Privacy Policy

Ikigai ADE is the trading name of Mohamed Sidiyot, an individual trading as a sole proprietor in South Africa. Ikigai ADE is not a registered company; there is no separate juristic entity, and Mohamed Sidiyot is personally the contracting party.

Mohamed Sidiyot, a sole proprietor trading as Ikigai ADE is the responsible party (the "controller" under the GDPR) for personal information collected through the Ikigai ADE platform and website.

Information Officer: Mohamed Sidiyot
Email: mohamedsidiyot@gmail.com
Tel: +27 68 695 9713
South Africa

Disclosure on our own compliance status: POPIA section 55 read with Regulation 4 requires an Information Officer to be registered with the Information Regulator. Our registration is not yet complete. We are telling you this rather than implying a compliance status we do not hold. It does not reduce any of your rights below, and it does not affect your right to complain to the Regulator.

We do not currently publish a physical business address. Section 43 of the Electronic Communications and Transactions Act expects an online supplier to do so, and we have not yet met that requirement. Reach us at the email and phone number above.

Account information. Name, email address and authentication data you provide at sign-up. Authentication is handled by Supabase.

Information you volunteer in forms. On our waitlist and contact forms: your name, email, and optionally a phone number, company name and website. Optional fields are labelled optional and you can leave them blank.

Content you put into the product. Prompts, uploaded documents, CRM contacts, brand material and anything else you add to your workspace or your Brain. This is yours. We process it to run the product for you.

Conversation memory. Context from your conversations with S.I.D and the agent team, stored against your account so a conversation can continue where it left off.

Usage data. Pages visited, features used, credits consumed, and which model served a request. We use this to run billing and to see where the product is failing people.

Homepage visit data, only with your OK. Our public homepage asks whether you accept analytics. If you do, it records under a random id which sections you reach, how far you scroll, what you click, where the visit came from, the kind of device, and whether you start or finish the waitlist form. No name, email or IP address is stored with it, it stays in our own database, and it is deleted 180 days after your last visit. We use it to see where the page loses people, to test two versions of a heading, and to show you a version of the page that fits your last visit. Choose "Essential only" and nothing is recorded under any id. Detail is in the Cookie Policy.

Technical and error data. When a page crashes, your browser sends us the error message, a stack trace, the page you were on, and your IP address is visible to us in that request and in our hosting logs. An IP address is personal information, so we are naming it here rather than hiding it under "technical data". We use it to diagnose faults and to rate-limit abuse.

Payment data. Card details are entered with Paystack and never reach our servers. We receive your name, email, billing country, the last four digits of the card, and whether the payment succeeded.

Third-party contact data you give us. If you upload prospects or contacts into the CRM or outreach tools, you are giving us other people's personal information. You remain the responsible party for that data; we process it on your instruction. You must have a lawful basis for it, and our Terms require you to.

POPIA section 11 and GDPR Article 6 both require a specific ground for every purpose. Ours, purpose by purpose:

Where we rely on consent, you can withdraw it at any time and we stop. Where we rely on legitimate interest, you can object and we will either stop or explain why our interest overrides your objection. Withdrawing consent does not undo processing that was lawful before you withdrew it.

We do not sell your personal information, and we do not use it to build advertising profiles. We may create and share aggregated, de-identified statistics that cannot reasonably be traced back to you or any individual. That is not personal information under POPIA or the GDPR. We do not try to re-identify it and we require anyone who receives it not to either.

The product works by sending your prompt and the context it needs to a large language model. That means the content you submit leaves our infrastructure and is processed by the AI provider serving that model. Which providers, and in which countries, is set out in sections 6 and 7.

• We only send what the request needs: the prompt, the relevant context, and your workspace content where you have asked an agent to use it.
• We contract with providers on terms that do not permit them to train their models on your content. Providers may retain it briefly for abuse monitoring, typically up to 30 days. The per-provider position is on the Sub-processors page.
• If you enable Bring Your Own Key, requests go to your own provider account under your own agreement with that provider, and their terms govern retention, not ours.
• We do not train our own models on your workspace content. Where improvements are shared across customers, what moves is the generalised technique, never your data. See the shared-learning disclosure.

Do not paste anything into the product that you are not willing to have processed by a third-party AI provider outside South Africa. If that is a problem for your data, use Bring Your Own Key, or ask us to route around a specific provider under section 9.

Some features score or rank people automatically: lead scoring, ICP fit, churn risk and similar. POPIA section 71 and GDPR Article 22 restrict decisions made purely by automated means that have a legal or similarly significant effect on someone.

