Privacy notice

Version 2 of 26 October 2026

This notice explains what the Kykie app does with personal information, as the Protection of Personal Information Act (POPIA) requires. It covers the freelancers and studios who use Kykie, the businesses Kykie finds for them and the people who run those businesses, and anyone who opens a proof.

Joining the early-access list on kykie.co.za is covered by that site’s own notice.

The short version

If you use Kykie, we keep your account, your studio’s details and what you do in Kykie, to run it for you. Card details go to Paystack, never to us.
Kykie collects details that businesses publish about themselves, so subscribers can find ones that need what they sell. Kykie never emails businesses on its own account and never sells their details: a subscriber’s notes go from the subscriber’s own mailbox, under their name.
If you connect your mailbox, Kykie sends your notes from it and reads only the headers of new mail, to find answers to those notes. It keeps only those answers. Your password stays encrypted, and you can disconnect any time.
When someone opens a proof, Kykie records how it was looked at, without cookies, and tells the subscriber who made it.
Anyone can ask what we hold, have it corrected or deleted, or opt out, at privacy@kykie.co.za.

Who we are

Kykie is run by Jasson Mangaliso, a sole proprietor, from Virginia Avenue, Vredehoek, Cape Town, South Africa (“we”). Jasson is our Information Officer: write to privacy@kykie.co.za. For anything else, write to hello@kykie.co.za.

If you use Kykie

What we collect

Your account: your email address and your password, which is stored only in scrambled (hashed) form.
Your studio: its name; what you sell and where; the sender name, email address, signature and postal address that go on your notes; your website; and where your look alerts should go.
Payments: the Paystack reference, the plan or top-up, the amount and the date. Paystack holds your card details; we never see or store card numbers.
How you use Kykie: your searches, the steps you start and the tokens they use, the businesses in your studio, the notes and proofs Kykie makes for you and your changes to them, and the replies to your notes that Kykie files for you.
Your mailbox, if you connect one: its address, the name your notes go out under, its server settings and its password (see If you connect your mailbox).
Technical records: our hosting and database providers keep short-lived logs of requests, such as IP addresses and browser types, to keep the service working and secure.

Why we use it

To run your account and do what you ask of Kykie. This is our agreement with you (POPIA section 11(1)(b)).
To take payments and keep the financial records that tax law requires (section 11(1)(c)).
To email you about your account: sign-in links, look alerts and changes that affect you. Now and then we may also tell you about new Kykie features, and every such email lets you stop them.
To keep Kykie safe and lawful: stopping abuse, enforcing the acceptable use policy and dealing with complaints. This is our legitimate interest (section 11(1)(f)).
To improve Kykie, using figures combined across studios that never identify you or a business.

We need your account details and your studio’s sender details to provide Kykie. Without them, you can’t use it.

If you connect your mailbox

You can connect your own mailbox (Gmail or Google Workspace, GoDaddy, Zoho, Titan, your web host’s email or another provider) with an app password or your email password. Kykie then works with it like this:

Sending. Kykie sends the notes you schedule, and the answers you write in Kykie, from your mailbox, under your name, and puts a copy of each in your mailbox’s Sent folder (Gmail files its own copy).
What Kykie reads. Every couple of minutes, Kykie reads the headers (who it’s from, the subject and the reference to an earlier email) of mail that has arrived in your inbox since you connected it. It opens an email only when it answers a note sent from Kykie, or comes from a business in your studio. For a delivery-failure notice, it reads only the part that says which note didn’t arrive.
What Kykie keeps. Only those answers: who sent them, when, the subject and the text, filed under the business. Kykie never keeps, copies or reads the rest of your mail, and never reads mail from before you connected the mailbox.
Your password. It’s kept encrypted in a vault. Kykie never shows it again, and only its background engine reads it, to send and to look for answers.
Disconnecting. You can disconnect any time in Settings, which deletes the password at once and stops all sending and reading. Answers already filed stay with their businesses until you remove them. You can also delete the app password at your email provider, which cuts Kykie off immediately.

We do this because you asked us to (our agreement with you, POPIA section 11(1)(b)). The businesses’ answers are handled on the same basis as the rest of their details (see the next section).

If Kykie found your business

Kykie finds businesses for its subscribers: freelancers and small studios who sell websites, SEO and Google reviews work. If your business is publicly listed in the United Kingdom, Ireland, the United States or South Africa, a subscriber’s search may have found it.

What we collect

Public listing details: the business’s name, category, address, phone number, website, Google rating and number of reviews, and similar details from its Google listing.
A business email address, found on the business’s own website, and whether it can receive mail.
The name of the owner or a director, where the business’s website or a public register such as Companies House shows it, and whether the business is a registered company.
What Kykie finds when it looks at the business’s website and Google listing, for example how the site works on a phone, how fast it loads, and how the business compares with others nearby. For a reviews audit we read the business’s public Google reviews and shorten reviewers’ names to initials.
Kykie’s notes on whether the business fits what a subscriber sells, and the notes and proofs made for it.
Whether someone at the business opened a proof, and how (see If you open a proof).
Replies the business sends to a subscriber’s note, when the subscriber receives them through Kykie (their connected mailbox, or their own reply address), so the subscriber can answer them in Kykie.
Opt-outs, which we keep so the business isn’t contacted again (see Opting out).

Where it comes from

Google Maps listings (collected for us by Outscraper), the business’s own website, public registers, and the subscriber who works with the business.

