Privacy

1. Who we are

PRASA ai is run by System Sol, a South African company, from 466 Imam Haron Road, Lansdowne, Cape Town, Western Cape, 7780. We make free tools that help PRASA train riders in Cape Town, Gauteng, Durban and East London.

You can reach our Information Officer under the Protection of Personal Information Act (POPIA) at info@prasaai.co.za.

2. Our services, in short

• The app (prasaai.co.za/app): no account and no phone number. Your trips and settings stay on your phone. Questions it can't answer go to our server as text only. Crowd reports are anonymous.
• The website (prasaai.co.za): no account. Nothing that identifies you; cookie-free visit counts.
• The 3D world: no account. Your saved station and trips stay on your device.
• WhatsApp (being phased out): your WhatsApp number (encrypted), language, saved trips, crowd reports, and messages for up to 7 days.

3. The app

• No account, no number, no name. You don't sign up.
• On your phone only: your region, saved trips, recent stations, alert choices and a random code for crowd reports are kept in your browser's storage on your phone. We can't see them. Clearing the site's data or removing the app deletes them.
• Your location is used only on your phone, if you allow it: to find your nearest station and, for a crowd report, to check whether you are at the station. Only "yes" or "no" is sent, never where you are.
• Questions the app can't answer itself are sent to our server as text, without your number or any code that identifies you. Our server asks OpenAI what you meant (see section 6) and returns the answer. We don't store or log the text of these questions. For a few minutes we keep a scrambled fingerprint of the question so the same question isn't sent twice.
• Crowd reports (on time, late, no train, full) are anonymous. Your phone makes a random code and we only store a scrambled version of it, to stop one phone reporting too often. Your internet address is scrambled and kept for 26 hours, only to limit reports per address. Each report (station, line, train, what you reported, the time, whether you were at the station) is kept for statistics, and after 30 days the scrambled code is removed, so it can't be linked to any phone. You can undo a report for 2 minutes after sending it.
• Alerts: the lines you choose are kept on your phone.

4. The website and the 3D world

• We count visits with Vercel Web Analytics. It uses no cookies and does not identify you: we see totals, such as which pages are visited, which country visitors come from, how many taps there are on the app, 3D world and WhatsApp links, and how many times the app is added to a phone and opened from one (at most once a day per phone).
• The trip box on the website uses the same timetable as the app and keeps your trips on your device, shared with the app on the same phone.
• The 3D world keeps your saved station and trips on your device. To draw the map and the weather, your browser loads map data and weather from the 3D world's own files and from Open-Meteo. These requests carry nothing about you beyond what any website request carries, such as your internet address.

5. WhatsApp (being phased out)

We are phasing out our WhatsApp service because WhatsApp now charges for every reply. Until it is switched off, this is what it keeps when you message it:

• Your WhatsApp number, stored encrypted (AES-256-GCM) and looked up by a scrambled version, never in plain text.
• Your language, worked out from your messages.
• Saved trips ("My Train"), if you set one up, and your alert and reminder choices.
• Crowd reports you send. After 30 days they no longer link to you and are kept only as statistics.
• Your messages and our replies, in full, for up to 7 days, to fix problems and improve answers. After 7 days they are deleted automatically.
• Words we couldn't match to a station (for example a nickname), without your number, so we can teach PRASA ai new station names.
• Totals such as how often each route is asked about, with no link to you.
• A conversation's short-term memory (your last trip, for follow-up questions) expires after 60 minutes.

6. Who handles data for us

We use these companies to run PRASA ai. Each only gets what it needs, and none may use it for its own purposes.

• OpenAI, to understand questions and write some answers: the text of the question (WhatsApp, or the app's online helper), never your number.
• Meta (WhatsApp), to carry WhatsApp messages: your number and messages, under WhatsApp's own privacy policy.
• Hetzner, our servers and database: everything in section 5, and anonymous crowd reports.
• Vercel, hosting the website, app and 3D world, and the visit counts: ordinary website requests and cookie-free totals.
• DuckDuckGo, to look up some general questions on WhatsApp: the question as a search, never your number.
• Sentry, error reports from our server so we can fix problems: technical details of the error.

Some of this data is processed outside South Africa. Under POPIA section 72 we only use providers bound by privacy laws or agreements that protect your information at least as well as POPIA does.

7. What we never do

• We don't sell, rent or trade your information.
• We don't use it for advertising or build profiles of you.
• We don't share it with PRASA, Metrorail or any government body, unless the law requires us to.
• We don't track where you are.

8. Why we use it

We process information because you asked us to (answering your question, saving your trip), with your consent (alerts, location, crowd reports), and for our legitimate interest in keeping the service working, safe from abuse and improving (limits, statistics, fixing errors).

9. How we protect it

• WhatsApp numbers are encrypted and looked up by a scrambled version.
• App and crowd-report codes and internet addresses are only stored scrambled.
• Only authorised System Sol staff can reach the data, and only what their work needs.
• Our systems are kept updated and monitored.

10. How long we keep it

• App data on your phone: until you clear it or remove the app.
• Text of the app's online questions: not stored.
• Crowd reports: kept for statistics; the scrambled device code or WhatsApp link is removed after 30 days.
• Scrambled internet address (app limits): 26 hours.
• WhatsApp messages and replies: up to 7 days.
• WhatsApp conversation memory: 60 minutes.
• WhatsApp number, language, saved trips: until you ask us to delete them.
• Visit counts: totals only.

11. Your rights

Under POPIA you can ask to see, correct or delete the information we hold about you, object to how we use it, and complain to the Information Regulator.

• WhatsApp: send "delete my data" in the chat. Your number, language, saved trips, messages and recent crowd reports are deleted straight away.
• The app, the website and the 3D world: your data is on your phone. Clear the website's data in your browser, or remove the app. Anonymous crowd reports can't be traced back to you, so we can't find "yours" to delete.
• Anything else: email info@prasaai.co.za.

12. Changes

If we change this policy we will update this page and its date. Big changes will also be shown in the app.

13. Contact

Email info@prasaai.co.za. System Sol, 466 Imam Haron Road, Lansdowne, Cape Town, Western Cape, 7780.