• These outputs are recommendations for a human to act on. Nothing in the product automatically refuses anyone a service, a price or a contract.
• If you use our scoring to make decisions about other people, that is your processing and your responsibility under Article 22 and section 71, not ours.
• You can ask us how a score about you was produced, and ask for it to be reviewed by a person.

POPIA section 21 and GDPR Article 28 require us to name our operators (sub-processors). The full, dated and authoritative list lives on the Sub-processors page, which we update before a change takes effect. Summarised:

We require every one of them to process data only on our instructions, to keep it secure, and to be bound by a data-processing agreement. We will tell active customers at least 30 days before adding a new sub-processor.

Your personal information leaves South Africa. It has to, because the infrastructure and the AI models we use are hosted abroad. POPIA section 72 and Chapter V of the GDPR both require us to say so and to name the basis for it, so here it is plainly.

Please read this if you are in the EU or the UK. Three of the model providers we can route to are based in China. There is no adequacy decision for China under the GDPR, and we cannot honestly claim that contractual clauses alone give you protection equivalent to EU law there. If you are subject to the GDPR, or your data is sensitive, either avoid selecting those models, or tell us to exclude them from your account under section 9 and we will. GLM and Qwen have no managed lane at all: they only run on your own key.

Whatever your jurisdiction, you can ask us to:

• Access a copy of the personal information we hold about you.
• Correct anything inaccurate or incomplete.
• Delete it, except where we are legally required to keep it (see section 8).
• Export it in a machine-readable format.
• Object to processing based on legitimate interest, including outreach.
• Withdraw consent where consent is the ground we rely on.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Exclude a specific sub-processor, in particular an AI provider or a country. Where it is technically possible we will reroute you, and where it is not we will tell you so.
• Not be discriminated against for exercising any of these. Under the CCPA we will not degrade your service or change your price because you asked.

Email mohamedsidiyot@gmail.com. We respond within 30 days. We may ask you to confirm your identity first, because handing your data to someone impersonating you would be worse than a slow reply. Asking costs nothing.

Signing in uses strictly necessary and preference storage: an authentication token so you stay signed in, a session-security value, and local settings such as your sidebar state and selected model. The law does not require us to ask before setting these, and we do not.

Analytics is your choice. The homepage asks you to pick "Essential only" or "Accept analytics". Only with the second does it set two cookies of our own, ik_consent (your choice) and ik_vid (a random id), each kept for 180 days; switching to Essential only deletes the id at once. A browser that sends a Global Privacy Control signal is treated as Essential only.

We run no advertising cookies, no tracking pixels, and no third-party analytics. No analytics company receives data about your visit; what we record stays in our own database. There is no advertising SDK and no cross-site tracking on this site. Our fonts are served from our own domain, so loading a page does not tell a font provider you were here. Full detail is in the Cookie Policy.

• HTTPS everywhere, with strict transport security.
• Postgres Row Level Security so one customer's rows cannot be read by another.
• Your own provider API keys are stored encrypted with envelope encryption, never in plain text.
• Rate limiting and abuse controls on public endpoints.
• Access to production data is limited to the Information Officer.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal information, POPIA section 22 requires us to notify you and the Information Regulator as soon as reasonably possible; under the GDPR we will notify the relevant authority within 72 hours. Report a suspected vulnerability to mohamedsidiyot@gmail.com.

Ikigai ADE is a business product and is not directed at children. You must be 18 or older to hold an account. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email mohamedsidiyot@gmail.com and we will delete it.

We may update this policy. If a change is material, we will email registered users at least 14 days before it takes effect, and we will change the "last updated" date above. We will not apply a materially worse policy to data we already hold without telling you first.

Please raise it with us first at mohamedsidiyot@gmail.com. You do not have to, and you are entitled to go straight to a regulator.

South Africa. Information Regulator (South Africa): inforegulator.org.za
Email: POPIAComplaints@inforegulator.org.za

EU and UK. You may complain to your national data protection authority, or to the Information Commissioner's Office in the UK.

You can connect outside accounts in Settings › Models & keys, or from the section that uses them. Each one is connected only when you sign in to it yourself and agree on that service's own screen, and each is used only for the feature you connected it for. You can disconnect any of them at any time in the same place.

Microsoft Outlook, Meta, Xero, GitHub and Supabase. The same rules apply: Outlook is used to show your mail in Inbox and send what you write or approve; Meta Ads and Xero are read only, for your reports and your books; GitHub and Supabase are used to save and link the projects you build. Tokens are stored encrypted, nothing is sold or used for advertising or model training, and disconnecting deletes the tokens here.