Privacy Policy
Effective 9 August 2026
Quiet Automation ("Quiet Automation", "we", "us") builds automations that run routine admin for small and medium businesses. We are operated from South Africa and our website and services are available worldwide. This policy explains what information we collect through quietautomation.co, how we use it, and the choices you have. The short version: we collect only what we need to prepare your automation brief and follow up with you, we never sell your information, and you can ask us to delete it at any time.
Information we collect
What you tell the intake assistant. Our AI audit chat asks about a business workflow you would like to automate. Everything you type is collected so we can prepare your brief, including your first name, email address and phone number if you choose to share them at the end of the conversation. Sharing contact details is optional; the audit completes either way.
What you send us directly. If you email us or contact us through the site, we receive whatever you include in that message.
Technical information. Like most websites, our server records basic technical data such as your IP address, which we use for security and to apply fair-use rate limits on the audit chat. If we enable analytics, we use privacy-focused, cookieless analytics that collect aggregate visit statistics without identifying individual visitors.
We do not knowingly collect information from anyone under 18, and our services are not directed at children.
How we use your information
We use the information above to prepare your automation brief, follow up with you about it on the channel you shared, respond to your messages, operate and secure the website, and improve how the intake assistant works.
Under the Protection of Personal Information Act 4 of 2013 ("POPIA"), we process your personal information on the following grounds:
- Consent (POPIA s11(1)(a)): you choose what to type in the audit chat and whether to share contact details at the end of the conversation. You may withdraw that consent at any time.
- Necessity for a contract (POPIA s11(1)(b)): preparing your automation brief and following up on it are necessary to deliver the service you requested.
- Justifiable interest (POPIA s11(1)(f)): responding to your enquiries, securing the website against abuse, and improving the intake assistant are necessary for the proper administration and legitimate business operations of Quiet Automation, and these interests do not override your rights to privacy.
Where you are subject to the GDPR or UK GDPR, the equivalent bases of consent and legitimate interest apply. You may object to processing on these grounds at any time by contacting us, as set out in Your rights below.
AI processing
The intake assistant is powered by Claude, an AI model provided by Anthropic. Your conversation is sent to Anthropic's API to generate the assistant's responses and your brief. Under Anthropic's commercial terms, API conversations are not used to train their models. Please do not share sensitive information in the chat, such as financial account details, ID or passport numbers, or health information; the assistant does not need it and will never ask for it.
If you nonetheless provide special personal information (as defined in POPIA s26, including health data, biometric data, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, criminal records, or the details of a child's record) in error, we will delete it from our records as soon as we become aware and will not process it further.
Who we share information with
We never sell or rent your information, and we do not share it with advertisers. We share it only with the service providers that make Quiet Automation work:
- Anthropic processes chat conversations to power the intake assistant.
- Railway hosts our website and server, including operational logs.
- Messaging services deliver completed briefs to our team so we can follow up, currently Telegram and a WhatsApp notification relay. The WhatsApp notification deliberately excludes your contact details.
Each provider is bound by a data-processing agreement that limits its use of your information to the purposes described above and requires it to delete or return your data when we request it.
We may also disclose information if the law requires it or to protect our rights, our users or the public.
International transfers
Our providers operate globally, so your personal information may be transferred and processed outside South Africa, including in the United States (Anthropic and Railway) and other jurisdictions.
Under POPIA s72, we make these transfers on the basis that:
- Our contracts with each provider include data-protection clauses that are substantially similar to the protections in POPIA, restricting the provider's use of your data to the purposes we have described, requiring it to apply equivalent security safeguards, and obliging it to delete or return your data when we ask. (s72(1)(a) and (b))
- Where s72 requires consent for the transfer, we treat the act of completing the audit chat and sharing contact details as your informed consent to the transfers described in this policy, and you may withdraw that consent at any time by requesting deletion of your information. (s72(1)(c))
We will not transfer your personal information to a country or territory that does not offer a standard of protection substantially similar to POPIA unless another ground in s72 is met. If your information is processed in the European Economic Area, United Kingdom, or another jurisdiction with its own transfer rules (such as the GDPR's Chapter V), those additional requirements apply and are honoured in our provider agreements.
How we secure your information
POPIA s19 requires us to take reasonable technical and organisational measures to secure the integrity and confidentiality of your personal information. Our measures include:
- Encryption in transit: all traffic between your browser and our server is encrypted using TLS.
- Access controls: access to briefs and user records is restricted to authorised members of the Quiet Automation team on a need-to-know basis.
- Provider safeguards: Anthropic and Railway are contractually required to apply industry-standard security controls to the data they process on our behalf.
- Rate limiting and monitoring: the audit chat applies fair-use rate limits and our server logs basic access data to detect and block abuse.
