Privacy and Content Policy

Personal Information: Information relating to an identifiable, living natural person or existing juristic person, as defined by POPIA and GDPR. Data Subject: The individual or entity to whom the personal information relates. Processing: Any operation or activity concerning personal information, including collection, storage, use, dissemination, or destruction. Child: For the purposes of this policy, a person under the age of 18 years. Platform: The website, application, and digital services operated by Appetite Technology (Pty) Ltd, trading as "Naya CRM".

To the extent relevant and applicable, all references to the Protection of Personal Information Act, 4 of 2013 (POPIA) and the General Data Protection Regulation (EU) 2016/679 (GDPR) shall be construed as functionally equivalent and shall be interpreted interchangeably for the purposes of this Policy. The provisions of this document shall therefore be read and applied in a manner that gives effect to the core principles, rights, and obligations prescribed by either or both regimes.

Where a conflict arises between POPIA and GDPR, or where jurisdiction-specific requirements differ, the more stringent, expansive, or protective standard affording greater rights to the Data Subject shall prevail. This ensures that, regardless of the applicable jurisdiction, the highest level of data protection and privacy compliance is maintained at all times. Nothing in this Policy shall be construed as limiting any rights afforded to a Data Subject under either legal regime, and Naya CRM undertakes to implement reasonable and appropriate safeguards to uphold those rights consistently across all regions in which it operates.

Naya CRM acknowledges its legal and ethical obligation to protect the personal information of users and complies with the Protection of Personal Information Act, 4 of 2013 (POPIA). We undertake to process all personal information in accordance with the conditions for lawful processing set out in Chapter 3 of POPIA, including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.

Personal information will only be collected and processed where: (a) the data subject consents thereto; (b) processing is necessary to carry out actions for the conclusion or performance of a contract; (c) processing complies with an obligation imposed by law; (d) it protects a legitimate interest of the data subject or a third party; or (e) it is necessary for the proper performance of a public law duty or to pursue our legitimate interests.

In accordance with POPIA, data subjects have the right to access their personal information; request correction, deletion or destruction of personal information; object to processing or to direct marketing; and lodge a complaint with the Information Regulator. Naya CRM has implemented appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession, to prevent loss, damage, unauthorised destruction, or unlawful access.

Contact Information — name, email address, phone number, physical address.

Professional Details — job title, company name, industry.

Digital Identifiers — IP address, browser type, device information.

Usage Data — interactions with our platform, preferences, and settings.

Content Provided — any information you or your team choose to store in your workspace, including leads, contacts, notes, messages, voice notes, documents, and files.

Payment and Transaction Data — any information required to process payments, including billing addresses and transaction history.

Device and Technical Data — operating system, device type, technical identifiers, and, where you enable notifications, a device token so we can alert you to new leads, tasks, and messages.

Direct Interactions — when you register, create or update records, or contact us. Automated Technologies — cookies and similar tracking technologies that collect data about your interactions with our platform. Third-Party Integrations — when you link or interact with third-party services through our platform. Public Sources — where legally permissible, we may collect information from public records, company registries, or business profiles as part of lead enrichment.

Service Delivery — to operate your workspace and provide our services. Communication — to send updates, respond to enquiries, and provide customer support. Improvement — to analyse usage patterns and improve our platform. Legal Compliance — to comply with legal obligations and protect our rights. Fraud Detection and Risk Management — to detect and prevent fraudulent activity. Marketing (with consent) — to send promotional content, offers, or updates you have opted into.

We may use your information to send promotional emails or marketing materials where you have opted in, or where we rely on legitimate interest. You may withdraw consent or opt out of marketing communications at any time by clicking unsubscribe or contacting us directly.

Naya CRM processes personal information in accordance with the lawful bases provided under POPIA and GDPR. Consent: where you have given voluntary, specific, and informed consent for one or more defined purposes — you may withdraw consent at any time, provided that such withdrawal does not affect the lawfulness of processing conducted prior to withdrawal. Contractual Necessity: where processing is necessary to enter into or perform a contract with you, including providing access to our platform, managing your account, or responding to service requests. Legal Obligation: where we are required to process your personal information to comply with applicable laws, regulations, legal processes, or enforceable governmental requests. Legitimate Interests: where processing is necessary for our legitimate business interests, such as improving and securing our platform, preventing fraud, enforcing legal claims, or understanding user behaviour, except where such interests are overridden by your fundamental rights and freedoms.

We apply the legal basis most appropriate to the specific processing activity and the jurisdiction in which it takes place. Where more than one basis applies, we will rely on the one that offers the highest level of protection to the data subject.

Service Providers — third parties who assist us in operating our platform, subject to confidentiality agreements. These currently include Supabase (database, authentication, and file storage), Paddle and Paystack (payment processing), Twilio (SMS, WhatsApp and voice), Resend (email delivery), contact-enrichment providers, and calendar and meeting providers. Each provider is bound by its own data-processing terms and only receives what it needs to perform its function.

Legal Authorities — when required by law or to protect our legal rights. Business Transfers — in the event of a merger, acquisition, or sale of assets. Affiliates and Subsidiaries — for internal business, compliance, and administrative purposes. We do not sell your personal information to third parties.

