Privacy Policy

1.Who we are

Yapp ("Yapp", "we", "us", "our") is a shared WhatsApp inbox service operated by NCK Consulting (Pty) Ltd (trading as Lucci), based in South Africa. This policy covers the Yapp website and application.

2.Our two roles (important)

Yapp handles personal information in two different capacities:

• As a responsible party — for information about our own customers (the businesses that sign up) and their staff users: account details, billing, and usage of the app.
• As an operator — for the customer-conversation data that a business processes through Yapp (their customers' WhatsApp messages). Here the business is the responsible party and decides why and how that data is processed; we process it on their behalf and under their instruction. If you are an end customer chatting with a business that uses Yapp, please refer to that business's own privacy notice.

3.Information we collect

Account & staff users (we are responsible party)

• Name, email address, and a securely hashed password.
• Business/branch details, role, and account settings.
• Billing information — processed by our payment provider, PayFast. We do not store full card details.

Customer conversations (we are operator, on the business's behalf)

• Customers' WhatsApp phone numbers and profile names.
• Message content — text, and (where enabled) images, documents, voice notes, video, and stickers.
• Conversation metadata — timestamps, delivery/read status, which branch handled the chat.

Technical information

• A single essential session cookie to keep you logged in (see clause 7).
• Standard server logs (e.g. IP address, browser type) used for security and reliability.
• On our marketing website only, analytics and advertising tools that set cookies (see clause 7).

4.How we use information

• To provide and operate the service — routing chats, showing conversations, sending replies.
• To manage accounts, authentication, and access control.
• To process subscriptions and payments.
• To provide support and respond to enquiries.
• To keep the service secure, prevent abuse, and meet legal obligations.

We process personal information on the lawful bases permitted by POPIA — to perform our contract with you, to pursue our legitimate interests in running the service, to comply with the law, and with consent where required.

5.WhatsApp & Meta

Yapp connects to the WhatsApp Business Platform provided by Meta Platforms, Inc. When customers message a business through WhatsApp, their messages pass through Meta's systems, which are subject to Meta's and WhatsApp's own privacy terms. We receive and store those messages to provide the service to the business.

6.Who we share information with (operators & sub-processors)

We do not sell personal information. We share it only with service providers who help us run Yapp, under appropriate confidentiality and data-protection terms:

• Hosting & database — our cloud hosting provider (Railway).
• Payments — PayFast (subscription billing).
• Messaging — Meta / WhatsApp Business Platform.
• Media storage — Cloudflare (where media features are enabled).
• Email delivery — Resend, for transactional emails such as password resets and team invitations.
• AI reply suggestions — Groq, our AI provider, and only for businesses that switch this optional feature on (see below).
• Website analytics & advertising — Google Analytics and Meta Pixel, on our marketing website only (see clause 7).
• Legal — authorities where we are required by law to disclose.

AI reply suggestions. If a business switches on the optional AI reply feature, the recent text of a conversation is sent to our AI provider (Groq) to generate a suggested reply for an agent to review — nothing is ever sent to the customer automatically. The feature is off by default and controlled by the business. Media files, and conversations where the feature is off, are never sent to the AI provider.

7.Cookies & analytics

The Yapp application uses a single essential cookie to keep you securely signed in. It is strictly necessary for the app to work and is never used for advertising.

Our marketing website (yapp.co.za) uses measurement and advertising tools that set cookies and similar technologies:

• Google Analytics 4 — to understand how visitors find and use the site (pages viewed, approximate location, device type) so we can improve it. Learn how Google uses this data at policies.google.com.
• Meta Pixel — to measure how our ads perform and to show relevant Yapp ads on Facebook and Instagram to people who have visited the site (retargeting).

We ask for your consent before these load: on your first visit a cookie banner lets you Accept all, or Manage your choice for analytics and advertising separately. Nothing loads unless you allow it, and you can change your choice at any time using the “Cookie preferences” link in the site footer.

These tools run only on our marketing website — never inside the app and never on customer conversations. You can also block or clear cookies in your browser settings, opt out of Google Analytics with Google's browser add-on, and control ad personalisation in your Facebook ad preferences.

8.How long we keep information

• Account data — kept while your account is active, and for a reasonable period afterwards as required for legal, tax, and record-keeping purposes.
• Conversation text — retained as part of the business's central record for as long as the business keeps its account, unless they delete it.
• Media files — images, documents and other attachments are automatically deleted after a retention window that depends on the plan: from as little as 1 hour on the Free plan up to 30 days on Pro. The conversation text remains after the file is gone.
• On termination, we make data available for export for a reasonable period, after which it may be permanently deleted.

9.How we protect information

• Encryption in transit (HTTPS/TLS) across the service.
• Sensitive credentials (such as WhatsApp access tokens) are encrypted at rest.
• Role-based access — staff only see the conversations they are entitled to; isolation keeps each business's data separate.
• Passwords are stored only as salted, hashed values, never in plain text.

10.Cross-border transfers

Some of our service providers (for example Meta and Cloudflare) may process information on servers outside South Africa. Where personal information is transferred across borders, we rely on the safeguards permitted by section 72 of POPIA, including that the recipient is subject to laws or agreements providing an adequate level of protection.

11.Your rights

Subject to POPIA, you have the right to:

• Request access to the personal information we hold about you.
• Ask us to correct or delete information that is inaccurate or no longer needed.
• Object to certain processing.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these, email hello@yapp.co.za. If your query is about conversations held by a business that uses Yapp, we will direct you to that business as the responsible party. You can contact the Information Regulator (South Africa) at inforegulator.org.za.

Deleting your data. You can disconnect WhatsApp at any time in Settings → Disconnect (this removes the connection and permanently deletes the stored credentials), and request full deletion of your account and data by emailing hello@yapp.co.za. If you installed Yapp through Shopify, uninstalling the app automatically deletes your workspace data. Step-by-step instructions are on our Data Deletion page.

12.Children

Yapp is a business tool and is not intended for children. We do not knowingly collect the personal information of children through the service.

13.Changes to this policy

We may update this policy from time to time. If we make material changes, we will give reasonable notice (for example by email or an in-app notice). The "last updated" date above always reflects the current version.

14.Contact

Questions about your privacy or this policy? Email us at hello@yapp.co.za.