Trust centre
This product asks you how you handle data. It would be poor form to be vague about how we handle yours, so this page says plainly what is collected, where it goes, and how to get rid of it.
Last updated 24 August 2026
What the free assessment stores
Everything you type into the assessment is stored. That is not a side-effect, it is how the assessment works: your answers are what produce the score, and keeping them is what lets you close the tab and come back to an unfinished conversation.
Specifically, we store:
- The full transcript of the conversation, both your messages and the assessment’s.
- For each question, the option value your answer was mapped to, along with which model did the mapping and how confident it was.
- Your score, the per-area breakdown, and the recommended next step.
- Your email address, name and business name, once you give them. These are not required to take the assessment, only to see the full result.
- The page that referred you, and the two-letter country code Cloudflare derives from your connection. We do not store your IP address against your assessment, and we do not store any finer location than country.
We do not use cookies for advertising or analytics. The only cookie set is a randomly generated session identifier that lets your browser return to your own assessment. It is not linked to any advertising network.
Where processing happens
This is the part most services bury, so it goes near the top here.
The conversation is processed outside South Africa. Your messages are sent to OpenAI’s API in the United States, which conducts the conversation and classifies your answers into rubric values. This is cross-border processing of personal information within the meaning of section 72 of POPIA. If that is not acceptable for your organisation, the assessment is not suitable for you, and we would rather you knew that before starting than after.
Your answers are not used to train any model, by us or by OpenAI under its commercial API terms.
Records are stored in the European Union. Assessments, transcripts, answers and scores live in a Cloudflare D1 database in the Western Europe region. Generated PDF reports live in Cloudflare R2 and are only ever served through a short-lived signed link, never a public URL.
Evidence you upload stays in the same place. Documents and data-room files go to Cloudflare R2, never a public URL. When you run the agent, they are mounted into a workspace that exists only for your assessment, in read-only mode, so a write fails at the filesystem rather than being prevented by an instruction. The sandbox the agent’s commands run in has network access switched off completely. The one thing that does leave is what the agent reads: the text it examines is sent to OpenAI in the United States, on the same cross-border basis as the conversation described above. Upload the shape of your data, not a live customer export. If we detect what looks like personal information in a file, we tell you so you can withdraw it.
We never ask for a password to your systems. There is no field on this site that accepts one and no process that would use one. You place exports in the data room yourself. Where you are exporting from a system that has logins, make a separate read-only account for the purpose rather than using a staff member’s.
Payments are processed in South Africa by PayFast. Card details are entered on PayFast’s own page. We never see, receive or store a card number.
Email is sent by Cloudflare rather than a separate provider, so the list of companies handling your information is one shorter than it was.
Subprocessors
These are the third parties that process data on our behalf. If this list changes we will update it here.
| Subprocessor | Purpose | Where | What it receives |
|---|---|---|---|
| OpenAI | Conducts the assessment conversation and classifies answers | United States | Your messages and the assessment's own messages |
| Cloudflare | Hosting, database, file storage, PDF rendering, and transactional email | Western Europe (database), global edge (hosting and email) | Everything stored, as listed above, plus the content of any email we send you |
| PayFast | Payment processing | South Africa | Your name, email address and the amount. Card details go directly to PayFast and never reach us |
How long it is kept
| What | Kept for | Why |
|---|---|---|
| Unfinished assessments | 12 months from the last message | So you can return to a conversation you left. Deleted automatically after that |
| Completed assessments, scores and transcripts | 12 months from completion | So you can return to your result and we can regenerate a report you paid for |
| Generated PDF reports | 12 months from generation | Same |
| Payment records | 5 years | Required for tax and accounting purposes. Retained even if you delete the rest |
| Email delivery log | 12 months | So we can show what was sent to whom if you ask |
Payment records are the one thing we cannot delete on request. South African tax law requires records of transactions to be kept, and we keep the minimum: the amount, the date, the reference and the email address the payment was made under.
Getting your data deleted
Email hello@aireadiness.co.za from the address you used, with the word “deletion” in the subject line. We will:
- Confirm the request is genuinely from you. If you email from a different address we will ask you to verify, because deleting someone else’s assessment on request would be its own kind of failure.
- Delete your assessments, transcripts, answers, scores and any generated reports.
- Confirm in writing when it is done.
We aim to complete this within 7 working days and will not take longer than 30. You may also ask for a copy of what we hold, or for a correction. The same address handles all three.
You have the right to complain to the Information Regulator of South Africa if you are unhappy with how we have handled a request.
Security
- All traffic is served over HTTPS. There is no unencrypted path to the application.
- Your assessment is tied to a random session token held in an httpOnly cookie, and every read checks it. Knowing an assessment identifier is not sufficient to read someone else’s answers.
- Generated reports are stored privately and served only through short-lived signed links. There is no public URL for a report.
- Secrets are held in Cloudflare’s secret store, not in the codebase.
- Payment notifications are verified by signature and confirmed directly with PayFast before anything is unlocked.
What we do not claim: we hold no security certification. There is no ISO 27001, no SOC 2, no independent penetration test. This is a small product and saying otherwise would be a lie you could not easily check.
If something goes wrong
If we become aware of a compromise affecting personal information, we will notify the Information Regulator and every affected person as soon as reasonably possible, as section 22 of POPIA requires. Notification will say what happened, what data was involved, what we have done, and what you may want to do.
We will not delay notification to establish the full picture first. You will hear from us while we still have incomplete information, and again when we know more.
To report a vulnerability, email hello@aireadiness.co.za. We will acknowledge within two working days. We do not currently run a paid bug bounty.
On POPIA compliance
The assessment never tells you that you are POPIA compliant, and never tells you that you are not. A self-assessment cannot determine compliance: it records what you told us, and it has not been verified against your systems.
Where your result flags something in the privacy or governance areas, the correct reading is “a possible gap that requires verification”, not “a finding”. It is a starting point for a conversation with a lawyer or your Information Officer, and it is genuinely useful as that. It is not a substitute for either.
Anyone selling you a compliance determination from a questionnaire is selling you something they cannot deliver.
Contact
hello@aireadiness.co.za reaches a person. Related reading: privacy notice, operator agreement and frequently asked questions.