RumidzaPrivacy policy
Last updated: 3 October 2026
Rumidza is a service that helps businesses reply to customers, manage leads and create marketing content. It is operated by Next Foundry Enterprise (Pvt) Ltd, [Registered address] (“Rumidza”, “we”, “us”). This policy explains what information we handle, why, and the choices you have.
1. Whose information this covers
- Our customers: the businesses and their staff who create a Rumidza account (“you”).
- Your contacts: people who message, comment on or are emailed by a business through Rumidza. For their information, the business is the responsible party (data controller) and Rumidza processes it on the business’s behalf and instructions.
2. What we collect
Account information
Name, email address, password (stored encrypted), business name, business details you add (products, prices, opening hours, delivery areas), plan and billing records.
From the accounts you connect
- WhatsApp, Facebook Messenger and Instagram (through Meta’s official business APIs): messages sent to and from your business, public comments on your posts, the sender’s name, profile ID or phone number, your Page and account details, follower counts and post statistics.
- Gmail or Outlook (only if you connect them for Prospect): permission to send email from your address. Rumidza does not read your mailbox. Replies to those emails go to a Rumidza reply address so they can appear in your Rumidza inbox.
- Calendar booking tools (Cal.com, Calendly): details of calls booked through your booking link.
Information created in Rumidza
Lead records (stage, notes, follow-ups), AI-written replies, prospect lists built from public business directories, and images and videos you create in Studio.
Business websites
When someone visits a website hosted by Rumidza, we count the visit and taps on "Order on WhatsApp" or "Call", without storing who the visitor is. If a visitor reports a website, we keep the report and any contact details they choose to give.
Technical information
Log data such as IP address, browser type and error reports, used to keep the service secure and working.
3. How we use it
- To provide the service: reply to messages, sort leads, send emails you approved, publish posts you scheduled and create media you requested.
- To keep accounts secure, prevent abuse and fix problems.
- To contact you about your account, billing and important changes.
- To meet legal obligations.
We do not use your contacts’ messages to train AI models, and we do not sell or rent personal information.
4. Google user data
Rumidza’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail access is used only to send the emails you approve; Rumidza does not read your mailbox. It is not used for advertising, not sold, not read by people except with your permission or where required for security or by law, and not used to train AI models.
5. Service providers we use
We share information only with providers that help us run Rumidza, under contracts that limit their use of it:
| Provider | Purpose |
|---|---|
| Supabase | Database, file storage and sign-in |
| Vercel | Website hosting |
| Anthropic | AI that writes replies, scripts and summaries |
| fal.ai | AI image and video creation in Studio |
| Meta Platforms | WhatsApp, Messenger and Instagram messaging and publishing |
| Google / Microsoft | Email sending and business directory search, when you use them |
| Paynow and Paystack | Processing payments (we never see or store card numbers or mobile-money PINs) |
| Inbound email service | Receiving replies to outreach emails on the Rumidza reply address |
Some providers are outside your country. Where information leaves Zimbabwe or South Africa, we rely on providers with adequate protection and contractual safeguards, as required by law.
6. How long we keep it
We keep account information while your account is open. When you close your account, we delete your business data and your contacts’ data within 30 days, except records we must keep by law (such as invoices). Backups are overwritten within a further 30 days.
7. Email outreach and unsubscribing
Every email sent through Prospect includes an unsubscribe link. People who unsubscribe are added to a suppression list and are never emailed again by that business through Rumidza. We require businesses to follow the Protection of Personal Information Act (POPIA) in South Africa, the Cyber and Data Protection Act in Zimbabwe and similar laws elsewhere.
8. Your rights
You can ask to see, correct, export or delete your personal information, object to its use, or withdraw consent. If you are a contact of a business that uses Rumidza, please contact that business first; we will help them respond. You can also write to us at our contact form. You may complain to the Information Regulator (South Africa) or POTRAZ (Zimbabwe).
To remove data received from Facebook or Instagram, see how to delete your data.
9. Security
Data is encrypted in transit and at rest. Each business’s data is kept separate by database access rules, the keys that connect your accounts are kept in a separate locked table that no user can read, and staff access is limited to what is needed to support you.
10. Children
Rumidza is a business tool and is not intended for anyone under 18.
11. Changes
If we change this policy in an important way, we will tell account holders by email or in the app before the change takes effect.
12. Contact
Next Foundry Enterprise (Pvt) Ltd
[Registered address]
our contact form