Compliance

Everything Eiro Systems does to keep your data, your customers' data, and your payments safe, in one place. Full detail is in our Privacy Policy, which is always the source of truth.

1. Data protection

We handle personal information in line with the Protection of Personal Information Act, 2013 (POPIA), which our company is registered under, and we respect the data protection rights of customers and visitors wherever they are.

• Information Officer appointed (see the Privacy Policy)
• Data requests answered within 30 days
• Right to access, correct, delete, or export your personal data

2. Chat data handling

Processing: Visitor messages on your widget are sent to our server, forwarded to Anthropic's Claude API to generate a response, and the response is returned. Messages are not shared with any other third party.

Retention: Chat logs are retained for 30 days for support and quality purposes, then permanently deleted automatically.

Training: We do not use your customers' chat messages to train any AI model. Ever.

Ownership: The knowledge base built for your assistant belongs to you. On cancellation, we delete it from our systems within 7 days on request.

3. Payment security

Payments are processed by our payment provider, Whop, which handles card data under PCI-DSS.

• Card details never touch Eiro Systems servers
• We receive only a record of each payment, never card numbers

4. Transport and storage security

• SSL/TLS encryption on every request, both site and widget
• API keys live in server-side environment variables, never in client code
• Database access is restricted via row-level security and scoped service credentials
• Each business's assistant answers only on that business's own website domains
• Payment notifications are verified by signature before any account is changed

5. AI identification

Our widget clearly identifies itself as an AI assistant. It never claims to be human and never impersonates a named staff member. When a question falls outside what it knows, it says so and points the customer to your real contact channels rather than making something up.

6. Sub-processors

We use a small, deliberate set of sub-processors, each bound by data protection obligations:

• Anthropic — AI model inference (Claude API)
• Supabase — database and accounts
• Vercel — hosting for our site, API and your widget
• Whop — payment processing
• Resend — email delivery
• Meta (WhatsApp Business) — only if you switch on WhatsApp alerts

We update this list if it changes.

7. Company

Eiro Systems is a trading name of K2026174513 (Pty) Ltd. Full company details are in our Terms of Service.

8. Contact

Compliance questions, data requests, or security concerns: info@eirosystems.com (subject line: "Compliance" or "Information Officer"). We respond within one business day.