Why we use it, and on what basis

We rely on legitimate interests (POPIA section 11(1)(f)): subscribers’ interest in finding clients who could use what they sell, and a business’s interest in hearing about services that could help it, weighed against the privacy of the people who run it. We keep that balance by:

collecting only what a business publishes about itself, or what a public register shows;
applying each country’s rules before anyone is contacted, which in South Africa means a single request for permission and nothing more without a yes;
putting an opt-out link on every proof and in every note Kykie drafts, and stopping as soon as it’s used;
never emailing businesses on our own account (each note goes from the subscriber’s own mailbox, under their name), never selling their details, and never letting subscribers export them in bulk.

Kykie decides what it collects about businesses and how long it keeps it, so for that we’re responsible under POPIA. Each subscriber decides which businesses to contact and what to send, so they’re responsible for their own outreach; Kykie prepares the notes and proofs and records looks for them. A business’s details sit only in the studio whose search found it. Other studios can’t see that studio’s records, even if their own searches find the same business.

If you open a proof

A proof is a draft website, an SEO audit or a Google reviews audit that a subscriber made with Kykie to show a business. Each has its own private link, and each says who made it and how to opt out. When a proof is opened, a small script on the page records:

how long it was open and in use, how far down it was scrolled, and which buttons and links were tapped;
whether it was opened on a phone or a computer;
the town and country it was opened from, worked out from the internet (IP) address at the time. We don’t store the IP address itself;
the page that linked to it, if the browser passes that on;
a random visit number, and a random visitor number kept in the browser, so the same person isn’t counted twice.

Proofs use no cookies and no advertising trackers. Automated visits, such as email link scanners, are left out where we can tell them apart. The subscriber who made the proof sees these details and gets an email alert, so they know the business has looked and can follow up at a sensible time, instead of chasing businesses that aren’t interested. That’s the legitimate interest we rely on. The subscriber’s own previews aren’t counted.

Who else handles information

These providers handle information for us, only on our instructions:

Supabase stores Kykie’s database, in Frankfurt, Germany.
Netlify, based in the United States, hosts and runs the Kykie app and the proof pages.
Cloudflare, based in the United States, runs our domain names and forwards email sent to our @kykie.co.za addresses.
Resend sends Kykie’s own emails, such as sign-in links and look alerts, from servers in Ireland. Subscribers’ notes to businesses go from their own mailboxes, through their own email provider (or their own Resend account, where they set that up), never through Kykie’s.
Anthropic, based in the United States, provides Claude, the AI that reads the information above to check businesses and write the checks, drafts, audits and notes.
Outscraper, based in the United States, collects Google Maps listings and reviews for us, and checks whether email addresses can receive mail.
Paystack takes payments for us. It holds the card details; we never see them.

Kykie also asks Google’s PageSpeed Insights how fast a business’s website loads, and shows small pictures of businesses’ websites from WordPress.com’s mShots service. Your browser fetches those pictures from WordPress.com, which sees your IP address when it does.

We never sell personal information, and we don’t share it with advertisers.

Information sent outside South Africa

Most of these providers keep or process information outside South Africa, in the European Union and the United States. POPIA (section 72) allows this when the recipient is bound by law or by an agreement that protects the information as well as POPIA does, or when the transfer is needed to provide the service you asked for. We only use providers bound by data protection terms of that kind.

How long we keep it

Subscriber accounts: while the account is open. When an account closes, we delete the studio and everything in it within 30 days, except payment records, which tax law requires us to keep for five years.
Businesses: while they’re in a subscriber’s studio. We delete a business’s details when the subscriber removes it or closes their account, and we delete businesses that no one has worked with for 12 months.
Proofs: draft websites come down after 30 days unless the subscriber keeps them up, and we delete proofs together with the business they were made for.
Records of proofs being opened: 12 months.
A connected mailbox: its settings and password until you disconnect it, when the password is deleted at once. Answers Kykie filed stay with their business, and go when it does.
Opt-outs: we keep a scrambled, one-way version of the opted-out email address for as long as Kykie runs, so the business isn’t contacted again. It can’t be turned back into the address.
Our providers’ logs: the short periods each provider sets.

Your rights

Whoever you are (a subscriber, someone whose business Kykie found, or someone who opened a proof), you can:

ask whether we hold information about you or your business, and for a copy of it;
ask us to correct it, or to delete it;
object to how we use it, including to your business being found or contacted through Kykie at all;
withdraw your consent, where we rely on it;
complain to the Information Regulator (see Complaints).

Write to privacy@kykie.co.za. We’ll answer within 30 days. Before we hand anything over, we may ask you to show that the information is about you or a business you run.

Opting out, for businesses

Every proof, and every note Kykie drafts, has an opt-out link. It stops the subscriber who made it contacting your business through Kykie again. To stop every Kykie subscriber finding or contacting your business, email privacy@kykie.co.za with the business’s name and website. We’ll block it across Kykie and tell you when that’s done.

Keeping it safe

Information travels to and from Kykie over encrypted connections.
The database itself keeps each studio’s records apart: a signed-in person can reach only their own studio’s.
The app holds no master key to the database. Kykie’s background engine uses its own secret, which the database stores only in scrambled form.
Mailbox passwords and email provider keys are kept encrypted in a vault, are never shown again once saved, and are read only by the background engine.
Card details never reach Kykie.
Only Jasson Mangaliso has administrator access.

If a security breach puts your information at risk, we’ll tell you and the Information Regulator, as POPIA requires.

Complaints

If you’re unhappy with how we handle your information, please tell us first at privacy@kykie.co.za. You can also complain to the Information Regulator at inforegulator.org.za. If you’re in the United Kingdom or Ireland, you can also contact the Information Commissioner’s Office (ico.org.uk) or the Data Protection Commission (dataprotection.ie).

Changes to this notice

When we change this notice, the version and date at the top change, and we email subscribers about changes that matter to them.