Privacy Policy

1. Who we are

RootLink Software is the trading name under which RootLink Exports (Pty) Ltd, a South African registered company, builds and operates the LeedLoop platform — a customer messaging, routing and analytics service used by retail businesses and their digital marketing partners across WhatsApp, Facebook Messenger and Instagram. RootLink Exports (Pty) Ltd is the responsible party for the personal information described in this policy.

LeedLoop is a first-party tool: a business uses it to reply to its own customers, on accounts that business owns and has authorised, and only to people who contacted that business first.

We operate in accordance with the Protection of Personal Information Act (POPIA) of South Africa.

2. What information we collect

When you message a WhatsApp number, Facebook Page or Instagram account powered by LeedLoop — or comment on one of that business's posts or advertisements — we may collect the following information:

• WhatsApp phone number — the number you message from, where you contact us on WhatsApp
• Page-scoped user ID — where you contact us on Facebook Messenger or Instagram, Meta gives us an ID that identifies you only to that one business. It is not your Facebook account name, your email, or your friends list, and it cannot be used to look you up elsewhere on Facebook.
• Display name — the public name shown on your WhatsApp, Facebook or Instagram profile
• Message timestamps — when you sent messages and when we responded
• Conversation content — what you asked about, the product and quantity you are interested in, and your general area or town
• Public comment content — if you comment on a business's post or advertisement, we store the text of that comment so the business can reply to it
• Ad referral data — if you clicked a Facebook or Instagram advertisement to start the conversation, we may receive limited attribution data from Meta (such as which ad or campaign you clicked)
• Session metadata — how long the interaction took, how many messages were exchanged, and the outcome of your session

We do not collect payment information, identity documents, your Facebook password, your friends list, your email address, or any sensitive personal information through our messaging services. We do not read your private messages with anyone other than the business you contacted.

3. How we use your information

We use the information we collect for the following purposes:

• To route you to the correct retail store on your behalf
• To generate aggregated analytics reports for retail businesses and their marketing partners (e.g. how many leads were received, what percentage were completed, time saved)
• To improve the accuracy and performance of our store-matching service
• To track unmet demand — if you request a store we don't currently service, we log that to help businesses understand where to expand

We do not use your personal information for advertising, profiling, or sell it to any third parties.

4. How we share your information

Your information may be shared in the following limited circumstances:

• With the business you contacted — the business whose WhatsApp number, Facebook Page or Instagram account you messaged can see your conversation and the details you gave, so its team can serve you
• With the retail store or distributor you are routed to — when you receive a WhatsApp link to a stockist, that store may see your phone number when you initiate a conversation with them directly
• With the business's digital marketing agency — aggregated, non-identifiable statistics (total leads, completion rates, time saved) are shared with the agency managing the business's advertising. Individual phone numbers and user IDs are not shared in these reports.
• With Meta Platforms — as required to operate the WhatsApp Business Platform and the Messenger Platform. Meta's own privacy policy applies to data processed through their infrastructure.
• With our service providers — a small number of companies process information on our behalf, only to run our service and under contract: Telasera Technologies (Pty) Ltd (server hosting, South Africa), Anthropic, PBC (automated reading of and replies to messages and comments), Cloudflare, Inc. (encrypted backups, DNS and email routing) and Google LLC (delivery of our own operational email). Some of these providers process information outside South Africa; where they do, they are bound to protect it to a standard comparable to POPIA.

We do not sell your information, and we do not pass it to any other business for its own use.

Requests from public authorities

If a court, regulator, law enforcement agency or other public authority asks us for your personal information, we:

• review every request to confirm it is lawful and properly made before acting on it
• challenge or refuse requests we believe are unlawful, overly broad or not properly authorised
• disclose only the minimum information the request legally requires
• keep a written record of each request, our response, the legal basis and the people involved

5. Data storage and security

Your data is stored on servers located in South Africa. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Access controls limiting who can query the database
• Regular encrypted backups stored in multiple locations

6. Data retention and deletion

We retain session data for a minimum of 12 months to provide historical reporting to our business clients. After this period, data may be anonymised or deleted.

You can ask us to delete everything we hold about you at any time, free of charge, and we complete deletions within 30 days. Step-by-step instructions — including how to remove the app's access to your Facebook account — are on our Data Deletion Instructions page.

7. Your rights under POPIA

As a data subject under South African law, you have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your personal information
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us at the details below.

8. WhatsApp, Messenger, Instagram and Meta

Our services operate on the WhatsApp Business Platform and the Messenger Platform, provided by Meta Platforms Inc. By messaging a WhatsApp number, Facebook Page or Instagram account powered by LeedLoop, you acknowledge that your messages are also subject to WhatsApp's Privacy Policy and Meta's Privacy Policy.

We only message people who contacted the business first, and only within the messaging windows Meta permits. We do not send unsolicited messages, and we do not use Meta data for advertising or profiling.

8a. Terms of Service

Use of our services is also governed by our Terms of Service.

9. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page reflects when it was last updated. Continued use of our services after any changes constitutes acceptance of the updated policy.