SwiftForm ("SwiftForm", "we", "us") provides a WhatsApp-based booking and job-management platform for small service businesses. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
We process personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA), and, where it applies, the EU/UK General Data Protection Regulation (GDPR).
1. Who we are
SwiftForm is the responsible party (data controller) for the account and billing information of the businesses that subscribe to our platform.
For the WhatsApp conversations that a subscribing business has with its own customers, that business is the responsible party and SwiftForm acts as its operator (data processor), handling the messages on the business's instructions.
2. Information we collect
2.1 From businesses that sign up
- Business name, contact name, email address, phone number and physical or service address.
- Account credentials (passwords are stored only as salted hashes).
- Business configuration: services offered, pricing, availability, booking rules and automated message content.
- Billing records, subscription status and payment references. Card details are captured and stored by our payment provider, not by SwiftForm.
2.2 From the Meta / WhatsApp connection
When a business connects its WhatsApp Business Account through Meta's Embedded Signup, Meta returns to us:
- The WhatsApp Business Account ID and phone number ID for that business.
- An access token allowing us to send and receive messages on that account's behalf.
- Account status information such as messaging limits, quality ratings and verification state.
We request only the whatsapp_business_management and whatsapp_business_messaging permissions. We do not request access to a user's Facebook profile, friends, pages or advertising data. Access tokens are encrypted at rest.
2.3 From the end customers who message a business
- WhatsApp phone number and WhatsApp profile name.
- Message content exchanged with the business, including text, media and interactive form responses.
- Booking details the customer supplies: service requested, date and time, address, and any notes.
- Message delivery and read status supplied by WhatsApp.
2.4 Technical information
- IP address, browser type and device information when a business uses our dashboard.
- Application logs and error reports used to keep the service running.
3. Why we use it
| Purpose | Legal basis |
|---|
| Delivering the booking and messaging service a business signed up for | Performance of a contract |
| Sending and receiving WhatsApp messages, reminders and booking confirmations on a business's behalf | Performance of a contract; legitimate interest of the business |
| Billing, subscription management and fraud prevention | Performance of a contract; legal obligation |
| Security monitoring, debugging and service improvement | Legitimate interest |
| Support correspondence | Performance of a contract; legitimate interest |
| Marketing emails to business subscribers | Consent, withdrawable at any time |
We do not sell personal information. We do not use WhatsApp message content for advertising, and we do not use it to train machine learning models.
4. Who we share it with
We share personal information only with service providers that help us run the platform, and only to the extent each one needs:
- Meta Platforms, Inc. — WhatsApp Business Platform message delivery.
- Twilio Inc. — phone number provisioning and SMS verification.
- Paystack — subscription payment processing.
- Our hosting and infrastructure providers — application, database and backup hosting.
We may also disclose information where we are legally required to do so, or to establish, exercise or defend a legal claim.
5. Where it is stored
Our infrastructure providers may process and store data outside South Africa. Where information is transferred across borders, we rely on the provider's contractual safeguards and, for GDPR-covered transfers, on Standard Contractual Clauses.
6. How long we keep it
- Business account data: for the life of the account. When a business deletes its account there is a 30-day grace period during which it can be restored; after that everything is permanently deleted. Backups roll off within a further 90 days.
- Conversation history and bookings: up to 24 months, or until the business deletes it, deletes the customer's record, or deletes its account.
- Billing and tax records: five years, as required by South African tax law. When an account is deleted these are kept in anonymised form — payment references and amounts only, with name, email and phone number removed.
- Deleted customers: when a business deletes a customer's data at their request, we keep only a one-way hash of the phone number so that we can recognise and ignore future messages from it. The hash cannot be turned back into the number.
- Application logs: up to 30 days.
- Records held by our providers: Paystack keeps payment records under its own policy; Twilio holds regulatory documents for platform-supplied numbers until we delete them when an account is purged; Meta holds the WhatsApp Business Account, which belongs to the business and is never deleted by us.
7. Security
- Traffic is encrypted in transit with TLS.
- WhatsApp access tokens and other credentials are encrypted at rest.
- Passwords are stored as salted hashes and are never recoverable in plain text.
- Every database query is scoped to a single business, so one tenant cannot read another's data.
- Access to production systems is restricted to authorised personnel.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.
8. Your rights
Subject to POPIA and, where applicable, the GDPR, you may:
- Ask what personal information we hold about you and request a copy.
- Ask us to correct information that is inaccurate or incomplete.
- Ask us to delete your information — businesses can do this themselves in Settings, and can delete an individual customer's data from the Customers page; see Data Deletion.
- Object to processing based on legitimate interest.
- Withdraw consent where we rely on it.
- Lodge a complaint with the Information Regulator of South Africa, or with your local supervisory authority.
Email djones@swiftform.co.za to exercise any of these. We respond within 30 days.
9. Opting out of messages
An end customer can stop automated WhatsApp messages at any time by replying STOP to the business. We record the opt-out and suppress further automated messages to that number.
10. Children
SwiftForm is intended for businesses and their adult customers. We do not knowingly collect personal information from children under 18. If we learn that we have, we delete it.
11. Changes to this policy
We may update this policy. The "last updated" date at the top will change, and material changes will be communicated to subscribing businesses by email.
12. Contact
Questions, requests or complaints: djones@swiftform.co.za