Privacy notice
What we collect, why, on what basis, and what you can do about it. Written to be read rather than to be survived.
Last updated 24 August 2026
Not yet reviewed by a lawyer
This document must be reviewed by a South African privacy lawyer before it is relied on with real customers. It was drafted to be accurate about what the product actually does and to be POPIA-aware, but it is not legal advice and it carries no professional assurance. If you are evaluating this service for an organisation with meaningful obligations, treat this document as a statement of intent rather than as a warranty.
Who we are
For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information described here, and the person named below is the Information Officer.
- Service
- aireadiness, at aireadiness.co.za
- Operated by
- Boondock Labs
- Responsible person
- Eugene Boondock, whose full legal name is Eugene Loyiso Mzimakhwe
- Information Officer
- Eugene Boondock
- Country
- South Africa
- Contact
- hello@aireadiness.co.za
- Registration number
- Not yet published
- Business address
- Not yet published
- VAT
- Not registered for VAT. No VAT is charged.
- Capacity
- Responsible party under POPIA for the information described in this notice
aireadiness is operated by Boondock Labs, a business conducted by Eugene Boondock (full legal name Eugene Loyiso Mzimakhwe) in South Africa.
Still outstanding before this document is complete: a registration number, a business address, registration of the Information Officer with the Information Regulator. These are stated as missing rather than left out.
Write to hello@aireadiness.co.za about anything in this notice, including a request to see, correct or delete what we hold. If you are not satisfied with how we handle it, you may complain to the Information Regulator of South Africa.
What we collect and why
| Information | Why we need it | Lawful basis |
|---|---|---|
| Your answers to the assessment, and the full conversation transcript | They are what produce your score, and keeping them lets you return to an unfinished assessment | Performance of the service you asked for (section 11(1)(b)) |
| Email address | To show you your full result, send you a copy, and contact you about a report you bought | Performance of the service you asked for, with your consent recorded at the point of entry |
| Name and business name | To address the report to your organisation | Performance of the service you asked for. Both are optional |
| Country code and referring page | To understand roughly where interest comes from and which pages lead to a started assessment | Our legitimate interest in operating the service (section 11(1)(f)) |
| Payment reference, amount and date | To fulfil and account for a purchase | Performance of a contract, and compliance with tax law |
We do not collect special personal information as defined in section 26 of POPIA, and the assessment is not designed to elicit it. We do not knowingly collect information about children.
Material you upload
If you buy the readiness report or the agent scan, you can upload documents and files for us to examine. What happens to them:
- They are stored in Cloudflare R2 and are never served from a public URL.
- For the agent scan, they are mounted into a workspace that exists only for your assessment, in read-only mode. The agent cannot change or delete them, and the environment its commands run in has no network access.
- Text from them is sent to OpenAI in the United States for analysis, on the same cross-border basis described below. This is the one point at which the content of your files leaves our infrastructure.
- They are deleted when the assessment is deleted, or sooner on request.
Please do not upload live records about identifiable people. The assessment needs the shape of your data, not its contents: a field list, a de-identified extract, a policy. Where a file looks like it contains personal information we tell you so, but we do not block the upload, so the judgement remains yours. Where you upload personal information for which your organisation is the responsible party, the operator agreement governs how we process it.
What we do not do
- We do not sell your information. There is no circumstance in which we would.
- We do not use it for advertising, and we set no advertising cookies.
- We do not add you to a marketing list. Giving us your email to see a result is not consent to be marketed to.
- Your answers are not used to train any AI model, by us or by our providers.
- We do not build a profile of you across other websites.
Cross-border processing
Records are stored in the European Union (Cloudflare, Western Europe region). Payment processing happens in South Africa (PayFast). Transactional email is sent through Cloudflare Email Sending.
If cross-border processing is not acceptable for your organisation, do not use the assessment. We would rather tell you that plainly than have you discover it afterwards.
Who we share it with
Only the operators listed in the trust centre, each of which processes on our instruction and for the stated purpose only. We would disclose information if compelled by a court order or a legal obligation, and we would tell you unless prohibited from doing so.
How long we keep it
Assessments, transcripts, scores and reports are kept for 12 months and then deleted. Payment records are kept for 5 years, because tax law requires it. The full table is in the trust centre.
Your rights
Under POPIA you may:
- Ask what personal information we hold about you, and get a copy.
- Ask us to correct anything that is wrong.
- Ask us to delete it. We will, except for payment records we are legally required to keep.
- Object to processing we carry out on the basis of legitimate interest.
- Withdraw consent where consent is the basis, without affecting anything done before you withdrew it.
- Complain to the Information Regulator of South Africa. Their details are published at inforegulator.org.za.
To exercise any of these, email hello@aireadiness.co.za. We respond within 7 working days where we can, and never later than 30 days. There is no charge.
Cookies
One cookie, named ar_anon. It holds a random identifier so your browser can return to your own assessment. It is httpOnly, meaning page scripts cannot read it, and it expires after 90 days. It is not used for advertising, analytics or tracking across sites, and there is no third-party cookie on this site.
Because we set no non-essential cookies, there is no consent banner. A banner asking permission for something we do not do would be theatre.
Security
The measures we take, and what we do not claim, are set out in the trust centre. In summary: encrypted transport, session-scoped authorisation on every read, private storage for reports, secrets held outside the codebase. We hold no security certification and do not pretend otherwise.
Changes
If this notice changes materially we will update the date at the top and, where the change affects how we handle information we already hold, contact people whose email addresses we have.