POPIA pack

Sonar · Last updated 08 November 2026

What a business, school or government department needs to check Sonar against the Protection of Personal Information Act (POPIA), in one place: who is responsible for what, where data is kept, who processes it and for how long. The documents linked at the end are the binding ones.

Who is responsible

The business that uses Sonar is the responsible party for its customers' information, and we are its operator (POPIA section 21). We sign a written operator agreement with any business that asks: read the operator agreement. Sonar keeps a record of each contact's opt-in and opt-out, and honours STOP replies automatically.

Where data is kept

Sonar runs on our server in Cape Town, hosted by HostAfrica. Backups are on a server in Johannesburg (Microsoft Azure): the database is copied every minute, and nightly encrypted backups are kept for up to 6 months. We keep no copies outside South Africa, and voice notes are transcribed on our own server. Some of the providers below process data outside South Africa, as described.

Keeping data in South Africa

For organisations that must keep data in South Africa, such as government departments and regulated businesses:

Sonar's own copies stay in South Africa: our server in Cape Town and our backups in Johannesburg.
WhatsApp messages also pass through Meta. Meta can keep a number's messages stored only in its South African data centres (Meta calls this local storage). Numbers connected to Sonar through Meta's Cloud API get it from the start. An existing number can be moved: it goes offline for a few minutes, and Meta sends a new verification code by SMS to the number, so someone must be able to receive that SMS at the time, or the number may not connect again. While a message is being sent or received, Meta may hold it outside South Africa for up to an hour (90 minutes for marketing messages), and after that it's stored only in South Africa.
Not for the WhatsApp Business app. If you keep using the WhatsApp Business app on your number alongside Sonar, Meta doesn't offer South African storage for it. That's Meta's rule, not ours, and we can't change it: Meta keeps those messages in its own data centres, which may be outside South Africa, and the app on your phone backs chats up wherever you've set it to, such as Google Drive or iCloud. If your data must stay in South Africa, use a number that's connected only to Sonar, not to the app.
Switch the AI off. The AI Agent and Copilot write replies using Anthropic, in the United States. Switch the AI off for a number and its chats aren't sent there.
Emails. Our emails go through Microsoft 365, or Infobip if that fails. Reply alerts are optional; when switched on, they carry a customer's name, number and the start of their last message.

Who processes it

Provider	What for	Where
HostAfrica	Our main server	Cape Town, South Africa
Microsoft Azure	Our backup server	Johannesburg, South Africa
Meta	Delivers WhatsApp, Messenger and Instagram messages	South Africa at rest for numbers with local storage; otherwise Meta's data centres
Anthropic	AI Agent and Copilot replies, and our support assistant	United States; a number's chats only when its AI is on
Microsoft 365 and Microsoft Clarity	Our emails; how account users use the dashboard, with contacts, messages and form entries masked	Microsoft's data centres
Infobip	Our emails when Microsoft 365 can't send	Infobip's data centres
Netcash	Card payments	South Africa

How long we keep it

Chats and contacts: while the account is open, and deleted when the business asks.
Files in chats (photos, documents, voice notes, videos): 12 months.
Our technical copy of WhatsApp's notifications: 90 days.
Meta's copy of a WhatsApp message: up to 30 days.
Messages to our support: 24 months after the conversation ends.
Records of staff access: 2 years.
Payment, invoice and balance records: 5 years, as tax law requires.
Backups: up to 6 months.

Security

Encrypted connections (HTTPS), passwords stored only as salted hashes, two-step sign-in any account user can switch on, access restricted per business, and a web application firewall. Only one named person on our team can reach the servers and databases. If we have reason to believe data was accessed without authority, we tell the affected business immediately, and in any case within 24 hours. Our uptime is public at status.whats-hub.co.za.

Requests

Anyone can ask for access to, correction of or deletion of their information at privacy@whats-hub.co.za. If they're a customer of a business that uses Sonar, we pass the request to that business within 2 working days and help it respond.