Privacy notice

Diretsa is a product of Aha Core (Pty) Ltd. Aha Core (Pty) Ltd is the responsible party for personal information it processes to operate Diretsa, manage partner accounts and respond to enquiries. POPIA protects information about identifiable people and, where applicable, existing legal entities.

Information Officer: Edzai C. Zvobwo, Managing Director, Aha Core (Pty) Ltd. Contact: support@diretsa.com (subject “Diretsa privacy request”).

Publishers and advertisers remain responsible for personal information they collect for their own publications, mailing lists, websites and campaigns. Where we process information on a partner’s instructions, the relevant agreement must set out our responsibilities as an operator.

• Account details: your email address, the organisations you belong to and your role, sign-in records, and two-step sign-in settings if you turn them on. Passwords are handled by our sign-in service; we never see them.
• Organisation details: organisation name, brand website, publication sites, placements, prices, screen locations (for screens and billboards), ad rules, pages and numbers your ads may link to, and proof that you own a website or brand.
• Business checks for advertisers without a website: the registered name and CIPC or NPO number, or a sole trader's name and ID or passport number, plus a contact person and phone number. A sole trader's full ID or passport number is kept only until a Diretsa admin has checked it; after that we keep only its last four digits.
• Campaigns and artwork: briefs, budgets, artwork, click-through links, approvals and the delivery reports for each booking. For screens and other media publishers run themselves: play logs and proof of what ran.
• Artwork and link checks: a copy of new artwork while it waits for a check (deleted once a person has decided), the result of the automatic check, and where each live ad's link leads when we follow it each day.
• Payments by advertisers: card top-ups and invoice payments are made on Paystack’s payment page. We never see or store card numbers. We keep the amount, date, Paystack reference, invoices and receipts.
• Bank details of publishers: to pay publishers, we send the account number, account holder name and ID, passport or company registration number to Paystack, which checks them with the bank and stores them for payouts. Diretsa keeps only the bank name, account holder name, account type and the last four digits of the account number.
• AI apps you connect: if you connect Diretsa to Claude, ChatGPT, Copilot or another AI app, we keep a record of the connection (which app, what you allowed it to do, when). The app sees only what your account can see, and only the parts you allowed.
• AI buying agents (AdCP keys): for each key an advertiser creates, we keep:
  • its name, who created it and when, and when it was last used;
  • the first few characters, so keys can be told apart, and a one-way fingerprint, so we can recognise the key.

  We never store the key itself; it is shown once, when it is made. Everything done with a key is recorded in the audit record. The agent can see only that advertiser's own placements, bookings, artwork and delivery figures.

• Questions to the assistant: we keep questions you ask the Diretsa assistant, on the website or in Media Control, together with its answers and your thumbs up or down, for 12 months, to improve the answers. A Diretsa administrator reviews questions the assistant could not answer. If the administrator approves an answer, that answer is added to the assistant's knowledge. Your question is not added, and approved answers must not contain names, contact details or other personal information. When you are signed in, we also keep your saved conversations with the assistant and the campaign briefs you send to the campaign planner.
• Technical and security records: an audit record of important actions (who did what, when), error reports and request logs kept by our hosting providers.
• Screen players: a screen running the Diretsa player sends which ad played and when, and its browser type.
• Web analytics: on our pages, Acalytica web analytics (operated by Aha Core (Pty) Ltd) records page visits, the page address and title, referring site, campaign tags, screen and window size, time zone, light or dark mode, clicks, scrolling and outbound link clicks, so we can see how the site is used. It sets no cookies; it keeps a random visitor ID and session ID in your browser’s local storage until you clear it. It does not read what you type into forms. It runs on all our pages, including Media Control and the sign-in pages. See the cookie notice to opt out.
• Ad measurement: we load Google’s ad measurement tag (Google Ads) so we can tell whether our advertising brings people to Diretsa. It records the pages you view and whether an ad click was followed by an advertiser sign-up, and may store or read cookies and similar identifiers in your browser for that purpose. In the European Economic Area, the United Kingdom, Switzerland and Quebec we ask first and load it only after you accept; elsewhere it loads by default. You can change your choice at any time in the cookie notice. Google’s privacy statement is at business.safety.google/privacy.

