.
• Credential discipline. Passwords, API keys and access tokens are held in a password manager, are never written into source code, and are never committed to our code repositories. Access to a client's systems is requested only when the work requires it and removed when the work is done.
• Access control. Access to personal information is limited to the people who need it for the project in front of them.
• Account protection. Accounts that hold personal information are protected by strong, unique passwords held in a password manager, and we enable additional login verification on those accounts where the provider offers it.
• Vendor vetting. We review the security and data protection terms of a service provider before we adopt it.
• Confidentiality. Anyone working with us is bound to keep client and customer information confidential.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

13. Children

Our services are sold to businesses and our website is directed at business owners and decision-makers. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has given us personal information, email support@seededsystems.co.za and we will delete it.

14. Visitors From Outside South Africa

We operate in South Africa and our services are aimed at South African businesses. This policy is written to comply with POPIA.

We do not target visitors in the European Union, the United Kingdom, or California, and we do not monitor the behaviour of people in those places. If you contact us from outside South Africa, your information will be processed in South Africa and in the countries listed in Section 6, under this policy. The rights in Section 10 are available to you regardless of where you are.

15. Changes to This Policy

We may update this policy as our services change or as the law requires. The current version is always at https://seededsystems.co.za/privacy, with the "last updated" date at the top.

If we make a change that materially affects how we use your personal information, we will give notice on our website and — where we hold your email address and the change requires it — by email, before the change takes effect.

16. Contact Us

Seeded Systems (Pty) Ltd
11 High Ridge Place, 294 Neptune Street, Waterkloof Ridge, Pretoria, Gauteng, 0181, South Africa
Registration number: 2026/675044/07
https://seededsystems.co.za