Privacy notice

This notice explains what personal information Abraxas handles, why, who sees it, how long we keep it and what you can ask of us.

1. Who we are

Abraxas is operated by Abraxas Technologies (Pty) Ltd, a private company registered in South Africa (registration number K2025597811), 50 Long St, Cape Town City Centre, Cape Town, 8000, South Africa ("Abraxas", "we", "us"). We are the responsible party under South Africa's Protection of Personal Information Act, 2013 (POPIA), and the controller under the GDPR and UK GDPR for our own customers and visitors.

Our Information Officer is Wendy Morency. For privacy requests, email privacy@abraxastechnologygroup.com, call +27 63 874 5569 or write to the address above. For anything else, email support@abraxastechnologygroup.com.

This notice covers visitors to our website, people who sign up for or use Abraxas, and people our customers' AI employees call, email or chat with.

2. Two roles

For our own customers and visitors, we decide how their information is used (we are the responsible party under POPIA and the controller under the GDPR).

For the people our customers contact (their leads, customers and callers), we handle the information on our customer's instructions. The business that uses Abraxas decides whom to contact and why, and is responsible for having the consents the law requires (see our Terms, clause 8). In this role we are an operator under POPIA and a processor under the GDPR. If an Abraxas AI employee contacted you for a business, you can ask that business, or us, to stop.

3. What we collect

Account information: your name, work email, business name, the plan you choose, records of your sign-ins, whether and when you confirmed your email address, and the status of your account (setup period, active, restricted, read-only or closed).

Sign-up protection: to stop automated sign-ups we keep a one-way scrambled (hashed) form of the internet address a sign-up came from, never the address itself.

Billing information: your plan, invoices and usage counts (call minutes, AI-written replies, emails). Card payment is not open yet; we bill by invoice.

What you put into Abraxas: contact lists and CRM records you upload or create, your knowledge base, your mailbox and calendar connections, and your instructions to your AI employees.

What the AI employees produce: emails they draft, send and receive; chat conversations on your website; and phone calls they make or answer. Calls start with a notice that the call is recorded, and we keep the recording and a written transcript. Every action is written to the contact's timeline, which cannot be edited afterwards.

Opt-outs: when someone asks not to be contacted, including by saying "stop" on a call, we record it and add the number to the customer's do-not-call list.

Cookies: a cookie that keeps you signed in, and one first-party cookie that remembers which Growth plan price you were shown, kept for 90 days. The price cookie is chosen at random and uses no personal data (Terms, clause 7).

4. Why we use it

• To provide the service you signed up for, including the AI employees' calls, emails and chats.
• To bill you, count usage against your plan and send the notices our Terms promise (for example renewal reminders).
• To send account emails about your own account: confirming your email, welcome and setup reminders, the end of your free setup period, plan and invoice confirmations, cancellation confirmations, and notices when your account is restricted, read-only or closed. They go only to the email address you signed up with and are not marketing.
• To keep accounts secure, prevent misuse and investigate problems.
• To meet legal obligations, including honouring opt-outs and do-not-call requests.

We do not sell personal information and do not use it for advertising.

Voluntary information. Most of the information we collect is necessary to provide the Service. If you choose not to give us the information we need to create your account, we cannot supply the Service. Where we rely on your consent as a legal basis, you may withdraw that consent at any time by contacting us. Withdrawing consent does not affect the lawfulness of processing that happened before the withdrawal.

Legal basis. We process your information to perform our contract with you, to meet legal obligations, and for our legitimate interests in running a secure service (POPIA section 11; GDPR Article 6(1)(b), (c) and (f)). Where we rely on consent, you can withdraw it at any time.

5. AI services and other providers

AI services read messages and call audio to understand them and to draft replies. Providers that host the service, carry phone calls and turn speech into text act on our instructions and may not use the information for their own purposes. We share information with authorities only where the law requires it, or to protect someone's rights or safety.

6. International transfers

Your information may be processed in countries other than your own, including the United States. Where the law requires safeguards for a transfer, we use them: under POPIA section 72 we transfer information only to countries or recipients bound by adequate protection or binding agreements, and for EU and UK customers we use the European Commission's standard contractual clauses or the UK equivalent.

7. How long we keep it

When a customer's paid period ends, or their free setup period ends without a plan, the account is restricted or becomes read-only, and the customer can still export their data. A read-only account closes 30 days later. We delete the account data no sooner than 60 days after the account closes. We keep data longer only where the law requires it, for example opt-out and consent records, and billing and tax records.

8. Your rights

You may ask to see, correct or delete your information, ask for a copy of it, or object to how we use it. If you are in the EU or UK you may also ask us to restrict processing or to move your information to another provider. You may also object to the use of your personal information for direct marketing purposes (we do not carry out direct marketing, but you retain that right). Email privacy@abraxastechnologygroup.com or write to us at the address in section 1. We may need to confirm who you are before we act. If your information was collected by one of our customers, we will pass your request to them and help them answer it.

If you are not satisfied, you can complain to the Information Regulator of South Africa (inforegulator.org.za), or, in the EU or UK, to your local data protection authority.

9. Changes

We will update this notice as the service changes, and tell customers before a material change takes effect. The date at the top shows the current version.