Compliance

Everything Eiro Systems does to keep your data, your customers' data, and your payments safe. This page consolidates all compliance, security, and data-handling details in one place so the rest of the site can stay focused on the product.

1. POPIA (Protection of Personal Information Act)

Eiro Systems operates under South African law and complies with the Protection of Personal Information Act, 2013. Full detail on how POPIA applies to your data lives in our Privacy Policy, including the appointed Information Officer, your access and deletion rights, and how to lodge a complaint with the Information Regulator of South Africa.

• Information Officer appointed in terms of section 55 of POPIA
• 30-day response window for POPIA access requests (Act requires 30)
• Right to access, correct, delete, or port your personal data
• Right to lodge a complaint directly with inforegulator.org.za

2. Chat data handling

Processing: Visitor messages on your widget are sent to our server, forwarded to Anthropic's Claude API to generate a response, and the response is returned. No message is shared with any third party beyond Anthropic.

Retention: On Starter Annual and Pro Annual (hosted plans), chat logs are retained for 30 days for support and quality purposes, then permanently deleted. On Self-hosted, no chat data ever reaches our servers — retention is entirely under your control.

Residency: Hosted chat logs are stored on infrastructure located inside South Africa or the European Union. Anthropic processes messages according to their own data-handling policies (anthropic.com/legal/privacy).

Training: We do not use your customers' chat messages to train any AI model. Ever.

Ownership: The knowledge base trained for your bot belongs to you. On cancellation, we delete it from our systems within 7 days on request.

3. Payment security (PCI-DSS)

All card payments are processed by Yoco, our third-party payment provider. Yoco is a registered payment processor and handles all PCI-DSS compliant processing on our behalf.

• Card details never touch Eiro Systems servers
• Yoco holds the PCI-DSS attestation; we inherit compliance for card data by never storing it
• Supported methods: Visa, Mastercard, American Express, Instant EFT

4. Transport and storage security

• SSL/TLS encryption on every request, both site and widget
• API keys live in server-side environment variables, never in client code
• Database access is restricted via row-level security and scoped service credentials
• Secrets rotated on personnel change or suspected compromise

5. AI identification

Our widget clearly identifies itself as an AI agent. It never claims to be human and never impersonates a named staff member. When a query falls outside what the bot can answer, it routes the customer to your real contact channels rather than making something up.

6. Sub-processors

We use a small, deliberate set of sub-processors. Each is bound by data protection obligations:

• Anthropic — AI model inference (Claude API)
• Yoco — card payment processing
• Hosting providers — infrastructure running our API and your widget

We update this list if it changes. The current Privacy Policy is always the source of truth.

7. Company

Eiro Systems is a trading name of K2026174513 (Pty) Ltd, a company registered in the Republic of South Africa. Registration number: K2026174513.

8. Contact

Compliance questions, data requests, or security concerns: info@eirosystems.com (subject line: "Compliance" or "Information Officer"). We respond within one business day.