1. Who We Are
PRASA ai is a product of System Sol, a South African company trading as PRASA ai. We build tools that make public transport easier for everyday commuters in Cape Town.
You can reach us at:
Our designated Information Officer under the Protection of Personal Information Act (POPIA) is Muammar Ras, who can be contacted at info@prasaai.co.za.
2. What We Collect
We only collect the minimum information needed to deliver a useful train assistant to you via WhatsApp. Here is what we gather:
- Your WhatsApp phone number — this is necessary to send and receive messages with you through WhatsApp.
- Language preference — automatically detected from your messages so we can respond in a language you are comfortable with.
- Saved route preferences — if you set up "My Train," we save your preferred routes so you get relevant information faster.
- Crowd reports — if you voluntarily submit a report about train conditions, we store that to help other commuters.
- Basic usage analytics — message timestamps and which features you use, so we can understand how to improve the service.
3. What We Do Not Collect
We believe in collecting as little as possible. Here is what we deliberately avoid:
- We do not store the content of your messages after they have been processed. Once your request is handled, the message text is discarded.
- We do not collect your location unless you explicitly share it with us in a message.
- We do not sell, rent, or share your personal data with any third parties.
- We do not use your data for advertising, targeted marketing, or profiling of any kind.
- We do not share your data with PRASA, Metrorail, or any government entity.
4. Why We Collect It
Under POPIA, we must have a lawful reason for processing your personal information. We rely on legitimate interest and consent as our legal bases. Specifically, we use your data for the following purposes:
- To provide personalised train information — your saved routes and language preference allow us to send you relevant updates without you having to repeat yourself.
- To deliver relevant delay alerts — knowing your preferred routes means we can notify you about disruptions that actually affect your commute.
- To improve the service — understanding how features are used helps us focus our efforts on making the things that matter most work better.
5. How We Protect It
We take the security of your personal information seriously. Here are the measures we have in place:
- Encryption at rest — phone numbers are stored using AES-256-GCM encryption, an industry-standard method used by banks and governments worldwide.
- Hashed lookups — when our system needs to look up your information, it uses hashed identifiers rather than your raw phone number, adding an extra layer of protection.
- Restricted access — only authorised personnel within System Sol have access to personal data, and that access is strictly limited to what is needed for their role.
- Secured infrastructure — our systems are hosted on secured infrastructure with regular security updates and monitoring.
6. How Long We Keep It
We do not keep your data forever. Our retention periods are designed to balance usefulness with your privacy:
- Active account data — retained for as long as you actively use the service. If you stop using PRASA ai, your data remains until you request deletion.
- Crowd reports — anonymised after 30 days. After that point, the report may still exist for statistical purposes, but it can no longer be linked back to you.
- Session data — expires automatically after 30 minutes of inactivity.
- Deleted accounts — when you request deletion, all personal data associated with your account is removed within 7 days.
7. Your Rights Under POPIA
The Protection of Personal Information Act gives you meaningful control over your data. As a user of PRASA ai, you have the following rights:
- Right to access — you can request a copy of the personal data we hold about you at any time.
- Right to correction — if any of your data is inaccurate or outdated, you can ask us to correct it.
- Right to deletion — you can have your personal data deleted. The easiest way is to send the message "delete my data" directly in our WhatsApp chat, and we will process your request.
- Right to object — you can object to the processing of your personal information if you believe we do not have a lawful basis.
- Right to lodge a complaint — if you believe your data has been mishandled, you have the right to lodge a complaint with the Information Regulator of South Africa.
To exercise any of these rights, contact us at info@prasaai.co.za or message us on WhatsApp.
8. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will post the revised policy on this page and update the effective date at the top.
We encourage you to review this page periodically. Your continued use of PRASA ai after any changes constitutes your acceptance of the updated policy.
9. Contact Us
If you have questions, concerns, or requests regarding this privacy policy or how we handle your personal data, please get in touch: