Sunbird Privacy Policy
Last updated: 15 June 2026
Applies to: the Sunbird platform, the salon booking pages, and the WhatsApp booking service (together, the Service).
1. Who we are
Sunbird is a WhatsApp-native appointment-booking platform for salons and service businesses operated by Sunbird Digital (Pty) Ltd, Registration No. 2015/359496/07, a company incorporated in South Africa (“Sunbird”, “we”, “us”, “our”).
This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
Information Officer. Our Information Officer, registered with the Information Regulator as required by POPIA, is Tyrone Niland and can be contacted at privacy@sunbird.digital.
2. Two roles: when we are the responsible party, and when we are an operator
The Service is used by two groups of people, and our POPIA role differs depending on whose information is involved. This distinction is important, because it determines who you direct a request or complaint to.
a. Salon client records — the salon is the responsible party; we are the operator. When a salon (“Operator”) uses Sunbird to manage its own clients (appointment history, contact details, notes, allergies, payments), the salon decides why and how that information is processed. Under POPIA the salon is the responsible party and Sunbird is the operator (processor) acting on the salon’s documented instructions under our Data-Processing Addendum. For these records, exercise your rights with the salon directly; we will assist the salon in responding.
b. Operator accounts and consumer-direct information — we are the responsible party. For information we determine the purpose of ourselves, Sunbird is the responsible party. This includes: salon owner and staff account information; billing information; and the identity, preferences and booking history a consumer gives to Sunbird directly (for example through the consumer app or WhatsApp booking assistant) rather than to a single salon.
Where this policy refers to “we” deciding something, it concerns category (b). For category (a) we act only as instructed by the salon.
3. What we collect
Operators (salon owners and staff)
- Account information: name, email address, role, and the salon’s business details, managed through our authentication provider (see Section 6).
- Billing information: subscription status and payment records. Card data is handled by our payment processor and is not stored by Sunbird.
- Usage and technical data: log data, device and browser information, and error diagnostics.
Consumers (people who book appointments)
- Identity and contact: name, mobile/WhatsApp number, and email address where provided.
- Booking information: services booked, appointment times, the salon, deposits, no-show and cancellation history.
- Messages: the content of WhatsApp messages you exchange with the booking assistant, which may be processed by an AI model to understand and fulfil your request (see Section 6).
- Special personal information — health. Where you record allergies or related health notes so a salon can serve you safely, this is special personal information under POPIA sections 26–27. We process it only on the basis of your consent and to provide the service you asked for, we keep it isolated from marketing use, and you may withdraw it at any time.
We do not knowingly collect information from children. The Service is intended for users aged 18 and over.
4. Why we process it, and on what lawful basis
| Purpose | Lawful basis (POPIA) |
|---|---|
| Creating and securing accounts | Performance of a contract; legitimate interests |
| Taking and managing bookings, deposits and reminders | Performance of a contract |
| Processing payments | Performance of a contract; legal obligation |
| Operating the WhatsApp booking assistant | Performance of a contract; consent |
| Recording allergy / health notes | Consent (special personal information) |
| Direct marketing by the salon or by us | Consent, or the existing-customer ground in POPIA s69(3), always with an opt-out |
| Improving and securing the Service | Legitimate interests (using de-identified or aggregated data wherever possible) |
| Meeting legal and tax obligations | Legal obligation |
We do not use the content of allergy/health notes, or special personal information, for marketing.
5. Direct marketing
We, and salons using Sunbird, will only send you electronic marketing (WhatsApp, SMS or email) where POPIA permits it: with your consent, or under the existing-customer ground in section 69(3) for similar services. Every marketing message carries a free opt-out, and you can change your preferences at any time in the app or by replying to opt out. Withdrawing marketing consent does not stop service messages you need (for example, a booking confirmation or reminder).
6. Who we share information with (operators and sub-operators)
We use the following third parties to run the Service. Each processes personal information only as needed to provide its function, under contract, and (where it acts for us) as our sub-operator.
| Provider | Function | Data involved | Location |
|---|---|---|---|
| Clerk | Authentication and account management | Account identity, email | United States |
| Infobip | WhatsApp and SMS message delivery | Phone number, message content | European Union / global |
| Paystack | Payment processing | Payment and transaction data (card data held by Paystack, not us) | South Africa / Nigeria |
| Anthropic | AI model powering the booking assistant | WhatsApp message content sent to understand your request | United States |
| Resend | Email delivery | Name, email address, booking details | United States |
| Google (Places API) | Salon discovery search | Approximate location | United States |
| Hosting (self-hosted Fly.io Postgres / Valkey) | Application and database hosting | All stored data | South Africa (Johannesburg) |
| Sentry | Error monitoring | Technical and diagnostic data | United States / European Union |
We do not sell personal information. We may disclose information where required by law, to enforce our terms, or in connection with a business transfer, in which case this policy continues to apply.
7. Cross-border transfers
Some of our providers process information outside South Africa (see Section 6). Where this happens, we transfer it in line with POPIA section 72: to recipients bound by laws, binding rules or contractual terms providing an adequate level of protection, or with your consent, or where the transfer is necessary to perform the contract you asked us to provide.
8. Your rights
Subject to POPIA, you may:
- access the personal information we hold about you, and know who it has been shared with;
- correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained;
- object to processing on reasonable grounds, and withdraw consent where we rely on it;
- opt out of direct marketing at any time; and
- complain to the Information Regulator (Section 11).
How to exercise these rights in Sunbird. Consumers can request a copy of their data (a data-subject access export) and request erasure directly in the app; these requests are handled through our built-in export and erasure process. You may also contact us using the details below. For a salon’s own client records we act on the salon’s instructions, so we will pass your request to the relevant salon and assist them in responding. We respond within the timeframes POPIA requires and may need to verify your identity first.
9. Retention and security
We keep personal information only for as long as needed for the purposes above or as the law requires (for example, tax and financial records). When a consumer requests erasure, or when retention is no longer justified, we delete or de-identify the information.
We apply appropriate technical and organisational security measures, including access controls, encryption in transit, tenant isolation between salons, and monitoring.
If a security compromise occurs that affects your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by POPIA section 22.
10. Cookies and similar technologies
The Sunbird web app uses cookies and similar technologies that are necessary to sign you in, keep you signed in, and operate the Service. We do not use advertising or non-essential tracking cookies.
11. Complaints and contact
Contact us first at privacy@sunbird.digital so we can try to resolve your concern. You also have the right to complain to:
The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 POPIAComplaints@inforegulator.org.za inforegulator.org.za
12. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new “last updated” date and, where the change is significant, give you reasonable notice.