1. Purpose and application
This policy protects Messaging Participants, Clients, White-Label Platform Operators, Bvelaphanda, Meta and the integrity of BotHub. It applies to every user, workflow, integration, campaign and communication processed through BotHub. A Client remains responsible for its users, contractors, content, contact lists, instructions and business outcomes.
2. Core obligations
- Use BotHub only for lawful, authorised and documented business purposes.
- Provide accurate identity and contact information and do not impersonate another party.
- Maintain a valid lawful basis for personal-information processing and messaging.
- Follow POPIA, consumer, advertising, industry and communication-channel rules applicable to the Client.
- Use only contact lists and data that the Client is authorised to use.
- Protect credentials, apply least privilege and report suspected compromise promptly.
- Cooperate with privacy requests, complaints, investigations, remediation and platform enforcement.
3. Consent, opt-in and direct marketing
Clients must obtain and retain evidence of the required WhatsApp or channel opt-in before initiating messages. An opt-in must identify the Client and make the intended communication sufficiently clear. POPIA requirements for electronic direct marketing apply independently of channel rules.
- Do not use purchased, scraped or unlawfully obtained lists.
- Do not treat a failure to opt out as consent.
- Identify the sender and provide a free, functional opt-out method.
- Apply opt-outs without unreasonable delay across relevant lists, campaigns and integrations.
- Do not re-add a person who opted out unless a new lawful basis is documented.
- Keep a minimal suppression record where necessary to honour the opt-out.
4. Prohibited content and conduct
- Illegal, fraudulent, deceptive, defamatory or rights-infringing activity.
- Spam, repeated unwanted messages, harassment, threats, intimidation or discriminatory abuse.
- Impersonation, phishing, credential theft, malware, malicious links or unauthorised access.
- Misleading claims, fabricated endorsements or concealment of the Client’s identity.
- Content or conduct prohibited by Meta, WhatsApp or another connected channel.
- Collection or disclosure of information that is excessive, irrelevant or not lawfully authorised.
- Attempts to bypass quotas, safety controls, opt-outs, account restrictions or platform enforcement.
- Use that materially degrades the platform, probes another Client environment or interferes with service operation.
5. High-risk uses
The following uses require a written risk assessment, explicit approval in the Statement of Work and appropriate human oversight. Bvelaphanda may decline or impose additional controls:
- Processing large volumes of special personal information or children’s information.
- Health, financial, legal, employment, insurance or credit decisions.
- Identity verification, biometric processing, criminal-behaviour information or fraud accusations.
- Solely automated decisions with legal or similarly significant effects.
- Emergency, safety-critical or life-critical communications.
- Cross-Client matching, shared profiling or reuse of identifiers for a new purpose.
BotHub must not be represented as professional advice or a guaranteed decision-making system. A Client remains responsible for qualified human review where the subject matter requires it.
6. Special personal information and children
A Client may process special personal information or children’s information only where a valid POPIA authorisation and appropriate safeguards exist. The Client must minimise collection, restrict access, define retention and ensure that messaging is suitable for the affected person. Persons under 18 may not administer a BotHub account.
7. AI and automated features
- Do not use AI output without the review level agreed for the use case.
- Do not intentionally submit information to an external model unless the Client is authorised and the provider is approved.
- Do not use prompts or knowledge sources that infringe rights or expose another Client’s information.
- Do not claim that AI output is always correct, unbiased or approved by Bvelaphanda.
- Immediately disable or escalate a workflow that produces harmful, discriminatory or materially incorrect results.
8. White-Label Platform Operator duties
- Apply this policy to every downstream Client.
- Verify Client identity and intended use before activation.
- Do not permit downstream resellers without Bvelaphanda’s written approval.
- Restrict support access and prevent cross-Client access or reuse.
- Report suspected misuse and implement Bvelaphanda’s suspension instructions promptly.
9. Monitoring and complaints
Bvelaphanda does not undertake to pre-screen every message or continuously supervise each Client. It may use service metrics, abuse signals, complaints and targeted review to protect the service and investigate suspected violations. Review will be limited to what is reasonably necessary and subject to confidentiality and access controls.
10. Enforcement
Bvelaphanda may require information, corrective action, additional controls or a written remediation plan. Depending on seriousness and urgency, it may restrict a user, workflow, campaign, integration, Client or White-Label Platform Operator; preserve relevant evidence; suspend service; or terminate the agreement.
Immediate action may be taken where Bvelaphanda reasonably believes there is fraud, unlawful processing, a security threat, serious harassment, failure to honour opt-outs, a severe Meta violation, imminent harm, regulatory exposure or material risk to another Client. Bvelaphanda will provide notice and reasons where reasonably possible without prejudicing an investigation or legal duty.
11. Reporting misuse
- Email — policy@bvelaphanda.co.za
- Information to include — Client name, number or account, date, message evidence, requested outcome and contact details.
- Emergency security reports — policy@bvelaphanda.co.za with “URGENT SECURITY” in the subject line.
12. Changes
Material policy changes will be notified to contracted Clients and White-Label Platform Operators before taking effect where reasonably practicable. Continued use after the effective date constitutes acceptance only to the extent permitted by the applicable agreement and law.