Privacy policy

Who is responsible

ChabadHub is operated by Jewish Life Centre; the registered legal entity will be named here when it is formed. We are the controller (responsible party) for service accounts and service operations. The organisation using a community book remains responsible for why its community information is collected and used; we process that book on its instructions.

For privacy requests and security concerns, contact security@chabadhub.app.

What is used and why

We use account and house membership information to provide access, and relationship records, contact details, interactions, follow-ups and giving records to help the house maintain its relationships. Consent records and change receipts help protect access and explain changes.

South Africa’s Protection of Personal Information Act (POPIA) treats religious belief as special personal information. A community relationship can reveal religious belief even without a separate religion field. The house must have an applicable lawful basis and special-information authorisation, and collect only what it needs. Children’s information has additional protection. Do not place sensitive information in ordinary notes.

When you connect an agent

The host you choose receives tool results in your conversation. The connector can read permitted adult relationship records and Today items; granted writes can log interactions and ordinary notes, update or add people, and mark Today items. The registry and your permissions determine what is available. Agent giving writes are not available in this release.

The connector does not expose minors’ records, private or sensitive note bodies, other houses’ records, credentials, or unrestricted database queries. A constrained person-creation operation may accept a minor into an existing home without contact details; that does not permit reading the child’s record. Agents cannot send messages, move money or delete people through these capabilities. Normal row and column access restrictions still apply.

Choose read-only access by clearing the consent screen’s write checkbox. You can revoke in Settings → My account → Agents. Disconnecting a host does not itself prove the ChabadHub grant has been revoked.

Retention and correction

Relationship records are kept to support the house’s active book. Retention must be limited to its purpose, applicable legal requirements and justified recordkeeping needs. Detailed retention and backup-erasure periods are still being finalised; ask us for the period applicable to your request.

Agent mutation receipts are stored with changes. The seven-day undo window is not a seven-day deletion period. Receipts, security records and backups may need separate retention; revoking an agent does not delete its history or copies already held by an AI host. Ask for access, correction, restriction or deletion through your house or our privacy contact. We assess requests and any lawful retention obligations before responding.

Subprocessors and the hosts you choose

Infrastructure subprocessors include Supabase for database and authentication, and Vercel for application hosting. AI hosts you connect, such as Claude, ChatGPT, Grok or Meta Muse, process conversation content under their own terms and settings. Review those terms before connecting; we do not promise that a host keeps no copy or uses the same retention rules.

These providers may process information outside South Africa. The house and service operator must ensure applicable POPIA cross-border safeguards and provider agreements. No South Africa-only storage promise is made here.

Your rights and questions

Contact your house or security@chabadhub.app to ask what information is held, correct it, object to applicable processing, or request deletion subject to legal requirements. You may also raise a complaint with South Africa’s Information Regulator.

Read the POPIA statute for the legal framework.