Privacy policy

Last updated 8 November 2026

Peak Social answers WhatsApp messages, Instagram DMs, emails and missed calls for service businesses (our clients) with an instant reply and their booking link. This page explains what information we handle, why, and what you can ask us to do with it. It applies to our clients and to the people who message them (their leads).

What we collect

• From clients: business name, contact name, email, mobile number, Instagram handle, booking link and business hours, given when you sign up or set up your account.
• From people who message a client: the message you send, when you sent it, and the identifier the channel gives us: your WhatsApp number and profile name, your Instagram-scoped ID (not your username or password), your email address and name, or the phone number that called. We also record whether you replied, booked or asked us to stop.
• Payments: PayFast or Paystack processes payments. We never see or store card numbers; we keep the amount, the date and the provider's payment reference.

Why we use it

• To send the reply you were waiting for, with the business's booking link, and at most two short follow-ups if you haven't booked.
• To show the business owner their leads and conversations in their dashboard, and to tell them when someone wants to book or asks about price.
• To bill clients and run their account.

We don't sell personal information, use it for advertising, or use it to train AI models.

Instagram and WhatsApp data

We receive messages from Meta's Instagram and WhatsApp APIs only for business accounts that have connected Peak Social. We use them only to reply on the business's behalf and to show the conversation to that business. We don't access followers, posts you didn't send to the business, or anything outside those conversations.

The Peak Social app (peak.io)

Clients can sign in to our iPhone and Android app with the email and password we give them. The app shows the same leads, conversations, content and payments as the dashboard, for that client's business only. It stores a sign-in token in the phone's secure storage (Keychain on iPhone, Keystore on Android), never your password. If you allow notifications, we keep your device's push token so we can tell you about hot leads; push messages pass through Expo, Apple and Google. The app has no ads, no tracking and no third-party analytics, and you can't buy anything in it. To delete your login, tap Account → Delete my login; that removes the login, its sessions and its push tokens straight away.

Stopping messages

Reply STOP on any channel and we won't send you anything else for that business. Reply START to undo it.

Who we share it with

Only the services that run Peak Social, and only to do so: Meta (Instagram and WhatsApp), Google (Gmail), n8n (message routing), BulkSMS and Twilio (SMS and missed-call detection), Calendly (bookings), PayFast and Paystack (payments), Railway (hosting), Anthropic (AI-written replies, for clients who switch them on) and Expo (app notifications). We share information with authorities only when the law requires it.

How long we keep it

We keep conversation and account data while the client's account is active, so the business can see its history. When you ask us to delete your data, or a client closes their account and asks us to, we delete it (see below).

Your rights

Under South Africa's Protection of Personal Information Act (POPIA) you can ask what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. You can also complain to the Information Regulator (South Africa).

Privacy policy · Delete your data · Home