Last updated: 8 November 2026
This notice explains what personal information Infinite Code (Pty) Ltd, trading as iCodeAI, collects through icodeai.co.za, why, who receives it, how long it is kept, and your rights. It is written to meet section 18 of South Africa's Protection of Personal Information Act (POPIA) and, for visitors in the UK and EU, Articles 13 and 14 of the GDPR and UK GDPR.
1. Who we are
The responsible party (controller) is Infinite Code (Pty) Ltd, trading as iCodeAI, a private company registered in South Africa, based in Weltevreden Park, Roodepoort, 1709, Gauteng, South Africa.
- Email: info@icodeai.co.za
- WhatsApp: +27 76 754 6115
- Information Officer: our director, who is the head of the company, reachable at info@icodeai.co.za
When we run AI agents or other services for our clients, our client is the responsible party for their customers' information and we act as their operator (processor), under a written agreement. That processing is covered by the client's own privacy notice and our contract with them, not by this notice.
2. What we collect, and where it comes from
| Where | What we collect | Required? |
|---|---|---|
| Contact form | Name, company, work email, phone (optional), the topic you choose and your message | Name, email and message are needed to reply |
| Chat with Felix, our AI assistant | What you type, the replies, the time, and a random session code | Only what you choose to type |
| "Leave your details" form in the chat | Name, email, company and phone (optional), preferred time to talk, your consent | Name and email are needed to reply |
| Booking a call | Name, email, company and phone (optional), your notes, your time zone and the time you choose | Name and email are needed to book |
| Talk to Felix (voice page) | The text your browser makes from your speech. Your browser's speech service turns your voice into text; we receive only the text, not audio | Optional |
| Cost calculators | Nothing. The numbers you enter stay in your browser unless you choose "Book a call about this", which copies a summary into the booking notes for you to edit before sending | n/a |
| Security and spam protection | Your IP address (to limit abuse) and, when you fill in a form, the information Google reCAPTCHA collects about your device and how you use the form | Needed to protect the site |
We do not ask for ID numbers, bank details, health information or passwords, and we ask you not to type them into the chat.
3. Why we use it, and on what basis
| Purpose | Lawful basis (POPIA section 11; GDPR Article 6) |
|---|---|
| Reply to your enquiry, chat or form | Your consent, and steps you ask for before a contract |
| Arrange your call and send confirmations and reminders | Your consent and steps before a contract |
| Provide and manage services you buy from us | Performance of a contract |
| Improve Felix's answers by reviewing conversations | Our legitimate interest in a helpful, accurate service |
| Keep the site secure and stop spam | Our legitimate interest, and our duty to keep information secure (POPIA section 19) |
| Keep records the law requires | Legal obligation |
| Tell you about our services | Your consent, or, for existing customers, about similar services with an opt-out each time (POPIA section 69) |
Every marketing email names us and has a one-click opt-out. When you opt out, your email address goes on a permanent do-not-contact list so we never email you again.
4. Who receives it
We never sell personal information. These kinds of service providers process it for us, each under a written agreement with data processing terms:
| Service provider | What it does for us | Where it processes data |
|---|---|---|
| AI model provider | Generates Felix's replies from the text of the conversation | United States |
| Cloud application hosting | Runs our application | Germany (EU) |
| Cloud database hosting | Stores our records | Ireland (EU) |
| Email delivery service | Sends our emails | Outside South Africa |
| Google reCAPTCHA | Spam protection on our forms | United States and other countries |
| Video-call service | Hosts calls you book with us | United States and other countries |
| South African web host | Hosts this website and our mailboxes | South Africa |
| Online payment provider | Processes card and instant EFT payments, when you pay an invoice online | South Africa and other countries |
If you want to know exactly which companies receive your information, ask us at info@icodeai.co.za and we will tell you. Clients receive the full list in their data processing agreement. If you message us on WhatsApp, WhatsApp handles that conversation under its own terms. We may also share information when the law requires it.
5. Sending information outside South Africa
Some providers above process information in the United States and the European Union. We only use providers bound by a written agreement that gives a level of protection substantially similar to POPIA (section 72). For information from the UK or EU, we rely on the safeguards those laws recognise, such as the European Commission's standard contractual clauses and the UK's international data transfer addendum.
6. How long we keep it
| Information | How long |
|---|---|
| Chat conversations | 12 months, then deleted |
| Enquiries, leads and bookings | While we are in contact, and up to 24 months after the last contact |
| Client contracts and invoices | At least 7 years, as company and tax law require |
| Complaints | Up to 3 years after the complaint is closed |
| Email opt-outs | Permanently (only the email address and date), so we can keep honouring them |
| Security logs | For the short period our hosting provider keeps them |
7. How we protect it
All traffic to our site and services is encrypted (HTTPS), our database connection is encrypted and locked against public access, access is limited to named people with two-step login, and our notification emails contain only a short summary rather than full conversations. No system is completely secure. If a security compromise affects your information, we will tell the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.
8. Your rights
You may:
- ask whether we hold information about you and for a copy of it (see our PAIA manual);
- ask us to correct or delete it;
- object to our use of it, including for marketing, at any time;
- in the UK and EU, also ask us to restrict how we use it, or to give it to you in a format you can take elsewhere;
- withdraw your consent at any time, without affecting what we did before; and
- complain to the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za, on 010 023 5200, or through inforegulator.org.za. In the UK you may complain to the ICO, and in the EU to your local data protection authority. We would appreciate the chance to put things right first, so please tell us too.
Write to info@icodeai.co.za. We will reply within the time the law allows and may ask you to confirm your identity first.
9. Our AI assistant
Felix is an AI, not a person. It answers from information we have approved, can be wrong, and does not give legal, medical or financial advice. Conversations are stored so our team can follow up and improve answers. The text is sent to our AI model provider in the United States to generate replies. Under its business terms, content we send is not used to train its models. No decision with legal or similarly significant effect is made about you by automated means.
10. Cookies and similar technology
We do not use advertising or analytics cookies. The chat keeps your conversation open as you move between pages using your browser's session storage, which is cleared when you close the tab. In the same way, the contact form, calculators and plan builder remember what you typed or chose in this tab, so the booking page can fill it in for you; nothing is sent to us until you press send or confirm. Your chosen currency is remembered in your browser's local storage so prices show in that currency next time. Our fonts and the code that draws the 3D town and brain are served from our own website, so no other company sees your visit when a page loads. Google reCAPTCHA loads only when you start filling in a form, and then sets its own cookies to tell people from bots.
11. Children
This site is for businesses. We do not knowingly collect information from anyone under 18.
12. Changes
We update this notice when our practices change and show the date at the top. We keep earlier versions, and you can ask us for a copy.