People who see the ads. When an ad is shown on a publisher’s website or newsletter, our ad server (serve.diretsa.com) receives the reader’s IP address and browser details, as any web server does. We shorten (anonymise) IP addresses before anything is stored, we use them only to tell which country the reader is in and to count impressions and clicks, and we do not set a cookie that recognises readers across visits or sites. We do not build profiles of readers. Publishers remain responsible for the notices and consents on their own sites.

Please do not upload mailing lists, identity documents, sensitive personal information or children’s personal information into campaign artwork, support messages or assistant conversations unless a lawful, agreed process specifically requires it.

• To check ads before they run and follow their links, so readers are not sent to scams or impersonation.
• To take payments from advertisers and pay publishers, and to keep the money records the law requires.
• To check that people are who they say they are and own the website or brand they register, and to prevent fraud (for example the 7-day wait before payouts go to new bank details).
• To respond to enquiries, discuss participation in the network, and take steps towards an agreement at your request.
• To provide an agreed service: manage accounts and access, plan and approve campaigns, deliver artwork, report results and reconcile financial records.
• To protect the service, investigate misuse, keep accountable approval records and resolve disputes, where necessary for our or a partner’s legitimate interests and subject to your rights.
• To meet applicable legal obligations, including financial recordkeeping and lawful requests from authorities.
• Where consent is the appropriate basis, to carry out the specific activity you agreed to. You may withdraw that consent without affecting processing that was lawful before withdrawal.

Recommendations and automated checks. Recommended next steps are worked out on Diretsa's own servers from delivery figures: impressions, clicks, spend, prices and ad sizes. They use no information about the people who see ads and are not sent to an AI provider. To check that recommendations actually help, we record:

• each recommendation shown;
• whether it was followed;
• the campaign's results 14 days later.

We use these records only in aggregate. None of these steps is a decision about a person made solely by automated means with legal or similar effects, as section 71 of POPIA describes. Recommendations are suggestions, and artwork is rejected only by a person.

Contact and account details needed to answer your enquiry or provide partner access are necessary for those purposes. If they are not provided, we may be unable to respond, verify your identity or provide the relevant service. Optional information need not be supplied.

We do not treat visiting the site as consent to electronic direct marketing. Any such marketing must meet POPIA’s consent or applicable existing-customer requirements and include a way to object or unsubscribe. Service messages about your account or an agreed campaign are distinct from promotional messages.

When you, or an AI agent acting for you, search Diretsa for placements, we keep that search (the brief and any filters) for 180 days. We use it to rank placements by how well they fit, to show you your own searches, and, combined across advertisers, to see which audiences and regions are in demand. Only your organisation and Diretsa staff can see your searches; publishers and other advertisers never do, and Diretsa staff review demand in aggregate.

The assistant and the campaign planner give advice only. Spending money always needs a person: an authorised person in Media Control, or, in an AI app, your clear yes to a summary with a one-time code.

We share personal information only with the people and services that need it:

• people in your organisation, according to their role, and Diretsa administrators;
• the advertiser or publisher on the other side of a booking (organisation name, the booking, artwork and delivery figures; not your personal contact details unless needed to run the booking);
• service providers that run Diretsa for us under contract, listed below;
• authorities, when the law requires it, and our professional advisers.

