Thankwrap Privacy Policy

DRAFT prepared for review by a South African attorney. It is not legal advice. Every [bracketed] item must be filled in or confirmed before publishing. Delete this box when done.

Last updated: [date] Applies to: the Thankwrap Android app, the Thankwrap AI service and the Thankwrap website (https://thankwrap.app).

1. The short version

• Your photos, gift lists, giver names, guest lists, phone numbers and messages are stored on your phone. We do not receive them and cannot see them.
• Thankwrap reads the writing on cards and gift tags on your phone.
• You send each thank-you yourself through WhatsApp. Thankwrap does not send messages for you.
• Invitations are drawn on your phone. When you tap Send on WhatsApp, the picture and message go to WhatsApp and then to whoever you choose to send them to. They contain what you typed, including an RSVP phone number if you add one. We never receive them.
• AI thank-yous are optional and off until you say yes. If you use them, a small amount of text (never photos) is sent from your phone to our server and then to Anthropic, an AI company in the United States, so a message can be written. Section 5 lists exactly what is sent.
• Our website is a simple static site with no cookies, trackers or forms. Its host, Cloudflare, keeps standard request logs (including your IP address). Section 3C explains.
• Deleting your data in the app removes it from your phone only. We cannot delete copies that Anthropic, WhatsApp or your phone maker may hold. Section 11 explains.

2. Who is responsible for your information

The "responsible party" under the Protection of Personal Information Act 4 of 2013 (POPIA) is:

• Name: Buysave PTY Ltd
• Registration number: [company or enterprise registration number, if any]
• Physical address: [address in South Africa]
• Email: [privacy email address]
• Information Officer: [name], registered with the Information Regulator. Contact: legal@thankwrap.app.

Written in this policy as "we" or "us".

3. Two kinds of information

A. Information that stays on your phone. We do not collect or receive it. You decide what goes in. Because it never reaches us, you are the one who controls it, and the rest of this policy is about what we do receive. This includes: celebrations and presents you add, photos of presents and cards, text read from cards and tags, giver names, phone numbers you type or pick, the messages you write or draft, guest lists (names, phone numbers, how many people each answer covers, your own ticks for Waiting, Coming, Maybe or No, and whether you opened a WhatsApp message to that guest), and the invitation pictures you make. If you switch on thank-you reminders, the reminder schedule is kept on your phone too, and the notifications are created by your phone. We never receive them, and your phone's lock screen only shows "You have thank-yous to send".

B. Information we do receive through the app. Only when you use the AI feature, or when your phone contacts our server:

We do not receive your photos, your contacts, your phone number, your guest lists, your invitations, your WhatsApp chats or your Google account details.

C. Information we receive when you visit our website. The website (https://thankwrap.app) is a static site. It has no cookies, no trackers, no analytics and no forms, and it does not ask you for any information. It is hosted by Cloudflare (Cloudflare Pages), which, like any web host, processes standard request records when your browser asks for a page: typically your IP address, the page asked for, the time, and technical details your browser sends such as its type. We treat Cloudflare as our host and service provider (an "operator" under POPIA). We do not use these records to identify or follow you. [Confirm in the Cloudflare account that no web analytics or other add-ons are switched on, and confirm what Cloudflare keeps and for how long, then state the period here.] [For the attorney: Cloudflare serves pages from data centres around the world, so see section 8.]

4. Why we use your information (purposes)

• To write the AI thank-you you asked for.
• To keep our service and website secure and available, and prevent abuse and excessive cost.
• [To check purchases, if paid features are added.]
• To answer you if you contact us, and to meet our legal duties.

We do not sell your information. We do not use it for advertising. We do not use it to build profiles, and we do not use it to train AI models. [Confirm this is and stays true before publishing.]

5. AI thank-yous: exactly what happens

1. You tap Draft. The first time, the app asks for your permission. Nothing is sent before you say yes.
2. Your phone sends the text listed in section 3B to our server ([hosting provider and region]) over an encrypted (HTTPS) connection.
3. Our server passes that text to Anthropic PBC ("Anthropic"), the company that makes the Claude AI model, through Anthropic's business service. Anthropic acts as our service provider (an "operator" under POPIA). It writes the message and sends it back.
4. Our server returns the message to your phone. Our own code does not store the text and does not write it to our logs.
5. [Hosting provider] is our hosting company. It may keep standard technical records that include IP addresses and request times, for up to [period]. It does not keep the card text or names in those records. [Confirm with provider settings.]
6. Anthropic's published policy for its business service says that it does not use this text to train its models by default, and that it deletes inputs and outputs from its systems within [30] days, but may keep them longer where the law requires or to enforce its safety rules (for example, if content is flagged, which can be up to two years). [Check Anthropic's current published terms on the day you publish, and update this paragraph to match. See https://privacy.claude.com and https://platform.claude.com/docs/en/manage-claude/api-and-data-retention.] We cannot delete text held by Anthropic on your behalf during that period.
7. Anthropic may process the text in [the United States / any country where Anthropic operates, depending on its settings]. See section 8.

Things to know before you use AI:

• Card and tag text can contain other people's names and personal details (for example "Love from Aunt Sarah and Uncle Pieter, 12 Main Rd"). Only use the AI feature if you are comfortable with that text going to us and Anthropic. Delete anything sensitive from the card text box first. Please do not put in health details, religious beliefs, ID numbers, addresses or account details.
• If the name you entered for the person the presents are for is a child's, please read section 10.
• Drafts are written by an AI. They can contain mistakes or odd wording. Read and edit every message before you send it.
• You can turn AI off at any time under About and privacy. When off, Thankwrap writes a simple template message on your phone and sends nothing to us.

6. Third parties in the picture

Apart from the operators above, we do not share your information with anyone, except where the law requires (for example, a court order).

7. Other people's information

Thankwrap lets you record information about other people: the giver, the child whose celebration it is, people named on cards, and the guests you invite (their names, phone numbers, party size and whether they are coming).

• On your phone, you keep this information for your own personal or household purposes, which POPIA treats as outside the Act (section 6(1)(a)(ii)). That exemption protects your own use. It does not cover what we do with information that reaches our server. [For the attorney: whether the exemption covers a host's guest list, and whether it can be relied on for guest lists a user keeps for a large or semi-commercial event, is a point to confirm. This draft does not treat it as settled.]
• Guest lists are your own records. Thankwrap stores them only on your phone and never receives them. You add each guest yourself, by typing a name or by picking one contact at a time with Android's contact picker. Thankwrap has no permission to read your address book. You are responsible for having a good reason to hold a guest's details and for using them only for your celebration. If a guest asks you to remove their details, you can delete them in the app. A guest's name appears as a one-tap suggestion in the "From" box when you record a present, and picking it copies their name (and number, if the present has none) into that present's giver record on your phone.
• Invitations contain what you type, including the names, date, place, a note and any RSVP number. Make sure the person whose RSVP number you use is happy for it to go on the invitation, and that you are happy for everyone you send it to (and anyone they pass it on to) to see it.
• The only ways a guest's name leaves your phone are in a WhatsApp message you choose to send, and, if you use AI and pick that guest as the giver of a present, the giver's name in the AI text described in section 5. Guest numbers are never sent to us.
• When you use AI, the giver's name and card text reach us and Anthropic. We handle them only to write your message, as set out in this policy. The people named can ask us about them (section 12), although because we do not keep the text, there will usually be nothing for us to find.
• You are responsible for being sensible about what you send: use first names where you can, leave out anything private, and do not use AI drafts for someone else's private messages without their agreement.
• When you message a giver on WhatsApp, you are acting for yourself. Please respect their wishes if they do not want to be contacted.

8. Sending information outside South Africa

Using the AI feature sends text to Anthropic, which is based in the United States and may process it in [the United States or other countries]. [If your server is outside South Africa: our server in [region] is also outside South Africa.] Visiting our website means your IP address and request details are handled by Cloudflare, which runs servers in many countries, so they may be processed outside South Africa. [For the attorney: confirm which section 72 ground applies to website visitors' IP addresses (for example Cloudflare's data processing terms) and whether the website needs more than this notice.]

POPIA section 72 allows this only when one of the permitted grounds applies. We rely on:

• A binding agreement. Our agreement with Anthropic (its commercial terms and data processing addendum) requires Anthropic to protect personal information, to use it only to provide the service to us, to keep it secure, and to restrict onward transfers. [Confirm the agreement is accepted in the Anthropic Console and a written operator agreement with [hosting provider] is in place.]
• Your consent, for your own information, which you give when you tap Allow in the AI permission screen.

The United States and other countries may not have a privacy law like POPIA. If you do not want your text to leave South Africa, leave AI switched off. Thankwrap works fully without it.

9. How we keep information safe

• Everything that leaves your phone travels over encrypted HTTPS. The app refuses plain HTTP.
• Your photos, gift lists and guest lists sit in the app's private storage on your phone and are excluded from Google's automatic cloud backup. Invitation pictures are made in the app's private cache and are handed to WhatsApp only when you tap Send, through a file-sharing component that exposes only that one folder. (Phone-to-phone transfer, and some phone makers' own backup tools, can still copy them. [Check on a test device.])
• Our server keeps no text, restricts who can use it, limits how many requests one address can make, and holds its secret keys in [secret storage].
• We have written agreements with the companies that process information for us.
• If we believe someone has got hold of personal information we hold, we will tell the Information Regulator and, where we can identify and reach you, you, as soon as reasonably possible, as POPIA section 22 requires. Because the AI text is not stored by us, we expect to hold very little that could be exposed.

No system is perfectly secure, and we cannot promise it. Keep your phone's screen lock on.

10. Children

• Thankwrap is for adults (18 and over), such as parents, hosts and guests. It is not directed at children, and we do not knowingly collect information from children.
• Photos of children stay on your phone. We never receive them.
• The AI feature can send the first name of the person the presents are for (for example "Leo"). If that person is a child, you may only use AI if you are the child's parent or legal guardian, or have their permission. POPIA treats a parent or guardian's consent as consent for the child (section 35(1)(a)). The AI permission screen asks you to agree only if this is true. Thankwrap sends only the first word of that name, so a surname is never sent. Please don't type a school or age into the card or tag text.
• We do not send photos, ages, birthdays or surnames of children unless you type them into the card or tag text yourself. Please do not.
• If you think a child's details reached us in a way a parent would not agree to, contact us (section 14) and we will act on it.

11. How long we keep information, and deleting it

Delete all data on this phone removes every celebration, present, guest list, photo, name, phone number and message stored by Thankwrap on this phone and switches AI off. It does not remove messages or invitations you already sent in WhatsApp, text already sent to Anthropic, or copies in a backup or transfer you made yourself.

12. Your rights under POPIA

You may:

• ask whether we hold information about you, and for a copy (POPIA section 23);
• ask us to correct or delete information about you (section 24);
• object to our processing of your information, on reasonable grounds (section 11(3)), and withdraw your consent to AI at any time (section 11(2)). Withdrawal does not undo messages already written;
• complain to the Information Regulator (section 14 below).

How to ask: email legal@thankwrap.app or write to [address]. Tell us who you are and what you want. A form is not required, though the Information Regulator's POPIA Form 1 (objection) and Form 2 (correction or deletion) may be used. We will answer within [30] days. We may need to check your identity. There is no charge for objecting or for asking for correction or deletion.

A practical point: we have no accounts, and we do not keep the AI text, so in most cases we hold nothing that could be traced to a named person. The exception is website request logs held by Cloudflare, which we cannot search by name. If you are a guest on someone's list, we do not have it: ask the person who invited you. If that is the case we will tell you plainly. Rights over what is on your phone are exercised using the app's own delete buttons.

13. Withdrawing consent

You can turn AI off under About and privacy at any time. Switching it off stops any further text being sent.

14. Contacts and complaints

Us: legal@thankwrap.app, [address]. Information Officer: [name]. This policy is published at https://thankwrap.app/privacy and the terms at https://thankwrap.app/terms.

If you are unhappy with how we handled a request, you may complain to the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200 (toll-free 0800 017 160)
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Online: https://eservices.inforegulator.org.za

[Check each of these contact details on the Regulator's contact page on the day you publish.]

15. Where the app is available

The app is available in many countries. This policy is written for South African law. If you live in the European Economic Area or the United Kingdom, [you may have additional rights under the GDPR / UK GDPR, such as a right to complain to your local authority. Contact us at legal@thankwrap.app and we will deal with your request. Add an EU/UK representative statement only if your lawyer advises that you are targeting those markets].

16. Changes

We will update this page and the date at the top when anything changes. If a change affects what is sent to us or to Anthropic, the app will ask for your permission again before it sends anything under the new terms.