Privacy Policy
Last updated 20 September 2026
Draft, not yet reviewed by a lawyer. The facts about how data is handled are accurate. The legal wording is not advice, and the details in square brackets still need filling in before anyone relies on this.
This explains what Chomi collects, why, who else sees it, and what you can ask us to do about it. It is written to meet the Protection of Personal Information Act (POPIA).
Who is responsible
[registered company name] is the responsible party for the personal information described here.
Information officer: [name], [privacy contact email].
Where you use Chomi to process information about your own customers or staff, you are the responsible party and we act as your operator: we process that material on your instructions and for no other purpose.
What we collect
- Account details — name, email address, workspace name, and the password hash. We never see your password itself.
- What you put in — business profile answers, documents you upload, competitor names and websites, briefs.
- Voice recordings and transcripts — the interview audio, and the text produced from it. This is personal information about whoever spoke, which may be you, a colleague or a client's expert.
- Generated content — the drafts produced for you.
- Usage records — which AI calls ran, when, and what they cost, so we can bill and spot problems.
- Payment records — what you bought and when. Card numbers go directly to the payment provider and never reach us.
Why we use it
- To run the service you have asked for — the contract between us.
- To bill you and keep the records the law requires.
- To keep the service working and secure, including investigating abuse.
- To answer you when you get in touch.
We do not sell your information, and we do not use your content to train AI models.
Who else processes it
Running Chomi means sending parts of your material to other companies. Each is bound to use it only to provide their service to us.
- Supabase — database, authentication and file storage.
- Vercel — hosting.
- OpenRouter, which routes to Anthropic, OpenAI and Google — the AI that writes and analyses.
- OpenAI — converting interview audio to text, and document search.
- Stripe, PayFast, Paystack and Yoco — payments.
- Resend — sending email such as password resets.
- Cloudflare — domain and bot protection.
Several of these operate outside South Africa, mainly in the United States and Europe. That is a cross-border transfer under POPIA, made on the basis that it is necessary to perform our contract with you and subject to the contractual protections those providers offer.
Interview recordings
Interviews are recorded so they can be transcribed and used to write your content. If you send an interview link to somebody else, tell them they are being recorded before they start — you are the one with the relationship, and under POPIA you are the one who needs their agreement.
How long we keep things
- While your account is open, we keep your content so the service works.
- When you delete your account, your workspace content is deleted within 30 days.
- Billing and tax records are kept for five years, as South African tax law requires.
- Backups roll off on their own schedule, within 90 days.
Your rights
Under POPIA you may ask us to:
- tell you what personal information we hold about you
- correct anything wrong
- delete it, where we are not required to keep it
- give you a copy in a portable form
- stop processing it for a particular purpose
Most of this you can do yourself in settings, including exporting your data and deleting your account. For anything else, email [privacy contact email] and we will answer within 30 days. If you are unhappy with our answer you may complain to the Information Regulator of South Africa.
Security
Access is restricted per workspace and enforced in the database, not only in the application. Traffic is encrypted in transit and data is encrypted at rest by our providers. No system is perfect; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
Cookies
We set only what is needed to keep you signed in and to remember which client workspace you are viewing. No advertising or tracking cookies.
Changes
If this policy changes materially we will tell you by email or in the app before it takes effect.