1Who we are

Yireh Systems is a product of Yireh Business Solutions, a South African business. Under the Protection of Personal Information Act, 2013 (POPIA), we are responsible for the personal information in your account and on this website. You can reach our Information Officer at info@yireh.co.za or on +27 82 331 1360.

2Your account, and your workspace

We hold two kinds of information, and our role is different for each.

Your account is you and your team: names, email addresses, logins, and how you use Yireh. We decide how this is used, so we are responsible for it.
Your workspace is the people and businesses you put into Yireh: leads, clients, contacts, invoices, bookings, tasks, messages and call lists. You decide what goes in and what is done with it, so you are responsible for it, and we handle it for you. POPIA calls us your operator.

We use your workspace only to run Yireh for you, never to market anything to the people in it. Our staff do not read it, except when you ask us to help with something, or to look into a fault, a security problem or a breach of our Terms. We do see totals, such as how many leads a workspace holds, to run the service.

3What we collect

When you sign up: your name, email address and password. The password is stored only as a salted hash, so no one at Yireh can read it.
When you set up your business: its name, industry, phone number, email, address, currency and logo, and the name, email, role and title of each person you invite.
When you use Yireh: whatever you enter, and the leads that arrive through your website form, your lead webhook, or email sent to your @leads.yireh.co.za address, including the sender's name, email, phone number and message.
If you connect Gmail or Google Workspace: Google asks you to let us read, file and send mail in that mailbox, and to see its address. We keep the access Google gives us so your inbox stays in step, and we copy recent messages (sender, recipients, subject, body and date) into your workspace. You can disconnect in Email, and remove our access in your Google account at any time.
If you use AI calling: the names and numbers on your call lists, the result of each call, its transcript and summary, and a recording when one is kept (section 7).
If your clients pay invoices online: PayFast's notice of each payment, with the amount, its status, its reference and the payer details PayFast includes. Card numbers never reach us.
When something breaks: the app sends us the error message, the technical trace, the page address without anything after a "?", your browser type, and, if you are signed in, your account and workspace ids. Visitors who are not signed in send the same, without the ids.
When you report a problem: what you write, and the screenshot if you add one. It is emailed to our admins.
When you use the contact form: your name, email, company, phone number and message, emailed to us.
Server logs: Supabase and Cloudflare keep standard records of requests, such as IP address, browser type and time, to run and protect the service.

We do not load advertising trackers or outside analytics tools on the site or in the app.

4What we use it for

to sign you in and keep your account secure;
to run what you use: showing your workspace, syncing your mailbox, sending the emails and making the calls you or your automations ask for, and drafting messages with AI;
to answer you when you contact us;
to find and fix faults, from error reports and problem reports;
to tell you about your account: security alerts, changes to your plan, and changes to these documents; and
to keep the records South African law requires, such as for tax.

POPIA lets us do this because it is needed to provide the service you signed up for, because the law requires it, because it is in our legitimate interest to keep Yireh working and safe, or, for things like connecting Gmail or browser notifications, because you agreed. We do not train AI models on your data.

These companies do parts of the work for us. Each gets only what its part needs.

SupabaseAlways: Our database, sign-in and file storage. Receives: Everything in your account and your workspace. Stored in Frankfurt, Germany.
CloudflareAlways: Serves the website and the app, filters attack traffic, and receives email sent to your @leads.yireh.co.za address. Receives: Requests to the site, and the content of emails sent to your lead address.
ResendAlways: Sends email for us. Receives: Team invites, contact form messages, problem reports, and the emails your automations send.
An AI model serviceWhen AI drafts something: Drafts email replies and call scripts. Receives: Only what the draft needs: your business name, your call brief, and the name of the person being written to.
GoogleIf you connect Gmail: Your mailbox. Receives: Our requests to read, file and send mail in the mailbox you connected.
Vapi, with ElevenLabs and TwilioIf you use AI calling: Vapi runs each call, ElevenLabs is the voice, Twilio is the phone line. Receives: The number being called, the person and business name, your script, and earlier contact with them. Vapi keeps its own copy of call data under its own retention rules.
PayFastIf your clients pay invoices online: Takes the payment on its own page. Receives: The amount, the invoice number and your client's name. Card details go to PayFast only; we never see them.
ipapi.coUntil you choose a currency: Guesses your country so prices show in your currency. Receives: Your IP address.
open.er-api.comWhen amounts are converted: Exchange rates. Receives: Nothing about you.

