Privacy Policy

Webparam (“Webparam”, “we”, “us” or “our”) is an AI intelligence platform where developers and businesses discover, understand and compare AI models, read our documentation and blog, talk to Echo (our AI assistant), and book consultations with our team. We respect your privacy and are committed to protecting the personal information of everyone who uses this website and platform (the “Platform”).

This Privacy Policy explains what personal information we collect, how and why we collect it, how we use, store, share and protect it, and the rights you have in relation to it. It is prepared in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Electronic Communications and Transactions Act, 25 of 2002 (“ECTA”), and other applicable South African legislation. If you access the Platform from outside South Africa, additional local privacy laws may also apply to you.

By using the Platform, submitting information through it, or interacting with Echo, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Platform.

For the purposes of POPIA, the responsible party that determines the purpose and means of processing your personal information is:

• Name: Webparam (operated by Param Solutions)
• Physical address: Cnr Tyrwhitt & 24 Cradock Ave, Rosebank, Johannesburg, 2196, South Africa
• Email: john.kitenge@webparam.org
• Telephone: +27 67 224 8032

We collect only what is adequate, relevant and not excessive for the purposes described in this policy. What we collect depends on how you use the Platform:

3.1 Echo — our AI assistant (text and voice)

• Conversation content: the messages you type to Echo are sent to our servers and processed by AI models that we host on our own cloud infrastructure in the AWS Africa (Cape Town) region, in South Africa (see section 5). Conversation turns are processed to answer your question and to keep the conversation coherent.
• Voice interactions: if you use Echo’s voice mode, your microphone audio is captured only after you grant your browser permission, and is transcribed by our self-hosted speech models on the same South African infrastructure. Echo’s replies may be converted to audio there as well.
• Please do not share sensitive information with Echo — do not enter special personal information (such as health, financial account, biometric or identity-document details), other people’s personal information, or confidential business information into the assistant.

3.2 Consultation bookings

• Contact and business details: your full name, company, role, work email address, country, and optionally your phone number and company website.
• Booking details: your selected meeting slot, timezone, and the topic or notes you provide for the consultation.
• Campaign context: the page you booked from and, where present, marketing campaign parameters (UTM tags) in the link that brought you to the Platform.

3.3 Newsletter

• Your email address, when you subscribe to our newsletter on the blog.

3.4 Accounts

• If you create an account, the details you provide during sign-up (such as your email address, organisation name and password) and your onboarding preferences. Passwords are never stored in plain text.
• Parts of the account and dashboard experience currently operate in preview mode: some features simulate functionality locally in your browser, in which case information you enter there is not transmitted to our servers at all.

3.5 Information collected automatically

• Technical data: your IP address, browser type and version, device type, the pages you view and the date and time of your visit — collected through standard server logs by our hosting infrastructure for security, diagnostics and performance.
• Rate-limiting data: short-lived technical counters (keyed to your network address) used to protect Echo and our APIs from abuse.
• First-party usage events: during the consultation flow we record anonymous product events (for example, which step of the booking you reached), correlated only by a random session identifier — the event properties contain no personal information.

3.6 Information stored only on your device

Preferences such as your theme (light/dark), documentation language, dashboard layout density and similar settings are stored in your browser’s local storage and are not transmitted to us. You can clear them at any time through your browser settings.

Under POPIA, we process personal information on the following lawful grounds:

• Consent — for example, when you subscribe to the newsletter, grant microphone access for voice mode, or submit a consultation request. You may withdraw consent at any time without affecting prior lawful processing.
• Performance of a contract — to provide the Platform’s features you use, schedule and manage consultations, and operate your account.
• Legitimate interests — to secure the Platform against abuse, understand how the booking flow performs, and improve our services, where those interests are not overridden by your rights.
• Legal obligation — where processing is required by law.

We will not use your personal information for purposes incompatible with the above without your consent, unless otherwise permitted by POPIA.

Echo generates its answers using large language models that we host ourselves on Amazon Web Services (AWS) infrastructure in the Africa (Cape Town) region — that is, in South Africa. When you send Echo a message (or speak to it), the conversation content is processed on that self-hosted infrastructure; it is not sold or disclosed to external AI model companies. AWS acts as our cloud infrastructure provider — an operator under POPIA — processing data on our behalf and on our instructions, under its data-processing terms. We process only what the feature needs: the conversation turns and the immediate page context, not your identity.

