Mema privacy add-on
Mema is run by Auxo Digital (Pty) Ltd, South Africa.
This adds to the Auxo Digital Privacy Notice (https://www.auxodigital.africa/privacy), which covers who we are, your rights and how to complain. Read that notice first. This page covers only what is specific to Mema, and follows the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible: Auxo and the host
Mema is an events platform run by Auxo Digital (Pty) Ltd ("Auxo Digital", "we", "us"), registration number 2024/374541/07, registered address: 6 Hoggs Bay Close, Kyalami, Johannesburg, 1684, South Africa.
For guest information, two parties act. Auxo Digital is the responsible party for the platform: we decide how Mema stores, protects and sends information, and we run the sign-in, messaging and security. The host of an event decides who attends and what to ask: they choose the registration questions, approve or decline guests, and use the answers for their event. The host is a responsible party for that use. Hosts agree to the Organiser terms, which require them to use guest information lawfully.
Information Officer: Njabulo (Jabu) Mthombeni, Auxo Digital (Pty) Ltd. Email: jabu@auxo.digital. Phone: +27 78 239 6261. General enquiries: info@auxo.digital.
2. What Mema collects
Guests
- Your name and email address.
- Your mobile number, if the host asks for it or you choose to give it.
- Your answers to the host's registration questions.
- Your consent choices: the exact wording you saw, its version, the time and where you gave it.
- Your registration status, check-in time, feedback and any photos you upload to the event.
- How you found the event, such as a referral link or campaign tag.
- Your message preferences and opt-outs, for email and WhatsApp.
Your name and email are required to register. Your mobile number is required only when the host asks for it, and so are the host's questions marked as required. Everything else, including both consent boxes, is up to you. If a host adds or imports you as a guest, we get your details from that host.
Ticket buyers (if paid ticketing is enabled)
- The tickets you bought, the amount, the payment reference and any refund.
- Paid ticketing is not switched on yet. When it is, card and bank details go straight to Paystack. We never see or store your full card number.
Hosts
- Your Auxo ID profile (name, email and picture), because hosts sign in to Mema with Auxo ID.
- Co-host invites: the email address of the person invited and who invited them.
- The organisations, calendars and events you manage, and your team roles.
- For paid events: your organisation's legal name, contact details and the bank account for payouts.
- Text you type into "Describe it in one line" and any flyer you attach, if you use AI drafting.
Technical information
- Your IP address, used briefly for rate limits and bot protection.
- Basic server logs kept by our hosting providers.
3. Why we use it, and on what basis
| Purpose | Legal basis (POPIA s11) |
|---|---|
| Register you, send your confirmation, calendar invite, ticket and QR code, and check you in. | Needed to carry out what you asked for. |
| Send reminders, event updates, changes to the time or place, cancellations and feedback requests by email. | Needed to run the event. You can switch off reminders, recaps and feedback requests at any time. Changes to the time or place and cancellations always go. |
| Send WhatsApp messages about an event you registered for: your confirmation, reminders, changes to the time or place, the host's approval decision, a cancellation and the join link. These always come in addition to email, never instead of it. | Your consent. The box is unticked by default. |
| Tell you about the host's future events. | Your consent (direct marketing, POPIA s69). A separate box, also unticked by default. |
| Share your registration with the host, and with the host's Fikelela workspace if they connected one. | Needed to run the event, and the host's own lawful basis. |
| Take payment, issue refunds and pay hosts. | Needed to carry out the sale, and our legal duties. |
| Keep tax and accounting records. | Legal obligation. |
| Search for a venue while a host creates an event (Google Places). | The host's request. Only what the host types into the venue search is sent. |
| Stop spam, abuse and fraud, and keep Mema secure. | Our legitimate interest in a safe service. |
| Draft an event from a host's one-line description (optional). | The host's request. |
Every consent is stored with the wording you saw and a version number. When we change the wording, we change the version. Old records keep the wording you agreed to.
We do not sell personal information. We do not use it for advertising.
4. Who we share it with: operators
The host of the event you register for sees your details and answers. We do not sell personal information and we share it only with the host and with operators. These operators run Mema for us. Each one processes information only on our instructions and under a written agreement (their data processing terms). The Auxo Digital Privacy Notice lists the operators we use across the company.
