Privacy Policy

1. Who we are

Grey Matter Consulting (Pty) Ltd ("Grey Matter", "GreyMC", "we", "us", "our"), registration number 2020/255888/07, is a South African company. We build and run digital products and services, including Dex, a WhatsApp assistant that answers messages on behalf of a business.

Our Information Officer for the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA) is Craig Haupt, reachable at hello@greymc.co.za or +27 81 557 1278.

2. Two different roles - please read this first

This policy covers two situations that are legally different, and it matters which one applies to you.

a. Where we are the responsible party

When you visit our website, enquire with us, or sign up as a Grey Matter client, we decide why and how your information is used. Under POPIA we are the responsible party (under the GDPR, the controller), and this policy governs that use.

b. Where we are only the operator

When you message the WhatsApp number of a business that uses Dex, that business - not Grey Matter - decides why your information is collected and what happens to it. That business is the responsible party. We host and run the software on their instructions, which makes us the operator (under the GDPR, the processor).

In that case, the privacy policy that governs your information is the one belonging to the business you messaged. We do not use those conversations for our own purposes, we do not sell them, and we do not use them to advertise to you. If you want your data deleted, the fastest route is to ask that business directly - see Data deletion, which explains both routes.

3. What we collect

Website visitors

• Name, email address and phone number, when you submit a contact or audit form
• Your business website URL, when you request a free website audit
• Usage data - pages visited, time on site, referral source
• Browser and device type, collected automatically by analytics

Client businesses

• Business name, trading details and business type
• Contact details for the owner and any staff you give portal access to
• The WhatsApp business number connected to the service
• The knowledge base you supply for Dex to answer from - your prices, services, policies and any documents you upload
• Billing records, including subscription status and payment history

People who message a Dex line

When you send a WhatsApp message to a business running Dex, we process the following on that business's behalf:

• Your WhatsApp phone number and the WhatsApp profile name your device sends
• The content of your messages, and the replies sent back to you
• Voice notes you send, which are converted to text so they can be answered
• Images and documents you send, which are read so they can be answered
• Details you choose to give in conversation - your name, email address, an alternative contact number, your company, or what you are enquiring about
• Bookings, orders and enquiries created from your conversation
• A short running summary of the conversation and a set of stated facts, so the assistant does not ask you the same thing twice

We do not take payments inside a WhatsApp conversation and Dex will never ask you for card, banking or password details. If a message claiming to be from a business asks you for those over WhatsApp, treat it as fraud.

4. How Dex handles a message

A message arrives from WhatsApp, is placed on a queue, and is answered by an AI model. To produce the answer we send the recent conversation, the business's knowledge base and what we know about you to our AI providers. Their responses come back as text, which is sent to you as the reply.

Dex tells you it is an AI assistant on first contact. You can reach a person at any time by replying HUMAN, and you can stop the assistant messaging you by replying STOP. We record that choice and respect it.

AI systems can be wrong. Answers, prices and availability given by Dex are not a guarantee, and the business you are dealing with remains responsible for what it agrees with you.

5. How we use information

• To answer enquiries and provide the services asked of us
• To run Dex on behalf of a client business, including making and changing bookings where the business has enabled it
• To alert a business owner to messages that need a person
• To bill for our services and keep the accounting records the law requires
• To monitor reliability, diagnose faults and keep the service secure
• To send marketing emails, only where you have agreed to receive them

We do not sell personal information. We do not use the contents of client conversations to train our own AI models, and our AI providers are engaged on terms that do not permit them to train their public models on this data.

6. Who we share it with

We use the following providers to deliver the service. Each processes only what it needs to, and each has its own privacy terms.

We will also disclose information where the law requires it, or to establish or defend a legal claim.

7. Where your information is stored

Our database is hosted in Ireland (the eu-west-1 region), and several of the providers listed above process data in the United States and the European Union. This means personal information is transferred outside South Africa.

We make those transfers on the basis of section 72 of POPIA. The countries and providers concerned are subject to laws or binding agreements that give personal information a level of protection substantially similar to POPIA, and our contracts with these providers require them to protect it and to use it only on our instructions.

8. How long we keep it

• Conversations, customer profiles, leads, bookings and orders - kept while the client business's subscription is active, and deleted within 30 days of that subscription ending
• Knowledge base content - kept until the client removes it or the subscription ends
• Operational and delivery logs - 12 months
• Website enquiries - 24 months from your last contact with us
• Billing and accounting records - 5 years, as required by South African tax law

Where a client business instructs us to delete sooner, we follow that instruction.

9. How we protect it

• All traffic to our website, dashboard and API is encrypted in transit over HTTPS
• Data is separated per client, and every query is restricted to a single client's records
• Access to the database is restricted to staff who need it
• Incoming WhatsApp webhooks are cryptographically verified, and unsigned requests are rejected
• Credentials are held as secrets and are never stored in our code

No system is perfectly secure. If a breach affects your personal information we will notify the Information Regulator and affected people as POPIA requires.

10. Your rights

Under POPIA, and under the GDPR where it applies to you, you may:

• Ask what personal information we hold about you and get a copy of it
• Ask us to correct or complete information that is wrong
• Ask us to delete information - see Data deletion
• Object to processing, and opt out of direct marketing at any time
• Ask for your information in a portable format
• Complain to the Information Regulator of South Africa

Email hello@greymc.co.za to exercise any of these. We respond within 30 days. If your request concerns a conversation with a business that uses Dex, we will pass it to that business and support them in answering it, because the decision is theirs to make.

The Information Regulator can be reached at complaints.IR@justice.gov.za.

11. Cookies

Our website uses cookies for analytics via Google Analytics. You can disable cookies in your browser settings at any time. Dex itself does not use cookies - it runs inside WhatsApp.

12. Children

Our services are meant for businesses and are not directed at children under 18. We do not knowingly collect their information. If you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The current version is always on this page with the date it was last changed. Where a change materially affects our client businesses, we will tell them directly.

14. Contact

Grey Matter Consulting (Pty) Ltd, registration number 2020/255888/07, South Africa. Email hello@greymc.co.za or call +27 81 557 1278.