Privacy notice

1. What this notice covers

This notice explains how Obelisk Property Investments (Pty) Ltd, trading as Obel AI & Quality ("Obel", "we") handles personal information on obel-ai.com and, in summary, in Obel-MS, the hosted product.

On this website, and for our own customer and billing records, we decide how personal information is used (we are the responsible party under POPIA and the controller under GDPR and UK GDPR). Inside a customer’s Obel-MS workspace, the customer decides, and we act for the customer as operator or processor (section 7).

2. This site uses no analytics, tracking or cookies

This site does not use analytics, advertising or tracking scripts, and it does not set cookies. It keeps one setting in your browser’s local storage: the currency you choose for prices (obel-currency). That setting stays on your device, is never sent to us, and you can clear it with your browser data.

3. The forms on this site

When you send the "Book a demo", workspace request or waitlist form, the details you enter go to chat@obel-ai.com through Web3Forms, a form-delivery service in the United States that acts as our processor. We use them only to reply to your request and, if you become a customer, to set up your workspace. If sending fails, the page offers to open the request in your own email app instead.

4. Why we use your information (legal basis)

• To reply to your request or question: our legitimate interest in answering people who contact us, or steps you ask us to take before a contract.
• To provide Obel-MS, bill for it and support it: the contract with your organisation.
• To keep tax and accounting records: our legal obligations.
• To keep the service and this website secure, for example through security logs: our legitimate interest in protecting them.

We do not use your information for automated decisions that have legal or similar effects on you, and we do not send marketing email without your consent.

5. Who processes information for us

We use these sub-processors. Each one processes personal information only for the purpose shown, under its own data protection terms:

• Google Cloud: Hosting of Obel-MS: application, database, document storage and backups (The region the customer chooses).
• Paddle: Payments, invoices and tax, as Merchant of Record for our orders (United Kingdom and United States).
• Amazon Web Services (Simple Email Service): Transactional email from Obel-MS, such as invitations and expiry alerts (The customer’s region where available).
• Google Workspace: Our own email and documents, including support conversations (Global).
• Web3Forms: Delivery of the forms on this website (United States).
• OpenAI: AI metadata extraction and summaries, only for workspaces whose organisation chooses it (United States by default).

The current list, with the date of the last change, is on our sub-processor page (/legal/sub-processors, last changed 29 September 2026). Where information goes to another country, we rely on the safeguards that the law requires, such as standard contractual clauses. If a customer's team sets up an integration, such as a webhook or Power Automate, Obel-MS sends the data they choose to the destination they choose; that destination is the customer's own processor, not ours.

6. How long we keep information

• Requests sent through our forms: 12 months after our last contact with you, then deleted.
• Order, billing and accounting records: 7 years, as South African company and tax law requires. Paddle keeps its own records as Merchant of Record.
• Customer workspace data: for as long as the subscription runs. After it ends, the customer has 30 days to export it, and then we delete it from the live system.
• Backups: deleted data leaves our backups within 90 days. Database backups keep 7 daily copies and 7 days of point-in-time recovery. Document storage keeps old versions and deleted files for up to 90 days.
• Logs: application logs 90 days; security audit logs 400 days.

7. What we do with an email you send us

We use what you send us, such as a demo request, a question or a support message, to reply to you and, if you become a customer, to set up and support your workspace. We do not sell or share it for marketing.

8. Data inside Obel-MS

The documents, records and personal information that a customer’s team puts into Obel-MS belong to the customer. We process them only to provide the service, under the customer’s instructions and our Terms of Service. A data processing agreement is available on request.

The data stays in the Google Cloud region the customer chooses. External AI processing is off unless the customer chooses it for the workspace. If you are a user in a customer’s workspace, contact that organisation first about your information; we help them answer your request.

9. Your rights

Under POPIA (South Africa), GDPR (European Union) and UK GDPR, you can ask what personal information we hold about you, ask us to correct or delete it, object to how we use it, and, where the law gives the right, ask for a copy in a portable format. You can also complain to a regulator:

• South Africa: the Information Regulator, inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
• European Union: the data protection authority in your country.
• United Kingdom: the Information Commissioner’s Office.

10. Children

This website and Obel-MS are for businesses. They are not directed at children, and we do not knowingly collect information about children.

11. Changes to this notice

When we change this notice, we update the date at the top. If a change affects customers’ data in Obel-MS, we tell customers by email before it applies.

12. Contact and Information Officer

Our Information Officer under POPIA is Neil Slabbert, at 23 Allen Drive, Bellville, Cape Town, 7530, South Africa. Write to chat@obel-ai.com with any request or question about this notice. We reply within 30 days.