Privacy Notice
How Lelapa AI collects, uses, and protects your information.
Version 1.0 — Dated May 28, 2026
1. About Lelapa AI
Lelapa AI is an artificial intelligence company based in Johannesburg, South Africa. Our primary product is Vulavula, a language AI service delivering transcription and translation to clients.
Our website address is https://www.lelapa.ai.
Depending on the context, Lelapa AI acts as:
- A responsible party for personal information collected through the website, including account registration and billing.
- An operator for personal information submitted to the Vulavula service by clients. In this role, Lelapa AI processes data on the client's instruction. The client is the responsible party.
2. Information We Collect
2.1 Website and Account Information
- Name and email address from account registration.
- Billing information processed through Stripe.
- IP address and browser user agent collected automatically on each visit.
- Comments and profile information submitted voluntarily.
- Website usage data collected through Google Analytics.
- Cookies as described in Section 6.
2.2 Vulavula Service Data
When clients use Vulavula, the following data is submitted to and processed by Lelapa AI:
- Audio recordings submitted for transcription and translation
- Processing metadata including job identifiers, timestamps, and API credentials.
Clients are responsible for ensuring they have a lawful basis for submitting data to Lelapa AI and for notifying relevant individuals in line with their own obligations.
Lelapa AI does not use client data for model training.
3. How We Use Personal Information
3.1 Website and Account Data
- Account management: to create and manage your account.
- Billing: to process subscription payments through Stripe.
- Customer support: to respond to enquiries and feedback.
- Service communications: to send account or service updates.
- Analytics: to understand and improve website usage.
- Spam detection: to filter spam comments.
3.2 Vulavula Service Data
- Delivering the transcription and translation of audio data as contracted.
- Generating processing logs required for service operation, issue investigation, and compliance.
We do not use client data for any purpose beyond those listed above without the client's express agreement.
4. Consent and Choice
Where processing is based on consent, you may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
For website account holders, you can manage or delete your account information at any time through your profile settings.
For clients submitting data through the Vulavula service, the terms of processing are governed by the data processing agreement in place between Lelapa AI and the client.
5. How Long We Retain Your Data
| Data Category | Retention Period |
|---|---|
| Website comments and metadata | Retained indefinitely unless a deletion request is received. |
| Account and registration information | Retained for the duration of the account and as required for legal and billing purposes thereafter. |
| Billing and payment records | Retained in accordance with applicable financial recordkeeping requirements. |
| Vulavula audio files and transcripts | Retained for the period defined in the data processing agreement. |
| Processing and system logs | Retained for the period defined in the data retention policy. |
When data is no longer required it is securely deleted or anonymised.
6. Cookies and Tracking
- Comment cookie: Saves your name and email to avoid re-entering details on your next comment.
- Login cookie: Maintains your login session and lasts for two days unless “Remember Me” is selected.
- Screen options: Remembers display preferences and lasts for one year.
- Google Analytics: Collects anonymised website usage data to help improve the website.
- Gravatar: An anonymised hash of your email is sent to Gravatar (if in use) to retrieve your profile picture.
You can manage cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.
7. Who We Share Your Data With
We only share your data in the following circumstances:
| Recipient | Purpose |
|---|---|
| Stripe | Billing email and payment information shared for payment processing only. Stripe is PCI DSS Level 1 certified. |
| Google Analytics | Anonymised website usage data may be stored on Google's servers in the United States. |
| Gravatar | Anonymised email hash to retrieve profile pictures for comment authors. |
| Sub-processors | Cloud infrastructure and model serving providers used to deliver the Vulavula service. All sub-processors are bound by data processing agreements. |
| Regulators and authorities | Where required by law or court order, including the South African Information Regulator. |
8. Security
We implement technical and organisational measures to protect personal information. These include:
- Encryption of data at rest and in transit.
- Access controls limiting access to authorised personnel only.
- Multi-factor authentication on all production systems.
- Regular vulnerability assessments and annual penetration testing.
- Security monitoring and incident response procedures.
In the event of a security incident affecting personal information, Lelapa AI will notify affected parties and the Information Regulator in accordance with POPIA Section 22.
9. What Rights You Have Over Your Data
You have the right to:
- Access: request confirmation of whether we hold personal information about you and receive a copy.
- Correction: request that inaccurate or incomplete information be corrected.
- Deletion: request deletion of your personal information where it is no longer required, subject to legal obligations.
- Objection: object to processing in certain circumstances.
- Withdraw: where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us using the details in Section 13. We will respond within a reasonable timeframe. If a request is denied, we will provide the reason and advise on available recourse.
For data submitted through the Vulavula service: requests relating to that data should be directed to the client as the responsible party. Lelapa AI will support the client in responding as required by the data processing agreement.
10. Data Quality
We take steps to ensure that personal information we hold is accurate, complete, and relevant for its intended purpose.
You are responsible for ensuring that the information you provide to Lelapa AI is accurate and up to date. If your information changes, please update it through your account settings or contact us directly.
11. Terms of Service
By using the Lelapa AI website and services, you agree to our Privacy Policy and the Terms of Service available on our site.
12. Monitoring, Complaints, and Enforcement
Lelapa AI monitors compliance with its privacy obligations on an ongoing basis. This includes periodic reviews of processing activities, access controls, and data retention practices.
If you have a concern, complaint, or enquiry about how we have handled your personal information, please contact us using the details in the next section. We will acknowledge your complaint and aim to resolve it within a reasonable timeframe. The outcome will be communicated to you in writing.
If you are not satisfied with our response, you may escalate your complaint to the Information Regulator of South Africa.
13. Contact Us
Information Officer: Jade Abbott
Email: popia@lelapa.ai
14. Changes to This Notice
We review and update this notice periodically. When material changes are made, we will update the effective date and notify users where appropriate. Prior versions are retained and available on request.