ServiceRoute is job management software for small trades businesses in South
Africa — plumbers, electricians and solar installers. This page explains what
information the software holds, why, who else can see it, and how long it is
kept.
Two different people are described here. A business that uses
ServiceRoute to run its work, and a customer of that business who never
signs in and may never have heard of us. Both are covered, and the difference
matters throughout.
Who is responsible for what
When a plumbing or electrical business uses ServiceRoute, that business
decides what to record about its customers and why. In the language of the
Protection of Personal Information Act (POPIA), the business is the
responsible party and ServiceRoute is an operator — we process that
information on their instruction and for no purpose of our own.
If you are a customer of a business that uses ServiceRoute and you want your
information corrected or removed, ask that business. They control it. We will
help them act on your request.
What is collected
About a business using ServiceRoute
Account
Name, email address, and a password held only as a
one-way hash. Optionally a profile photograph.
Business details
Trading name, address, registration and VAT
numbers, and banking details — because these are printed on the invoices and
quotes the business issues.
Usage
Which jobs, quotes and invoices were created or changed,
and by whom.
About that business's customers
Contact
Name, phone number, email address where given.
Where the work is
The address typed in, and map coordinates
derived from it or from a location pin somebody sent.
The work itself
What was wrong, what was quoted, what was
charged, what was paid, and a signature if one was given at the door.
Messages and voicemails
Where a business has connected
WhatsApp or a ServiceRoute phone number, the enquiry messages and
voicemails its customers leave for it. See below.
ServiceRoute does not collect identity numbers, dates of birth,
or payment card details. Card details for a business's own subscription are
handled by the payment provider and never reach us.
WhatsApp and voicemail enquiries, and the AI that reads them
A business can connect its own WhatsApp number, or a phone number that
takes voicemail, so that customer enquiries arrive inside ServiceRoute instead
of being retyped. Where that is switched on:
The message text, the sender's WhatsApp number and profile name are stored
against that business's account.
Calls. A call to the business's ServiceRoute number is answered
by a recorded voice that asks three fixed questions — what the problem
is, the address, and the caller's name — and records each answer.
Unless the live assistant below is switched on, nothing on the call
listens, understands or replies: only those questions in that order. The
recordings and the caller's number are held by Twilio
(twilio.com), the phone provider, in the United States. The recording
is then sent to OpenAI (openai.com), also in the United States,
which turns the speech into text and does nothing else with it. The
answers are stored as one enquiry, exactly like a WhatsApp message,
and treated the same way from there. If they cannot be transcribed,
the enquiry still appears, marked so, and the business calls back.
The live assistant. Where a business has switched it on, the
call is answered by an AI assistant instead of the fixed questions.
The call audio is streamed in real time to OpenAI (openai.com),
in the United States, which listens and replies in a synthetic voice,
in English or Afrikaans. It is only allowed to ask what the problem is,
the address and the caller's name, read them back, and say that
someone will call back. It cannot book, quote, price or promise a time,
and it says it is automated if asked. A transcript of the conversation
is stored as the enquiry. The audio itself is not kept by us.
The confirmation message. After a call, the business's
ServiceRoute may send the caller one WhatsApp message summarising what
was understood — the problem, the address and the name — and asking
them to confirm or correct it. Replies are read to update that
summary; a reply can change what the job is, where it is and who the
customer is, never the phone number. At most two rounds, after which a
person at the business takes over. Every such message is stored with
the enquiry, and a business can switch the confirmation message off.
When somebody at the business opens an enquiry, the message text is
sent to Anthropic (anthropic.com), an AI provider in the United
States, which reads it and returns a suggested job — a title, an address,
a phone number and so on.
Nothing is sent to Anthropic until a person opens the enquiry. Messages
that are never opened are never read by an AI.
The suggestion is never acted on automatically. It fills in a form
that a person at the business reads, corrects and saves. No job, quote,
invoice, price, appointment or assignment is ever created by the AI.
Replies are sent by people, not by the AI. A business can answer
your message from inside ServiceRoute. The software may suggest a
question when something is missing — that suggestion is built by fixed
rules from the empty parts of the form, involves no AI, and is sent only
when a person presses Send. Messages sent to you are stored alongside the
ones you sent, against that business's account.
This means an enquiry you send to a business over WhatsApp, or leave as a
voicemail, may be transmitted outside South Africa for processing. Under POPIA section 72 this is a
cross-border transfer, and it happens on the instruction of the business you
contacted.
If a business would rather not use this, it simply does not connect
WhatsApp or a phone number. Everything else in ServiceRoute works without
them, and no message text or recording is sent anywhere.
Who else sees it
Supabase
Database and file storage. Where all of the above is
held.
Netlify
Hosting for the website and its server functions.
Anthropic
Reads enquiry text as described above, and, when a
technician uses the quote helper, the notes they typed about the work.
Only that text; never prices or customer records.
Meta (WhatsApp)
Delivers the messages, where a business has
connected its number.
Twilio
Answers and records calls to a business's ServiceRoute
phone number, where it has one. Holds the recording and the caller's
number.
OpenAI
Turns a voicemail recording into text. Receives the
recording, nothing else, and only where a business has a phone number
connected.
Resend
Sends emails such as an invoice or a quote link.
PayFast
Takes subscription payments from businesses. Card
details go to them, not to us.
OpenStreetMap
Turns a typed address into map coordinates. It
receives the address text, nothing else.
Google Maps
When somebody taps Navigate, the job's address or
map pin is opened in Google Maps to get directions. That happens on their
phone, at the moment they tap it.
Push notifications
Where a business has switched them on,
alerts are delivered through the browser maker's push service (Google,
Apple or Mozilla, depending on the phone). They carry the job title, not
customer contact details.
We do not sell personal information, and we do not use it for advertising.
Nobody outside these providers is given access.
How long it is kept
While the account is open — jobs, quotes and invoices are business
records the business relies on, so they are kept until it deletes them.
Invoices and tax records — a business may be required to keep these
for five years under South African tax law, so deleting an account does
not necessarily delete them immediately.
WhatsApp and voicemail enquiries — kept with the business's other
records, the voicemail recording included. An enquiry that never
becomes a job can be dismissed, which hides it.
On request — a business can ask us to delete its account and its
data, and we will do so except where the law requires a record be kept.
Security
Everything travels over HTTPS.
Each business's data is separated at the database level, and those rules
are enforced by the database itself rather than by application code.
Passwords are stored as one-way hashes and cannot be read by us.
Staff of a business see only their own workspace. A staff member who is
deactivated loses access immediately.
No system is perfectly secure, and we would rather say so than imply
otherwise.
Your rights
Under POPIA you may ask what personal information is held about you, ask for
it to be corrected or deleted, and object to how it is used.
If you are a business using ServiceRoute, contact us at the address
below.
If you are a customer of such a business, contact that business —
they hold the information and decide what happens to it. If you cannot
reach them, contact us and we will help.
You may also complain to the Information Regulator of South Africa at
inforegulator.org.za.
Changes
If this policy changes in a way that affects how information is used, the
date at the top changes and businesses using ServiceRoute are told.
Contact
SERVICEROUTE (PTY) LTD Registration number 2026/697824/07 28 Esdoring Crescent, Vredekloof, Cape Town, Western Cape, 7560, South Africa privacy@serviceroute.co.za Cape Town, South Africa