AI-generated responses are produced automatically and may be inaccurate or incomplete. Echo’s answers are not professional advice, and no decision with legal or similar significant effect about you is made solely by automated means on this Platform.

We do not sell, rent or trade your personal information. We share it only in these limited circumstances:

• Operators and service providers — our hosting and content-delivery infrastructure, Amazon Web Services (on whose South African Cape Town region we self-host the AI models that power Echo, as described in section 5), our content-management and media-storage infrastructure, and email and scheduling tooling — each processing information on our instructions and required to keep it confidential and secure.
• Professional advisers — auditors, accountants and attorneys, where reasonably necessary and under duties of confidentiality.
• Legal requirements — where disclosure is required by law, a court order or a competent regulator.
• Business transfers — if our business is merged, acquired or restructured, subject to the commitments in this policy.

• Essential session cookie: the consultation flow sets one first-party, httpOnly session cookie so your booking session can be recognised across steps. It is not used for advertising.
• Local storage: device-local preferences as described in section 3.6.
• No third-party advertising or tracking cookies are set by the Platform.

You can control and delete cookies and local storage through your browser settings; blocking the session cookie may prevent the consultation booking flow from working.

Echo’s AI processing happens on our self-hosted infrastructure in the AWS Africa (Cape Town) region, so that content remains in South Africa. Some of our other service providers — such as our website hosting and content-delivery infrastructure — operate servers outside South Africa (including in the United States and the European Union). Where personal information is transferred outside South Africa, we do so in accordance with section 72 of POPIA: the recipient is subject to laws, binding corporate rules or binding agreements providing an adequate level of protection substantially similar to POPIA, or another lawful ground for the transfer applies (such as your consent or the necessity of the transfer to perform a contract with you).

In accordance with section 19 of POPIA, we take reasonable technical and organisational measures to secure personal information against loss, damage, unauthorised destruction and unlawful access — including serving the Platform over HTTPS, restricting access to personal information to those who need it, applying rate-limiting and abuse controls to our APIs, and requiring our operators to implement equivalent safeguards. No internet transmission or storage is completely secure; if we have reasonable grounds to believe personal information has been accessed by an unauthorised person, we will notify the Information Regulator and, where required, you, in accordance with section 22 of POPIA.

In line with section 14 of POPIA, we keep personal information only as long as needed for the purpose it was collected, unless longer retention is required or authorised by law, needed for a lawful business purpose, or you have consented. As a guideline: Echo conversations are processed transiently to generate responses and are not used to train models by us; consultation records are kept for as long as needed to manage the engagement and any follow-up; newsletter addresses are kept until you unsubscribe. When retention is no longer justified, records are deleted, destroyed or de-identified.

We send electronic marketing (including the newsletter) only in accordance with section 69 of POPIA and the Consumer Protection Act, 68 of 2008: only with your opt-in (or to existing customers about similar services), always identifying us as the sender, and always with a free and easy way to unsubscribe. To opt out at any time, use the unsubscribe mechanism in the communication or contact us at john.kitenge@webparam.org.

Subject to POPIA and the Promotion of Access to Information Act, you may:

• request confirmation of whether we hold personal information about you, and access to it;
• request correction of information that is inaccurate, out of date, incomplete or misleading;
• request deletion or destruction of information we are no longer entitled to retain;
• object, on reasonable grounds, to processing — and object at any time to direct marketing;
• withdraw any consent you have given;
• complain to the Information Regulator or institute civil proceedings.

To exercise any right, contact us using the details in section 2. We may verify your identity before acting on a request.

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; P.O. Box 31533, Braamfontein, 2017; complaints.IR@inforegulator.org.za; inforegulator.org.za.

The Platform is not directed at children under 18, and we do not knowingly collect their personal information without the consent of a competent person. If you believe a child has provided us personal information, contact us and we will delete it promptly.

We may update this Privacy Policy as the Platform evolves — in particular as preview features (such as accounts and the API gateway) become fully operational, which may change the data flows described here. Updates are published on this page with a revised date; material changes will be brought to your attention. Continued use of the Platform after publication constitutes acknowledgement of the updated policy.

Questions, concerns or requests about this policy or your personal information: john.kitenge@webparam.org · +27 67 224 8032 · Cnr Tyrwhitt & 24 Cradock Ave, Rosebank, Johannesburg, 2196, South Africa. Please also read our Terms & Conditions.