Effective date: 1 November 2026 Last updated: 9 November 2026
This policy explains how ARA Automated Solutions, a sole proprietorship operated by Shaun Wayde Govender, trading as Niu ("we", "us", "our"), handles personal information. Niu provides an AI-powered receptionist service to businesses in South Africa.
Regulator of South Africa.
We are committed to protecting personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
POPIA distinguishes between the Responsible Party (who decides why information is processed) and the Operator (who processes it on someone else's behalf). Niu acts in both roles, depending on whose information it is:
business clients (their account and contact details) and of visitors to our website. This policy governs that information.
own customers (the people who call, chat or message a business that uses Niu). For that information, our client is the Responsible Party and their own privacy notice applies. Niu processes it strictly under a written Operator Agreement and only on the client's instructions. See section 9.
payments are handled by a PCI-compliant payment provider and we keep only a token and the last four digits.
kept for security and audit.
enter and — for the voice demo — your microphone audio (processed via Vapi) to generate a sample reply. We do not store your demo inputs or the demo conversation.
Cookie Notice).
We collect personal information directly from you wherever practical (POPIA s12).
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| To create and administer your account and provide the service | Necessary to perform our contract with you |
| To bill you and take payment | Necessary to perform our contract; legal obligation (tax) |
| To provide support and respond to requests | Necessary to perform our contract |
| To secure the service, prevent abuse, keep audit logs | Our legitimate interest; legal obligation |
| To send service messages (e.g. outages, changes) | Necessary to perform our contract |
| To send marketing about Niu | Your consent, which you may withdraw at any time (POPIA s69) |
We process only the minimum necessary for each purpose (POPIA s10, s13).
We will only send you electronic marketing (email, SMS, WhatsApp) if you are an existing customer for similar services, or you have consented. Every marketing message offers a free and simple way to opt out, and we stop on request.
To run the service we use trusted providers who process information on our behalf under written agreements. Each is bound to use the information only for our instructed purpose, keep it confidential and secure it (POPIA s20–s21).
| Provider | Purpose | Where it processes data |
|---|---|---|
| Anthropic (Claude) | The AI language model — the "brain" that understands and answers on every channel (voice, WhatsApp, email, web chat) | United States |
| Telnyx | WhatsApp messaging (WhatsApp Business Cloud API) | United States |
| Vapi | AI voice calling — connects call audio to the AI (speech-to-text, text-to-speech and call carriage); Vapi engages its own speech sub-providers to do this | United States |
| Supabase | Database / storage | European Union |
| Render | Application hosting | European Union (region selected) |
| The client's own email provider (e.g. Google Workspace / Gmail) | Sending and receiving the client's business email that the AI reads and answers | as set by that provider |
| Google (Google Calendar) | When a client connects their calendar: reading availability and writing appointment bookings | Google data centres (global) |
We select providers whose terms do not permit them to use personal information to train their own models, we bind each by written agreement, and we keep the current, authoritative list in our sub-processor register, available on request. We update it as providers change.
We do not sell personal information. We disclose it to others only where the law requires it (for example a lawful court order) or to protect our rights.
Some of our providers process information outside South Africa (in the European Union and the United States), as shown in section 6. POPIA permits this only on specific grounds. We rely on binding written agreements that require each provider to protect the information to a standard comparable to POPIA, and, where applicable, on your consent and on the transfer being necessary to perform our contract with you.
We keep personal information only as long as necessary for the purpose it was collected, or as the law requires:
by tax and company law (generally five years) after it closes.
When a retention period ends we delete or de-identify the information.
When you use Niu to answer your customers, Niu is the Operator and you are the Responsible Party. We:
configuration) and never for our own purposes;
encrypt stored records;
consent wording; by default we keep only a redacted text transcript of the call (no audio recording), so your team has a record and can follow up;
or a different period you set — after which we delete or de-identify them;
The full terms are in the Operator Agreement, which forms part of your contract with us. Your customers' rights are exercised through you as the Responsible Party; we assist you to meet them.
You may:
out of date or obtained unlawfully;
similarly significant effects on you, except as the law allows.
To exercise a right, contact our Information Officer at araautomatedsolutions@gmail.com. We may need to verify your identity first. We respond within a reasonable time and, where the law sets a period, within that period. Requests use the prescribed POPIA forms where applicable.
We take appropriate, reasonable technical and organisational measures, including: encryption of stored personal information; encrypted connections; access on a least-privilege basis; passwords stored only as hashes and optional two-factor authentication; audit logging of administrative actions; tenant isolation; and regular review. No system is perfectly secure, but we work to keep risks low and to respond quickly if something goes wrong.
If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible, as POPIA requires, and tell them what happened and what to do.
Our service is for businesses and is not directed at children. We do not knowingly process the personal information of a child without the consent of a competent person.
If you are unhappy with how we handle your information, please contact our Information Officer first so we can put it right. You also have the right to complain to:
The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: complaints.IR@inforegulator.org.za / enquiries@inforegulator.org.za
We may update this policy from time to time. We will post the updated version on our website and change the "Last updated" date. Significant changes will be notified to account holders.
This policy should be read with Niu's Terms of Service, Operator Agreement and Cookie Notice.