Privacy Notice
How we collect, use, store and protect personal information, in line with POPIA.
This notice explains how we collect, use, store and protect personal information, in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").
Please read section 4 carefully if you upload client documents to Broker AI. In that situation we act as your operator, not as the responsible party, and specific obligations apply to both of us.
1. Who we are
| Registered name | Broker AI (Pty) Ltd |
| Registration number | 2026/318666/07 |
| Trading as | Broker AI |
| Physical address | 2 Niagara Road, Tygervalley, Cape Town, 7530 |
| Postal address | 2 Niagara Road, Tygervalley, Cape Town, 7530 |
| admin@brokerai.co.za | |
| Telephone | 082 554 2605 |
| Website | https://broker-ai.org |
Information Officer: Dean Geldenhuys, admin@brokerai.co.za Registered with the Information Regulator in terms of section 55 of POPIA.
In this notice, "we", "us" and "our" refer to the entity above. "You" refers to the person or brokerage using the Broker AI service.
2. What this notice covers
This notice applies to:
- the broker-ai.org website
- the Broker AI application and any account you create on it
- documents and content you upload to the service
- email and other correspondence with us
It does not apply to third-party websites we link to.
3. Information we collect
3.1 Information you give us
Account information. Your name, work email address, telephone number, brokerage name, FSP number where you provide it, job title or role, and your password (stored in hashed form — we never see or store your password in readable form).
Billing information. Your billing name, billing address and payment records. Card details are entered directly with our payment processor, Stitch, and are never received or stored by us.
Content you upload. Policy wordings, schedules, client information, correspondence and any other documents, audio or text you submit to the service, together with the outputs Broker AI generates from them.
Correspondence. Anything you send us by email, through a support channel or through a form on the site.
3.2 Information we collect automatically
- IP address, browser type and version, device and operating system
- Pages viewed, features used, timestamps and session duration
- Error and diagnostic logs
We do not use cookies. See section 10.
3.3 Information we do not want
Do not upload information that is not necessary for the task you are performing. In particular, do not upload South African ID numbers, bank account details, medical information, or biometric data unless the specific piece of work genuinely requires it. POPIA treats several of these as special personal information under section 26, with stricter conditions attached.
4. Client information you upload — our role as operator
This section is the most important one for brokerages.
When you upload a document containing your client's personal information, you remain the responsible party for that information. Your client is your data subject, not ours. We process that information only on your instruction and for the purpose of producing the output you have asked for. That makes us your operator as defined in POPIA.
What this means for us. In terms of sections 20 and 21 of POPIA we will:
- process client information only with your knowledge or authorisation
- treat it as confidential and not disclose it unless the law requires us to
- secure its integrity and confidentiality under section 19
- notify you immediately where there are reasonable grounds to believe it has been accessed or acquired by an unauthorised person
- not use it for our own purposes, and not use it to train or improve any AI model (see section 5)
What this means for you. You are responsible for having a lawful basis to share your client's information with us, and for having told your clients that you use third-party service providers to process their information. Your own privacy notice and client mandates should cover this.
Written operator agreement. Section 21(2) of POPIA requires a written contract between a responsible party and its operator. Our Terms of Service include those provisions. If your compliance function requires a standalone Data Processing Agreement, request one from admin@brokerai.co.za and we will provide it.
5. How AI processing works
Broker AI uses large language models to generate draft Records of Advice, risk analyses and client correspondence from the documents you supply.
We do not use your uploaded documents, or the outputs generated from them, to train or improve any AI model. This applies to our own systems and, contractually, to the AI providers we use.
Sub-processors. Producing an output involves several third parties, and more of them than most people expect — the model that writes the text, a text-extraction service that reads scanned pages, a search index for in-document chat, and a live progress stream to your browser. The complete, current list, naming what each one receives and where it processes, is available on request from admin@brokerai.co.za. We maintain it as a separate document so that it stays accurate as providers change, and we give 30 days' notice before adding or replacing one.
The short version: document content is processed by Anthropic, OpenAI and Google, all outside South Africa, under commercial API licences that prohibit training on it. Storage is on Amazon Web Services in Cape Town.
Output is a draft. Broker AI produces drafts for review. Every output must be checked, amended where necessary and approved by an appropriately authorised representative before it is relied on or provided to a client. Broker AI does not render financial services, does not give advice as defined in the Financial Advisory and Intermediary Services Act 37 of 2002, and is not a licensed financial services provider. Responsibility for the advice, and for compliance with the FAIS General Code of Conduct, remains with you.
6. Why we process your information, and on what basis
| Purpose | Lawful basis under POPIA section 11 |
|---|---|
| Creating and administering your account | Necessary to perform our contract with you — s 11(1)(b) |
| Generating outputs from documents you upload | Necessary to perform our contract with you — s 11(1)(b) |
| Billing, invoicing and collecting payment | Necessary to perform our contract with you — s 11(1)(b) |
| Providing support and responding to queries | Necessary to perform our contract with you — s 11(1)(b) |
| Security, fraud prevention, abuse monitoring and diagnostics | Our legitimate interests — s 11(1)(f) |
| Improving the service (aggregated usage patterns, not document content) | Our legitimate interests — s 11(1)(f) |
| Meeting legal, tax and regulatory obligations | Compliance with an obligation of law — s 11(1)(c) |
| Sending marketing communications about our services | Your consent, or the existing-customer route in s 69(3) |
You may object to processing based on legitimate interests at any time. See section 9.
7. Direct marketing
We will only send you electronic marketing where POPIA section 69 allows it — that is, where you have consented, or where you are an existing customer, the communication relates to our own similar products or services, and you were given an opportunity to object when we collected your details and in every message since.
