Last updated: 25 October 2026
This policy explains how Express Design Agency (“we”, “us”) collects and uses personal information when you visit expressdesignagency.com, chat with us, or use ED-ChatBot (the WordPress plugin, ChatBot Cloud and the Inbox app). We follow South Africa’s Protection of Personal Information Act (POPIA) and, where it applies, the EU and UK GDPR.
Who we are
Express Design Agency, Cape Town, South Africa. Information Officer: our Founder & CEO. Contact: admin@expressdesignagency.com.
What we collect
- When you chat with us or fill in a form: your name, email, phone or WhatsApp number, your messages, the page you were on, your browser language and a one-way scrambled (hashed) version of your IP address used to stop spam.
- When you book a call: the service, date and time, your contact details and any note you add.
- When you create an ED-ChatBot account: your business name, your name, email, a securely scrambled password, your settings and the content you add (knowledge base, replies).
- When you pay: your plan, payment status and the reference numbers Paystack gives us. Card details are entered on Paystack’s secure page and are never seen or stored by us.
- Technical data: basic server logs and, on our website, a small amount of browser storage that remembers your language, your chat session and your currency choice.
Why we use it
- To answer your questions and follow up, including by email, phone or WhatsApp when you ask us to.
- To provide ED-ChatBot: run your chatbot, show your conversations, leads and bookings, send notifications and reports.
- To manage subscriptions and payments.
- To keep our services secure, prevent spam and abuse, and fix problems.
- To meet legal and tax obligations.
We rely on your consent (you tick the box before chatting), on the contract with you (your account and subscription), and on our legitimate interest in keeping our services safe and working. We do not sell personal information and we do not use it for advertising.
ED-ChatBot customers and their visitors
When a business uses ED-ChatBot on its own website, that business is responsible for its visitors’ information and decides how it is used. We process those chats, leads and bookings only on the business’s behalf, to provide the service. Visitors of those websites should read that business’s privacy policy and contact the business about their information.
Who we share it with
- Hosting: our website host in South Africa, and Fly.io for ChatBot Cloud (servers in Johannesburg).
- Payments: Paystack, for subscriptions.
- AI answers: when AI replies are switched on, the conversation and relevant knowledge are sent to the chosen AI provider (Anthropic or OpenAI) to write the reply. They may process it outside South Africa under their own data protection terms.
- Email and notifications: the services that deliver our emails and phone notifications.
- Authorities, when the law requires it.
Some of these providers are outside South Africa. When information leaves the country, we use providers that protect it to a standard similar to POPIA.
How long we keep it
Chats and leads on our own website are kept for as long as we need them to help you, and no longer than 2 years after our last contact unless you become a customer. Account data is kept while your account is open and deleted within 90 days after you close it, except billing records we must keep for tax purposes (usually 5 years). Businesses using ED-ChatBot can set their own automatic deletion period.
Your rights
You can ask to see the information we hold about you, correct it, delete it, or object to how we use it, and you can withdraw consent at any time. Email admin@expressdesignagency.com and we will reply within 30 days. If you are not happy with our answer, you can complain to the Information Regulator of South Africa (inforegulator.org.za).
Security
We use encrypted connections (HTTPS), scrambled passwords, encrypted storage for ChatBot Cloud, limited staff access and daily backups. No system is perfect; if a breach affects you, we will tell you and the Information Regulator as POPIA requires.
Changes
We will update this page when our practices change and show the date at the top.