| Operator | What they do | Where |
|---|---|---|
| Google Cloud (Firestore) | Main database for events, guests and preferences. | Johannesburg, South Africa (africa-south1) |
| Vercel | Hosts the website and runs the app. | United States company, with a global edge network (the Mema app runs in the Cape Town region) |
| Google (Places and Maps) | Venue search for hosts: only what the host types into the venue search is sent. On event pages with an in-person venue, a Google map loads only when you press "Show map". Google then receives your IP address and may set its own cookies, under Google's privacy policy. | Global |
| Cloudflare | Image and photo storage (R2), bot protection (Turnstile) and scheduled tasks. | Photo and image storage in the EU (Western Europe); Turnstile and scheduled tasks on a global network |
| Resend | Sends our emails. | United States |
| Meta (WhatsApp) | Delivers WhatsApp messages if you opted in. Mema sends them through Auxo Digital's shared WhatsApp service, which runs on the Google Cloud and Vercel services above. | United States and global |
| Paystack | Processes card and EFT payments and refunds. | South Africa and Nigeria. Only if paid ticketing is enabled. |
| OpenRouter, routing to Anthropic or Google (Gemini) models; or Anthropic directly | AI event drafting for hosts. Only the host's one-line description and any flyer they attach are sent. Guest information is never sent. We ask OpenRouter to route only to providers that do not keep or train on the data. | United States |
Hosts sign in through Auxo ID, which is run by Auxo Digital. We may share information if the law requires it, or to protect someone's safety.
5. Information sent outside South Africa
Our main database stays in Johannesburg. Our hosting, photo storage (EU), email, WhatsApp and AI operators process information in other countries. These operators are bound by written agreements. Under POPIA section 72 we only send information abroad where the recipient is bound by law, binding rules or an agreement that gives protection similar to POPIA, or where the transfer is needed to provide the service you asked for.
6. How long we keep it
Where a period below says "we aim to", deletion is a manual review today; automatic deletion is being built.
- Guest registrations and answers: we aim to delete them or make them anonymous 24 months after the event ends.
- Event photos: until the host or you delete them, or the event is deleted.
- Payment, refund and payout records: 5 years, as tax law requires.
- Consent records: while we rely on the consent, and 3 years after you withdraw it, so we can show what you agreed to.
- Opt-outs (email and WhatsApp): for as long as needed to keep honouring them.
- Email send records: 7 days after sending.
- WhatsApp messages: the WhatsApp sender keeps each message's number, template, delivery status and cost estimate for 90 days, then deletes it. The message text (your name and links) is removed as soon as the message is sent or stops. Mema keeps a delivery log per event (template, status and the last 4 digits of the number) with the event's registrations.
- WhatsApp opt-outs (STOP): kept for as long as needed to keep honouring them.
- Host accounts: while active; we aim to delete inactive accounts 12 months after the last sign-in.
- Rate-limit and bot-protection records: a few hours.
- AI drafting: we do not store the text or the flyer. We keep one usage line with no content.
7. Your rights
Under POPIA you may:
- Access the personal information we hold about you.
- Correct information that is wrong or out of date.
- Delete information we no longer need or are not allowed to keep.
- Object to processing based on our legitimate interest, and to direct marketing at any time.
- Withdraw consent for WhatsApp or marketing at any time. This does not affect what we did before.
- Stop WhatsApp by replying STOP to any Mema WhatsApp message. We record it and stop at once. STOP also stops WhatsApp marketing from other Auxo Digital products. Reply START to opt back in. See the Messaging terms. We only message you on WhatsApp if you ticked the box (unticked by default) when you registered.
To change your message preferences, use the link at the bottom of any email, or reply STOP on WhatsApp. To cancel a registration, use your confirmation email. To delete your data or your registration, email our Information Officer at jabu@auxo.digital from the address you registered with, and tell us which event. Hosts can also delete a photo from their event. For anything else, email info@auxo.digital. We reply within 30 days. We may ask you to prove who you are first.
Other rights, and how to complain, are in the Auxo Digital Privacy Notice. If your request is about how a host uses your details, we will pass it to the host and help them respond.
8. Complaints
Please talk to our Information Officer first. If you are not happy with our answer, you can complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Complaints: complaints.IR@justice.gov.za
9. Cookies
Mema only uses cookies it needs to work. It sets no analytics or advertising cookies. Event pages can show a Google map, but only after you press "Show map"; Google then receives your IP address and may set its own cookies. The Auxo Digital website has its own cookie choices, described in the company notice.
- mema_session: keeps hosts signed in.
- mema_guest: remembers a signed-in guest for One-click RSVP.
- mema_auxo_flow and mema_fk_connect: short-lived, protect sign-in and connecting Fikelela.
- Cloudflare Turnstile may use its own short-lived technical data to tell people from bots.
If we ever add analytics, we will update this policy and ask first where the law requires it.
10. Security
Technical measures: data is encrypted in transit and at rest, and the database is closed to the public so only our server can read it. Organisational measures: access is limited to the people who need it, and operators are bound by written agreements. The company notice describes our security measures in full. If a breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.
11. Changes
We will update this page when our practices change and change the date below. If a change matters to you, we will tell you by email. This add-on is a draft pending legal review.
Draft for legal review. Last updated 15 October 2026.