EvoBot Privacy Policy

Last updated: 12 October 2026 (version 2026-10-12)

Sufficient Software (Pty) Ltd may amend this document at any time without prior notice by publishing the updated version on this page. The "Last updated" date above shows when it last changed. Please review it regularly.

This policy explains how Sufficient Software (Pty) Ltd (Sufficient Software, we) processes personal information in connection with EvoBot, in line with the Protection of Personal Information Act, 2013 (POPIA). It forms part of the Terms of Service.

1. Our two roles

Responsible party for account information about the people who use EvoBot (for example names, email addresses and usage), which we need to run the Service, bill for it and keep it secure.
Operator for personal information contained in our customers' business data (for example details of their customers, suppliers or staff in Sage Evolution). Our customer is the responsible party for that information and decides what is connected; we process it only on their behalf to provide the Service.

2. What we collect

Account information: name, email address, company name, password (stored only as a secure hash), two-factor settings, role and permissions, and optionally a WhatsApp number you link.
Business data: data the EvoBot agent reads from the Sage Evolution databases you connect, only when needed to answer a question, and the questions, answers and Excel files produced.
Billing information: packages bought, amounts, invoices and payment references. Card details are handled by Paystack and never reach us.
Technical information: IP address, device and browser details, security logs, and bot-protection signals from Cloudflare Turnstile.

3. Why we use it

to create and secure accounts, verify email addresses and prevent fraud and abuse;
to answer questions, produce files and run the Service you asked for;
to process payments, issue invoices and meet tax and legal obligations;
to support you, send service messages (for example low credit warnings) and improve reliability and security.

We rely on the performance of our contract with you, our legitimate interests in operating a secure service, compliance with law, and your consent where required. We do not sell personal information and we do not use your business data to train AI models.

Our staff do not read your chats as a matter of course. Authorised staff may see a question that EvoBot declined under the acceptable use rules, and EvoBot's reply to it, to enforce the Terms of Service. Our main administrator may read the question behind an individual answer to investigate its cost, billing or a fault. Every such view is recorded in our audit log.

4. Who we share it with

We share personal information only with service providers that help run EvoBot, under obligations of confidentiality and security:

AI model providers (Anthropic) that process questions and relevant data to produce answers. With each request we send a pseudonymous identifier (a one-way cryptographic hash of your user and company IDs), never your name or email address, so the provider can tell users apart for safety purposes; only we can link it back to you;
Paystack for payments, Cloudflare for bot protection, Meta (WhatsApp) where you use WhatsApp, and our hosting and email providers;
authorities or others where the law requires it, or to protect our rights, users or the public.

5. Transfers outside South Africa

Some providers, including AI model providers, process information outside South Africa, for example in the United States. We transfer information only as permitted by section 72 of POPIA, such as where the recipient is bound by law, binding rules or an agreement that provides an adequate level of protection, or where the transfer is necessary to perform our contract with you. By connecting data to EvoBot, our customer confirms it may lawfully authorise these transfers.

6. How long we keep it

chat messages: up to 12 months, then deleted automatically;
records of questions declined as outside EvoBot's purpose or acceptable use, and any resulting pause, for as long as the account exists, to enforce the Terms of Service;
Excel files: 24 hours;
invoices and billing records: as long as tax law requires (generally at least five years);
account information: while the account is active and for a reasonable period after, unless the law requires otherwise.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords and tokens, two-factor authentication, signed and read-only data access, tenant isolation, access controls and audit logs. No system is perfectly secure; if a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

8. Your rights

You may ask to access, correct or delete your personal information, object to processing, or withdraw consent, subject to the law. For personal information in a customer's business data, please contact that customer first; we will assist them. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.

9. Direct marketing

We send marketing communications, tips and tricks, and upgrade notices by electronic means only to users who opted in, as required by section 69 of POPIA. Opting in is voluntary, separate from accepting the Terms of Service, and never a condition of using EvoBot. We record when you opted in or out. You can withdraw your consent at any time on your profile page or through the unsubscribe link in every such message, and we will stop sending them. Service messages needed to run your account (for example security, billing and low credit notices) are not direct marketing and continue while you have an account.

10. Cookies

The EvoBot portal uses only strictly necessary cookies: a secure session cookie that keeps you signed in, and cookies set by Cloudflare Turnstile to protect sign-up from automated abuse. Because these cookies are needed for the portal to work and to keep it secure, they cannot be switched off in the portal; you can block or delete them in your browser, but you will then not be able to sign in. We do not use advertising, analytics or third-party tracking cookies. Your acceptance of the cookie notice and your day or night mode choice are remembered in your browser only.

11. Contact

For questions about your personal information or to exercise your rights, contact our Information Officer at info@evobot.co.za or Sufficient Software (Pty) Ltd, PO Box 934, Mokopane, Limpopo, 0600, South Africa. You may also complain to the Information Regulator (South Africa) at www.inforegulator.org.za.

12. Changes to this policy

We may amend this Privacy Policy at any time, without prior notice, by publishing the updated version on this page with a new "Last updated" date; amendments take effect when published. Your continued use of EvoBot after publication constitutes acceptance of the updated policy. Where the law requires prior notice or your consent for a change, we will give that notice or ask for that consent.