- No unencrypted storage at rest: completed briefs are stored in an access-controlled environment; we do not write personal information to logs or analytics.
No system is completely secure. If you believe your information with us has been compromised, please contact us immediately at booyensnicoleen@gmail.com so we can assess and respond.
Security breaches
POPIA s22 requires us to notify you and the Information Regulator of certain data breaches.
If we discover a breach of security affecting your personal information, for example unauthorised access to a stored brief or a misconfiguration that exposes your data, we will:
- Contain and investigate the breach as soon as we become aware.
- Notify the Information Regulator as soon as reasonably possible where the breach is of a nature that is likely to result in harm to you.
- Notify you directly, by email or the channel you shared with us, as soon as reasonably possible, providing:
- a description of what happened and what information was affected;
- the likely consequences of the breach;
- steps we have taken or will take to mitigate the impact; and
- contact details so you can ask for further information.
- Document the breach internally, including what occurred, its effects, and the remedial action taken, as required by POPIA s22(3).
We will not delay notification because the information is technically recoverable. The test is whether the breach is likely to result in harm.
How long we keep it
POPIA s14 requires us to keep your personal information for no longer than is necessary for the purpose for which we collected it. Our specific retention periods are:
| Record | Retention period | Disposition |
|---|---|---|
| Completed briefs and associated contact details | 24 months from the date of the last substantive interaction (a reply from you or a follow-up from us) | Deletion |
| Audit chat transcripts (no contact details shared) | 90 days | Deletion |
| Server and access logs | 30 days (rolling) | Overwrite |
| Records subject to a pending deletion request | Until the request is processed (target: 30 days) | Deletion |
If a law requires us to keep a record for longer, for example a tax or tax-invoice obligation, we will retain it only for the period the law requires and will not use it for any other purpose.
If you ask us to delete your information before the end of the retention period, we will remove it from our systems and instruct our providers to do the same within 30 days, unless the law requires us to keep it.
Your rights
Wherever you are, you can exercise the following rights by emailing booyensnicoleen@gmail.com. We will respond within 30 days, or within 60 days if the request is complex or voluminous, as permitted by POPIA s12(2).
- Access (POPIA s23): ask what personal information we hold about you, why we hold it, and who has received it.
- Correction (POPIA s24, s27): ask us to correct, update, or delete information that is inaccurate, incomplete, or out of date.
- Deletion (POPIA s25): ask us to delete or anonymise your information. We will comply unless a law requires retention.
- Objection (POPIA s11(3)): object to processing on the basis of justifiable interest. We will stop processing unless we can show compelling grounds that override your objection.
- Withdrawal of consent (POPIA s11(1)(a) read with s11(3)): withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before you withdrew.
- Portability (GDPR Art 20, where applicable): receive a copy of your information in a structured, machine-readable format.
- Complaint: lodge a complaint with the Information Regulator (inforegulator.org.za) or, if in the EEA or UK, with your local supervisory authority.
You may exercise any of these rights without needing to provide a reason, and we will not charge you to process a request. We may ask you to confirm your identity before fulfilling a request to ensure we do not disclose information to the wrong person.
Cookies and local storage
Quiet Automation uses no advertising or tracking cookies. The only thing we store in your browser is a single local-storage entry remembering whether you prefer day or night mode, which never leaves your device and identifies nothing about you. If we enable analytics, we use a cookieless, privacy-focused service that does not store anything in your browser. If that ever changes, we will update this section and ask for consent where the law requires it.
Changes to this policy
If we change how we handle your information, we will update this page and its effective date. Meaningful changes will be noted clearly on the site.
Contact
General queries, data-subject requests, and concerns: booyensnicoleen@gmail.com
Information Officer (POPIA s55). Nicoleen Booyens (booyensnicoleen@gmail.com, 079 873 7581) has been designated as Quiet Automation's Information Officer in terms of POPIA s55 and is registered with the Information Regulator as required by s56. All data-subject requests are handled by or on behalf of the Information Officer.
Promotion of Access to Information Act (PAIA) Manual. In terms of section 51 of the Promotion of Access to Information Act 2 of 2000, Quiet Automation maintains a PAIA manual setting out the procedure for requesting access to records. A copy is available on request by emailing booyensnicoleen@gmail.com.
Physical and postal address. 14 Kloof Street, Still Bay West, 6674, South Africa.
Quiet Automation is a private body operated from South Africa.
Direct marketing. We do not use your contact details for direct marketing to third parties or for marketing to you that is unrelated to the automation brief you requested. If in the future we would like to send you information about new features or services, we will ask for your explicit consent first, and you may opt out of any such communication at any time by replying or emailing booyensnicoleen@gmail.com (POPIA s69).