Most of these companies are based outside South Africa, so your information is processed abroad. POPIA allows that when the recipient is bound by law or contract to protect it to a standard like POPIA's. Each of these services handles data under its own data processing terms, and the European Union's GDPR applies to our database in Germany.

Apart from these, we share personal information only when the law requires it, to protect people or our rights in a legal claim, or as part of a sale of the business. In a sale, the buyer must keep to this policy, and we will tell you who they are.

6What is kept in your browser

Your sign-in: a session token, so you stay signed in.
Your preferences: theme, currency, dashboard layout, the logo and icon you upload, your tour progress and your notification choices. Some are also saved to your account so they follow you to other devices.
The app's own files: a service worker keeps a copy of the app's code and images on your device so it opens quickly on a weak connection. It never stores your workspace data.

We set no cookies of our own. Cloudflare may set one security cookie to tell people apart from bots. Browser notifications appear only if you allow them. Clearing this site's data in your browser signs you out and resets these preferences.

7Calls made through Yireh

Yireh can make phone calls for a business with an AI assistant. These rules apply to every call, and a business cannot switch them off:

the first sentence says that an AI assistant is calling, for which business, and that the call is recorded;
calls happen only on weekdays from 08:00 to 20:00 and on Saturdays from 09:00 to 13:00, never on Sundays or public holidays;
if you say "stop", or ask not to be called, your number goes on a do-not-call list at once and is never called again. We keep that number on the list for good, because deleting it would let it be called again.

A recording is kept only when the call was answered for at least a minute, ended in a booking, or was flagged for review. It is deleted automatically after the period the business chose: 30, 90 or 365 days, 90 unless they change it. The transcript and summary stay with the call's record until the workspace is deleted.

When a Yireh customer calls you, that business is responsible for the call and its record, so ask them first. You can also ask us, and we will add your number to that business's do-not-call list.

8If Yireh contacted your business

We use Yireh Systems to find customers of our own. If we emailed or called your business, we found its name, email address and phone number in public sources on the internet, such as your website or a public business listing. We use them only to offer our services to your business.

To stop hearing from us, reply to one of our emails and ask us to stop, say "stop" on a call, or email info@yireh.co.za. We stop, and we keep a note of your request so it is honoured from then on.

9How we protect it

Each workspace is walled off inside the database itself, so one account cannot read another's data even if the app had a bug.
Every connection to Yireh is encrypted, and passwords are stored only as salted hashes.
Admin access is limited to two named people at Yireh, and the database enforces that list, not just the app.
The keys to services you connect, such as Gmail, sit in a table that no signed-in user can read. Only our own server code uses them.

No system is perfectly safe. If a breach exposes your personal information, we will tell you and the Information Regulator as soon as we reasonably can, as POPIA requires.

10How long we keep it

Your account and workspace: while your account is open.
When your account is closed: we delete your workspace and account. We keep a short record that the account existed and was deleted, with its email, name and business name, as proof that we did it. Do-not-call numbers stay on the list (section 7).
Team chat: messages and attachments are deleted automatically about 30 days after they are sent, by a monthly clean-up. Save anything you need to keep somewhere else.
Call recordings: as set out in section 7.
Error reports: for as long as they help us find and fix faults.
Records the law requires: for as long as South African tax law says.

Deleted data can remain in our database host's routine backups until those backups are replaced.

11Your rights

Under POPIA you can:

see what we hold about you. You can download your whole workspace yourself: open My Business and press "Download a full backup". For anything not in that file, such as email, call records or your account details, email us.
have it corrected. Most of it you can change yourself in Settings and My Business.
have it deleted. Email us from the address on your account, and we will close the account and delete its workspace.
object to how we use it, including to any marketing from us, at any time.
take back your consent, for example by disconnecting Gmail or turning off notifications.
complain to the Information Regulator at POPIAComplaints@inforegulator.org.za or inforegulator.org.za.

Email requests to info@yireh.co.za. We may check that the request comes from you, we answer within 30 days, and we do not charge for it.

12Children

Yireh is for businesses and is not meant for anyone under 18. If you think a child has given us personal information, tell us and we will delete it.

13Changes to this policy

When this policy changes, the date at the top changes. If a change affects what we collect or who we share it with, we will email account owners before it takes effect.

14Contact

Email info@yireh.co.za, call +27 82 331 1360, or use the contact page.