Every marketing message we send identifies us and gives you a way to opt out. If you opt out we will record it and stop, and we keep a suppression register so it stays stopped.
If you were contacted by us before becoming a customer, that was a once-off approach in terms of section 69(2). If you did not respond, we will not have contacted you again.
8. Where your information is stored, and for how long
Storage location. Account data, uploaded documents and generated outputs are stored on Amazon Web Services infrastructure in the af-south-1 (Cape Town) region, within the Republic of South Africa.
Transborder flows. Producing an output requires transmitting document content to AI providers outside the Republic, and streaming progress back to your browser through infrastructure in the European Union. Every such transfer, and the provider involved, is set out in our sub-processor list, available on request from admin@brokerai.co.za.
We make these transfers in terms of section 72 of POPIA on the basis that:
- they are necessary for the performance of our contract with you, and for the implementation of measures taken in response to your request — section 72(1)(c) and (d); and
- each provider is bound by a data processing agreement imposing obligations materially equivalent to the conditions for lawful processing under POPIA — section 72(1)(a).
Under those agreements, no provider uses content submitted through our commercial API licences to train or improve their models, and content is not retained beyond what is required to return the output and to meet the provider's own limited abuse-monitoring obligations. Each provider's specific retention window is set out in their data processing agreement, and we will provide those terms to your compliance function on request.
Stored documents and outputs remain in South Africa. It is the processing required to generate an output, and the live progress stream, that occur offshore.
Retention.
| Data | Retention period |
|---|---|
| Uploaded source documents | 5 days from upload, deleted automatically |
| Generated outputs | Retained until you delete them, or on request. We do not expire them on a schedule — brokers rely on being able to return to a document produced months earlier |
| Records of jobs you have run, including information extracted from your documents | 400 days, then deleted automatically |
| Account information | For the life of your account, then deleted on closure or on request |
| Security and access logs | Between 1 and 90 days depending on the system; the main application log is retained for 14 days |
| Billing, tax and company records | The applicable statutory period. Different records carry different minimums under the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008 — some company records require seven years — so we retain each for the period the relevant law requires rather than applying one figure across all of them |
| Marketing suppression records | Indefinitely — we must retain these to honour your opt-out |
| Backups | Deleted data clears our backups within 35 days |
We delete or de-identify information once the purpose for holding it has ended, unless a law requires us to keep it.
9. Your rights
Under POPIA you have the right to:
- Be told what personal information we hold about you, and to receive a copy
- Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
- Object to processing based on legitimate interests, on reasonable grounds
- Opt out of direct marketing at any time
- Complain to the Information Regulator
- Not be subject to a decision based solely on automated processing that has legal consequences for you
How to exercise them. Email admin@brokerai.co.za, or use the forms in our PAIA Manual at /paia. An objection is made on Form 1 and a correction or deletion request on Form 2 of the POPIA Regulations. We respond within 30 days. There is no charge for objecting or for requesting correction or deletion. A request for access to a record may attract the prescribed fee set out in our PAIA Manual.
We may ask you to verify your identity before we act, to make sure we are not disclosing your information to somebody else.
How deletion works in practice. You can delete any document you have generated from within the application yourself. A request to delete an account and everything associated with it is actioned by our team rather than by an automated process — email admin@brokerai.co.za and we will remove it and confirm in writing.
Getting a copy of your data. You can download any document you have generated at any time from within the application. We do not yet offer a single self-service export of everything at once; if you need a complete extract — for a migration, an audit or a regulatory request — email admin@brokerai.co.za and we will produce it.
If your client asks us directly. If we receive a request from one of your clients about information you uploaded, we will refer them to you, because you are the responsible party for that information. We will tell you when this happens.
10. Cookies and analytics
Broker AI does not use cookies.
We keep you signed in using your browser's local storage rather than a cookie, so there is nothing to consent to and no cookie banner. We do not use analytics cookies, advertising cookies or cross-site tracking of any kind, and we do not run a third-party analytics or session-recording tool on this website.
Our web pages load no third-party fonts, scripts or stylesheets, so no third party receives your IP address simply because you visited us.
We do record technical diagnostic information about errors and performance within the application itself, in our own AWS infrastructure in Cape Town. That is used to keep the service working and is not shared with anyone.
11. Security
We apply reasonable technical and organisational measures under section 19 of POPIA, including:
- encryption in transit (TLS 1.2 or higher) and at rest, using AWS KMS with a customer-managed key for the stores that hold your documents
- role-based access control and least-privilege access to production systems
- multi-factor authentication available to all users, and enforceable across your whole organisation by your administrator
- logging and monitoring of access to production data
- rate limiting and login throttling
- a web application firewall in front of the application and the API
- continuous database backups with a 35-day point-in-time recovery window
Our security measures are described in full, including what we do not have, at /security.
No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 requires.
12. Changes to this notice
We may update this notice. The current version is always at https://broker-ai.org/privacy with the date at the top. Where a change materially affects how we process your information, we will notify account holders by email before it takes effect.
13. Contact us, and the Regulator
Us: admin@brokerai.co.za · 082 554 2605 · 2 Niagara Road, Tygervalley, Cape Town, 7530
Information Officer: Dean Geldenhuys, admin@brokerai.co.za
If you are not satisfied with how we have handled your information, you may complain to:
The Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg P.O. Box 31533, Braamfontein, Johannesburg, 2017 General enquiries: enquiries@inforegulator.org.za POPIA complaints: POPIAComplaints@inforegulator.org.za PAIA complaints: PAIAComplaints@inforegulator.org.za Website: https://inforegulator.org.za eServices Portal: https://eservices.inforegulator.org.za