Skip to content

Privacy policy

Last updated 29 October 2026

Who we are

RippleSM (“we”) runs advertising for South African businesses: we take a brief over WhatsApp or on this website, make ad films, run the ads on Meta and Google, and report on the results. For the personal information in this policy we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Questions, requests and complaints go to our Information Officer at hello@ripplesm.co.za. Our full company details are in our terms.

The short version

  • We collect what we need to make and run your ads, and to bill and report to you.
  • We use AI to help with the work. A person on our team approves anything that goes live or costs money.
  • We never sell personal information, and we don’t use advertising or analytics cookies on this site.
  • You can ask what we hold about you, have it corrected or deleted, and object to how we use it.

What we collect, and why

  • When you message us on WhatsApp: your phone number, your WhatsApp profile name, and the messages and files you send. We use them to answer you and build your brief (POPIA s11(1)(b): steps you asked for before a contract, and the contract itself).
  • When you chat with Ripple bot on this website: what you type and the WhatsApp number you give us, so the team can follow up (same basis).
  • For your brief: business details such as your business name, area, offer, audience and budget, and the name and contact details of the person we deal with.
  • Photos and footage for your films: pictures of you, your team, your premises and your products, used only to make your films and ads. When a film shows a person, we rely on you to have their permission (see our terms), and we need a parent or guardian’s consent for a child.
  • For the client portal: your name and email address, and a record of when you sign in, to keep your account secure (s11(1)(b) and (f)).
  • From the ad platforms: campaign results from Meta and Google such as reach, clicks, spend and leads, to report to you and improve your ads.
  • For billing: your invoices, payment status and billing contact. Card payments are handled by Paystack; we never see or store card details. We keep tax records because the law requires it (s11(1)(c)).

We don’t collect special personal information (such as health, religion or biometric data used to identify someone) on purpose. Please don’t send it to us.

If we wrote to you first

We look for businesses that could use our help in public sources, such as business websites and directories. From those we keep the business’s name and its published contact details, and a short note on why we think we could help (s11(1)(f): our legitimate interest in offering a business service to a business). We write to a business at most once to ask whether it would like to hear from us (s69(2)). If you say no, or ask us to stop, we never contact you again, and we keep only what we need to make sure of that. To ask what we hold, or to be removed, email hello@ripplesm.co.za.

How AI is used

We use Anthropic’s Claude to read briefs, draft scripts and ad copy, research businesses and write reports, and other AI services to make the films. AI drafts; people decide. No decision with legal or similar effects on you is made by a computer alone (s71). Ads we make with AI are declared as AI-made where a platform asks for it.

Who we share it with

Only the service providers we need to do the work, each bound to keep it confidential and secure:

  • Meta (WhatsApp, Facebook and Instagram) and Google (Google Ads and YouTube), to message you and run your ads
  • Anthropic (Claude), and Google (Gemini) in our film pipeline, for the AI work described above
  • The cloud GPU providers our film studio rents, to render films
  • Paystack, to take card payments
  • Supabase (sign-in and data), our server host, and our email provider, to run this platform and send you email

We share information with others only when the law requires it, or to protect our rights in a dispute. We never sell it.

Information sent outside South Africa

Several of these providers store or process information outside South Africa, including in the United Kingdom, the European Union and the United States. We send it only where POPIA s72 allows: the provider is bound by law or by a binding agreement that protects it to a standard comparable to POPIA, or the transfer is needed to deliver the service you asked for.

Leads from your ads

When people respond to your ads (for example on a Facebook lead form), we handle their details on your behalf, as your operator under POPIA, only to pass them to you and to measure results. You are the responsible party for those leads and for how you use them.

How we keep it safe

Connections to this site are encrypted. The portal and our admin are behind a sign-in, and each person sees only what their role allows. Card details stay with Paystack. If we believe someone has got hold of your personal information without authority, we will tell you and the Information Regulator as soon as reasonably possible (s22).

How long we keep it

  • Client records: for as long as you are a client, and afterwards for as long as the law requires.
  • Invoices and tax records: five years from the relevant tax return (Tax Administration Act, s29).
  • Conversations that didn’t lead to working together: deleted when you ask, or once we no longer need them.
  • The website chat cookie: 90 days from your last visit (see cookies).
  • Our do-not-contact list: for as long as we prospect, so a no stays a no.

Your rights

Under POPIA you may:

  • ask whether we hold personal information about you, and for a copy of it (s23)
  • ask us to correct or delete it (s24)
  • object to how we use it, including for direct marketing (s11(3))
  • withdraw consent you gave us, without affecting what we did before
  • complain to the Information Regulator

Write to our Information Officer at hello@ripplesm.co.za. We answer within 30 days. Records requests are also covered by our PAIA manual.

Complaints

Tell us first and we’ll try to put it right. You can also complain to the Information Regulator of South Africa, whose complaint forms and contact details are on inforegulator.org.za.

Children

Our services are for businesses. We don’t knowingly collect personal information from children.

Changes

We’ll update this policy when what we do changes. The date at the top shows when it last changed.