Privacy Policy.

MSHENGUX (PTY) LTD, registration number 2023/690008/07, of Stand 786, 57 Sunningdale Crescent, Peach Tree X01, Centurion, Gauteng, 0157, South Africa, is the responsible party for the personal information described here.

• Information Officer: Simphiwe Tshabalala, Director
• Email: sim@mshengux.co.za
• Telephone: +27 81 052 7882
• Address: Stand 786, 57 Sunningdale Crescent, Peach Tree X01, Centurion, Gauteng, 0157, South Africa

This policy covers mshengux.co.za, the MshenguX AI portal, the sign-up wizard, and the agents themselves wherever they talk to you.

You give us

• Account details: your name, email address, mobile number, and for a business its name, industry, size, website and a description of what it does.
• Household details, if you set one up: who is in the group and what each person may see.
• Work content: whatever you or your agents put through the service — invoices, statements, messages, documents, lists, dates, approvals and the reasons you give for them.
• Public profiles, only if you paste them at sign-up. We read once what those pages already show to anyone, show you exactly what we found, and never read them again.

Your connected systems give us

If you connect an accounting platform, a mailbox or a bank feed, we receive the data that connection covers — and only after you approve it on the provider’s own consent screen. You can revoke any connection in the portal, which stops the flow immediately.

Payments

We receive from Paystack the outcome of each payment, the amount, and the card’s last four digits, type and expiry. We never receive or store your full card number, expiry or CVV. Those are entered on Paystack’s own secure page.

Automatically

Technical records needed to run and secure the service: IP address, browser type, timestamps, pages requested, and error logs.

• To perform our contract with you — creating your account, building and running your agents, taking payment, keeping your balance, giving support. (POPIA s11(1)(b))
• To meet legal obligations — issuing tax invoices, keeping accounting records for the periods the Tax Administration Act and Companies Act require, and responding to lawful requests. (s11(1)(c))
• For our legitimate interests — keeping the platform secure, preventing fraud and abuse, and improving how it works in the aggregate. (s11(1)(f))
• With your consent — connecting an outside system, reading a public profile you paste, or sending you anything that is not about your own account. (s11(1)(a)) You can withdraw consent at any time.

What we do not do

• We do not sell your personal information. Ever, to anyone.
• We do not use your data, or your agents’ content, to train AI models. Neither does our model provider.
• We do not use your data for any customer but you.
• We do not send marketing to you unless you ask for it, and every message we do send has an unsubscribe.

Your data is stored on our servers in Johannesburg, South Africa.

Your agents think using Claude, an AI model operated by Anthropic outside South Africa. Only the text needed for a particular task is sent, it is not used to train models, and it is handled under the cross-border rules in section 72 of POPIA — the recipient is bound by contractual terms that uphold a level of protection substantially similar to POPIA.

Who else processes your information

• Paystack Payments South Africa — card and instant EFT payments. PCI-DSS compliant; card data stays with them.
• Anthropic — the AI model your agents reason with, as described above.
• Cloudflare — serving this website and protecting it from attack.
• Telegram, or another chat platform you choose, for the conversation between you and your agents.
• Systems you connect yourself — your accounting platform, mailbox or bank feed, on the consent you gave.

Each of these is an operator bound by a written agreement to process your information only on our instructions and to keep it secure. We share personal information with no one else, except where the law requires it or to establish or defend a legal claim.

• While your account is open: for as long as you need it. Your agents’ record is append-only so that you can always see what was done and why.
• When you close your account: every agent is paused, the saved card is removed at once, and your data is deleted 30 days later. The 30 days exist so that a closure by mistake can be undone.
• Accounting records: invoices, payments and the records the Tax Administration Act and Companies Act require are kept for five years after the end of the relevant tax year, whatever else you delete.

You can delete individual data from the portal at any time without closing the account.

Under POPIA you may:

• Ask what we hold about you, and get a copy.
• Correct or complete anything wrong or out of date.
• Delete information we no longer have a lawful reason to keep. Most of it you can delete yourself from the portal.
• Object to processing based on our legitimate interests.
• Withdraw consent you gave, including by revoking a connected system.
• Ask for your data in a portable form — the record and your agents’ content export from the portal.
• Complain, to us and to the Regulator.

Write to sim@mshengux.co.za. We answer within 30 days and charge nothing, unless a request is repetitive or excessive.

The Regulator

You may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg — enquiries@inforegulator.org.za, inforegulator.org.za. Complaint forms and the current complaints address are on their website.

We hold personal information under appropriate technical and organisational measures: encryption in transit, access limited to the people who need it, credentials for connected systems sealed so that they are never shown again after you enter them, and an append-only record of what every agent did.

Approval gates are part of security, not only of design: an agent cannot send, pay, buy or change anything on its own, so a compromise of an agent cannot move your money.

No system is perfect. If a breach affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires, as soon as reasonably possible after establishing the facts.

This website sets no advertising or tracking cookies and carries no third-party analytics.

The portal and the sign-up wizard use your browser’s own session storage to hold your portal key and the state of the form so that you are not thrown out when you come back from the payment page. It is cleared when you close the tab. Cloudflare may set a strictly necessary cookie to protect the site from attack.

The service is for adults. We do not knowingly collect the personal information of a child under 18 except where an adult in a household account chooses to record it — a child’s pocket money in a family ledger, for example — which that adult does as the competent person under section 35 of POPIA, and which they can delete at any time.

We update this policy when the service changes. The “last updated” date at the top always reflects the current version, and material changes are emailed to account holders before they take effect.

Questions, requests and complaints: sim@mshengux.co.za, 081 052 7882, or Stand 786, 57 Sunningdale Crescent, Peach Tree X01, Centurion, Gauteng, 0157, South Africa.