Service providers and where they process information:

• Railway (hosting of the Diretsa platform, database and ad server): servers in Singapore.
• Lovable and Supabase (Media Control website, sign-in and its database): outside South Africa.
• Paystack Payments South Africa (card payments, bank-account checks and payouts): South Africa and its group’s servers.
• Resend (sending service emails): United States.
• Sentry (error reports, with email addresses, account numbers and keys masked before they are sent): outside South Africa.
• Cloudflare (Turnstile bot check on sign-up and sign-in): global.
• Acalytica web analytics (visits to our site): hosted by Aha Core.
• Google Ads (ad measurement and advertising): outside South Africa.
• Anthropic (the campaign planner and the automatic artwork check) and AI providers reached through Lovable AI Gateway (the assistant): United States.
• AI apps you choose to connect (such as Claude, ChatGPT or Copilot): these receive what you ask them to fetch, under their own terms and privacy notices.
• AI buying agents that advertisers connect with an AdCP key: these receive the advertiser's placements, bookings, artwork and delivery figures. They are run by the advertiser or its agency, under the advertiser's own arrangements with them.

Most of these providers keep information outside South Africa. We transfer it under section 72 of POPIA: the providers are bound by contract terms that protect personal information to a standard similar to POPIA, and the transfer is needed to provide the service you asked for. Ask us if you want details of the safeguards for a provider.

A publisher’s site, newsletter and advertising delivery may involve separate processing and notices. This notice does not replace those publishers’ or advertisers’ privacy obligations.

Diretsa uses sign-in, confirmed-email checks, organisation-based permissions, private artwork storage and server-side approval checks to limit access. We take reasonable technical and organisational measures to protect personal information; no online system can guarantee absolute security. Bank account numbers are not stored by Diretsa (only the last four digits). Backups are kept in private storage for 35 days.

If there are reasonable grounds to believe an unauthorised person has accessed or acquired personal information, we will assess the incident and notify the Information Regulator and affected data subjects as required by section 22 of POPIA, subject to any lawful delay.

How long we keep information:

• Money records (top-ups, invoices, receipts, payouts, bookings and the delivery reports behind them): at least 5 years, as tax law requires, and up to 7 years where company law requires.
• The audit record of important actions: for the same period, because it is part of the financial record.
• Account and organisation details: while the account is open; on a valid deletion request we remove or anonymise them, except records we must keep by law.
• Artwork waiting for a check: until a person decides; the decision itself is kept with the campaign records.
• Assistant questions and answers: 12 months.
• Saved assistant conversations: until you or your organisation delete them or the account closes.
• Error reports: as long as our error-tracking provider keeps them (usually up to 90 days).
• Backups: 35 days, then overwritten.

When you ask us to delete your information, we remove your access and replace your email address with an anonymous code in ordinary records. Money records and the audit record are kept as they are for the period above.

Subject to POPIA’s requirements and applicable lawful exceptions, you can:

• Ask whether we hold personal information about you and request access to it.
• Request correction or deletion of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained.
• Request destruction or deletion of information we are no longer authorised to retain.
• Object on reasonable grounds to applicable processing, and object to direct marketing.
• Withdraw consent where processing relies on it, and complain to the Information Regulator.
• Disconnect an AI app at any time in Media Control (Connected AI apps), which revokes its access straight away.

We may need proportionate proof of identity or authority before releasing or changing records, to protect them from unauthorised access. Confirmation of whether information is held is free; access procedures or a prescribed access fee may apply where permitted by law. If a request cannot be granted, we will explain the applicable reason.

Access requests may also fall under the Promotion of Access to Information Act (PAIA). Our PAIA manual explains how to make a formal request.

Email support@diretsa.com with the subject “Diretsa privacy request”, or use the postal address or telephone above. Tell us what information or action your request concerns. Do not send a password or unnecessary identity documents. We will explain any verification needed and route the request to the person responsible for information protection.

You may complain directly to South Africa’s Information Regulator without first contacting us. See the Information Regulator’s official website for current complaint procedures, prescribed forms and contact details.

You can also use the PAIA manual for formal access requests.

We may update this notice when our services or legal obligations change. The effective date above identifies this version. Material changes affecting partner information will be communicated through an appropriate channel. A change to this notice does not itself create consent for a new purpose.