Where you choose to connect a Google account, Naya CRM requests only the narrowest permissions needed for the calendar feature to work, and nothing more. We request three scopes. See your Google account email (userinfo.email) so we can show you which account is connected and prevent you connecting the wrong one. See, create, edit and delete events on your calendars (calendar.events) so Naya can place a meeting on your calendar when you or a prospect books one, and keep it up to date if it moves. See the list of calendars you own (calendar.calendarlist.readonly) so you can choose which calendar an event is written to.

We do not request access to Gmail, Google Drive, Google Contacts, or any other Google service, and we cannot read your email or your files. We cannot change your calendar sharing settings.

What we store. Your Google access and refresh tokens are encrypted with AES-256-GCM before they are written to our database, and are decrypted only in memory at the moment a request is made on your behalf. We store the email address of the connected Google account so it can be displayed to you. We keep an audit log of calendar actions we take — the action performed, whether it succeeded, and the identifier and title of the event concerned — so that you can see exactly what Naya did on your calendar and so we can investigate failures. We do not copy your calendar into our systems, and we do not read events we did not create.

What we never do. We do not sell, rent or trade Google user data. We do not use it for advertising, and we do not transfer it to third parties except as necessary to provide the calendar feature you asked for, to comply with applicable law, or as part of a merger or acquisition in which it remains subject to this Policy. We do not use Google user data to train, retrain or improve any artificial-intelligence or machine-learning model, whether our own or a third party's. No human at Appetite Technology reads your Google user data, except where you have expressly asked us to investigate a problem, or where we are compelled to by law.

Limited Use. Naya CRM's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access and deletion. You may disconnect Google at any time from the connection panel inside Naya CRM. Disconnecting revokes the token with Google and deletes it from our database immediately. You may also revoke our access directly from your Google Account permissions page. To request deletion of the audit log of calendar actions, contact us using the details in the "Contact us" section below and we will action it within the period set out in "Data retention periods".

Naya, our AI assistant, together with our enrichment, summarisation and drafting features, sends the relevant text or content to third-party AI providers — currently Google Gemini, DeepSeek, OpenAI, or equivalent providers, depending on availability — solely to generate a reply or extract the requested information. These providers process the request under our commercial terms with them and do not use it to train their own public models. We do not use your customer data to train foundation models.

Encryption — securing data in transit and at rest. Access Controls — limiting access to authorised personnel, with every workspace isolated by row-level security. Regular Audits — monitoring and testing our security systems. Breach Notification — in the event of a data breach, we will notify you and the appropriate regulators in accordance with legal requirements.

We retain your personal information only as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. For example, user account information is retained for the duration of your active use and up to 12 months after closure. Billing records are kept for 5 years in accordance with tax laws. Upon request, we will delete or anonymise your personal information, subject to legal and contractual obligations. Data no longer required will be securely destroyed or anonymised.

Under POPIA and GDPR, you have the right to: Access — request access to your personal information. Correction — request correction of inaccurate or incomplete information. Deletion — request deletion of your personal information. Data Portability — request a copy of your personal data in a structured, commonly used, machine-readable format. Objection — object to the processing of your personal information. Complaint — lodge a complaint with the Information Regulator or relevant supervisory authority.

To exercise these rights, please contact us at admin@nayacrm.co.za. We will respond to your request within the statutory time frame and may request identity verification before actioning.

We use cookies and similar technologies to enhance your experience on our platform. You can manage your cookie preferences through your browser settings. You may opt out of non-essential cookies at any time.

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these websites and encourage you to read their privacy policies. Use of such links is at your own risk.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children without parental consent. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information. In accordance with children's data-protection codes and GDPR: Age of Consent — users must be at least 16 years old to provide consent, unless the applicable law allows for a lower age (not below 13 years). Parental Consent — for users under the age of consent, verifiable parental consent is required. Data Minimization — we collect only the data necessary to provide our services to children with parental consent. Transparency — our privacy notices are written in clear and plain language. Default Settings — the highest privacy settings are enabled by default for child users. We reserve the right to restrict or terminate child user accounts if parental consent cannot be verified.

We may transfer your personal information to countries other than the one in which you reside. These countries may have data protection laws that are different from those of your country. We ensure that appropriate safeguards are in place to protect your personal information.

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Substantive changes will be communicated to you where required by law.

If you have any questions or concerns about this policy or our data practices, please contact us at: Appetite Technology (Pty) Ltd, trading as Naya CRM, registration number 2023/849612/07, registered office: 350 Parkstation Road, Greenwood Park, Durban, KwaZulu-Natal, 4051, South Africa. Email admin@nayacrm.co.za for legal and privacy queries, or support@nayacrm.co.za for product support.

We may collect certain personal information related to your device when you visit our websites, such as your device's IP address, the referring website, the pages your device visited, and the time and date that your device visited our websites.

We may collect personal information on your preferences for receiving marketing communications and details about how you engage with us.

We may collect a log of your interactions with the Naya assistant, both on our website and inside the product.

We may collect personal information about your use of and access to our services, which may include administrative and support communications with us, third-party integrations you use (if any), and messages, persons, features, content, and links you interact with.

We may collect and store payment information as needed to facilitate transactions with Naya CRM.