Privacy Policy

Last updated: 9 November 2026

This policy explains how Zarto AI collects, uses, shares and protects personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”). Our POPIA Notice sets out your rights and how to use them.

1. Who is responsible for your information

Zarto AI, a division of Zarto (Pty) Ltd (registration number 2026/882078/07), of 77 Sea Hare Circle, Cape Town, 7441, South Africa, is the responsible party for personal information collected through this website. Our Information Officer is Etiene van Wyk, who can be reached at info@zartoai.com.

2. What we collect

When you submit our contact form, or email us, we collect:

• your name and email address;
• your phone number, if you choose to provide it;
• the type of project you need help with;
• what you tell us in your message; and
• your agreement to this policy.

When you visit the website, we and our service providers also process:

• technical information, such as your IP address, browser and device details and request logs, to deliver and protect the website;
• the cookie choice stored in your browser; and
• if you consent, visitor statistics (see section 4).

We do not need sensitive information to respond to an enquiry. Please do not include special personal information, such as health details, religious beliefs, race, or criminal history, or information about other people, in your message.

3. How we use your information and why we may do so

• To respond to your enquiry and discuss your project: with your consent, and to take steps towards a contract at your request.
• To prepare a proposal and keep a record of our correspondence: to take steps towards a contract, and in our legitimate interest in running our business.
• To protect the website and our forms from spam, fraud and automated abuse: in our legitimate interest, and yours, in a secure website.
• To understand how visitors use the website: only with your consent.
• To comply with our legal obligations.

These grounds are set out in section 11 of POPIA. We do not sell your personal information. Giving us your information is voluntary, but we cannot respond to an enquiry without your name, a way to contact you and a description of what you need.

4. Cookies and visitor statistics

Cookies are small files stored on your device. Similar technologies, such as browser storage, are treated in the same way in this policy. We group them as follows:

• Strictly necessary: required for security and for the website to work, and cannot be switched off. These include security technologies from Cloudflare that protect the website against bots and abuse, and browser storage that remembers your cookie choice.
• Analytics (optional): if you consent, we use Cloudflare Web Analytics to see how visitors use the website, such as pages viewed, referring websites, device type, country and page speed. It does not use cookies or follow you across other websites.
• Marketing (optional): help us measure and tailor our advertising. We do not currently use any. If we introduce them, we will update this policy and they will operate only with your consent.

Optional technologies are off by default. You can accept, reject or choose categories when you first visit, and can change or withdraw your consent at any time using the Cookie settings link at the bottom of every page. Withdrawing consent does not affect anything done before you withdrew it. We keep your choice for 12 months and then ask you again. You can also remove cookies through your browser settings.

5. Website security and bot protection

When you use our contact form, Cloudflare Turnstile checks that it is being sent by a person and not an automated program. Most people never see this check. To do this, Cloudflare processes your IP address and technical information about your browser and device. We also use your IP address to limit repeated submissions. We do this in our legitimate interest, and yours, in keeping the website free of spam and fraud. If the check cannot run, for example because a browser extension blocks it, you can email us at info@zartoai.com instead.

6. Who we share it with

We share information only as needed with service providers who act on our behalf:

• Cloudflare, Inc.: website hosting and security, processing form submissions, bot checks and, if you consent, visitor statistics;
• Resend: delivering form submissions to us by email; and
• xneelo: hosting our email, where your enquiry is received.

We may also disclose information where the law requires it, or where needed to protect our legal rights. If you become a client, the agreement for your project will explain any further sharing that the work requires.

Cloudflare’s privacy policy and Resend’s privacy policy explain how those providers handle information.

7. Transfers outside South Africa

Cloudflare operates a global network, and Cloudflare and Resend may process information outside South Africa, including in the United States and the European Union. We make these transfers as permitted by section 72 of POPIA, subject to each provider’s data processing terms, and with your consent when you submit our form.

8. Direct marketing

We do not use enquiries to send marketing. We will send direct marketing only as section 69 of POPIA permits: with your consent, or to existing clients about our similar services. Every marketing message will include a simple way to opt out, and you can object at any time by writing to info@zartoai.com.

9. Artificial intelligence and automated decisions

This website does not use artificial intelligence to process your enquiry, and we do not make decisions about you based solely on automated processing. If an AI-enabled service forms part of a project with you, the agreement for that project will address it.

10. How long we keep it

We keep enquiry information only for as long as needed to respond to you and for the related purposes above, or as required or permitted by law, and then delete or de-identify it. If you become a client, the information forms part of your project records, which we keep for as long as our agreement and the law require. Your cookie choice is kept for 12 months.

11. Security

We apply reasonable technical and organisational measures to protect personal information, including encrypted (HTTPS) connections, restricted access to our systems and mailboxes, bot protection and limits on repeated form submissions. No online system is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as section 22 of POPIA requires.

12. Children

Our services are intended for businesses and adults. We do not knowingly collect information from anyone under 18. If you believe a child has sent us information, please contact us so that we can delete it.

13. Visitors in Namibia

We serve clients in South Africa and Namibia, and we are based in South Africa. We apply the standards in this policy, and the rights in our POPIA Notice, to all visitors and enquirers, including those in Namibia. Your information is received and handled by us in South Africa and by the service providers named above. Nothing in this policy limits any right you have under the Constitution of the Republic of Namibia or other Namibian law. We will update this policy if Namibian data protection legislation requires it.

14. Your rights

You may ask whether we hold your personal information, request access to it, ask us to correct or delete it, object to its processing on reasonable grounds, object to direct marketing, and withdraw your consent. Our POPIA Notice explains how, and how to complain to the Information Regulator.

15. Changes to this policy

We may update this policy from time to time. The current version is always published on this page with its date.

16. Contact

Questions about this policy can be sent to our Information Officer, Etiene van Wyk, at info@zartoai.com.