Last updated: 27 October 2026
Dimeri (Pty) Ltd ("Dimeri", "we", "us") is a South African company. This policy explains how we handle personal information when you visit our website, use the Dimeri platform on the web or in the Dimeri Android app ("Dimeri" on Google Play, package ai.dimeri.app), together the "Service", or otherwise deal with us. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA) and, where they apply, other data protection laws such as the GDPR.
Our customers decide what they put into their Dimeri workspaces. For that content, the customer is the responsible party (controller) and Dimeri processes it on their behalf under our Data Processing Agreement. If your information is in a customer's workspace and you have a question about it, please contact that organisation first.
Account and profile details (name, email address, job title, organisation) and your user ID, billing details, your subscription status and purchase history, messages you send us, and information you enter into forms on our website, such as demo or contact requests and template downloads.
Information you and your colleagues add to a workspace, such as risks, controls, incidents, audits, policies, comments, uploaded files and photos, and the prompts you send to our AI features and the records it helps you create. This can include personal information about other people.
Device and browser information, IP address, log data, crash logs and diagnostics, and how you use our website and the Service (app interactions). We collect some of this using cookies and similar technologies, as described in section 10 and our Cookie Policy.
When you sign up, we use your IP address to estimate the country you signed up from, for security and fraud prevention. We store only the country, not your IP address, and the lookup happens on our own servers using an offline copy of the DB-IP Lite database (licensed under CC BY 4.0), so no information is sent to DB-IP.
Information from your organisation when it invites you to a workspace, from tools you choose to connect (see section 6), and from payment providers confirming your payments.
If you buy a plan in the Android app, you pay through Google Play. Google processes the payment and is the merchant of record, under its own terms and privacy policy; we receive only what we need to confirm your subscription, not your card details. On the web, payments are processed by our payment providers (see section 8). We do not store full card numbers.
To understand which features are used and to fix problems, the Dimeri platform sends usage and error information to our product analytics and error-reporting provider, which stores it in the European Union. On self-serve workspaces this includes an internal user ID (not your name or email address), your workspace's ID, plan and type, your country (estimated from your IP address), the pages you visit, the buttons you click (with all text on them hidden), and key steps such as creating a workspace or a record, inviting someone, sharing, importing or exporting, and changing plan, recorded as IDs, counts and formats only. We never send what you type, the content of your records, your name or email address, and we remove email addresses and access codes from page addresses before sending. We do not record your screen. This data is kept for up to 12 months.
Product analytics is on by default on self-serve workspaces. You can switch it off at any time in the platform under Profile → Security → Product analytics; we keep a dated record of your choice. We respect your browser's Do Not Track setting. Enterprise workspaces, and Dimeri's own support and test accounts, send no product analytics. Error reports (the type of error, its message and technical details, and the page) are always sent so we can fix problems; they are sent without your user ID if you have switched analytics off or use an enterprise workspace, so they cannot be linked to you. Our legitimate interest in keeping the Service working and improving it is the basis for this processing.
We use personal information to:
We rely on one or more of these legal grounds: performing our contract with you or your organisation, our legitimate interests (where these are not outweighed by your rights), your consent, and compliance with the law. We do not sell personal information.
The Service includes optional AI features, such as chat, suggestions, document analysis, form building and report drafting. To deliver them, the content you work with (including prompts, relevant workspace content and files you attach or upload) is processed by our AI providers, acting on our behalf. Only the context needed for your request is sent; no provider receives your full workspace or account data.
Under our contracts with them, our AI providers do not use this content to train their models, and they keep it only for a short period for abuse and safety monitoring before deleting it. We do not use customer content to train AI models either.
Workspace administrators can turn AI features off, or restrict AI processing to providers that process data in South Africa. AI conversations and AI-generated content saved to a workspace are kept as part of that workspace's data. Chat history outside a client workspace can be cleared at any time from the dashboard. Files attached to an AI conversation are not stored after the session ends, unless they are saved to a client workspace (see section 5).
AI outputs can be wrong and are advisory only. They are not legal, compliance, financial or other professional advice, and should be reviewed by a suitably qualified person before you rely on them. AI does not change your records without a user confirming the change, and we do not make automated decisions that affect your legal or compliance standing without human review.
You can ask Dimeri's AI assistant a limited number of questions on app.dimeri.ai without signing up. Your questions are sent to our AI provider only to produce the answer. We do not store them on our servers: the conversation is kept in your own browser so you can continue it, and it moves into your account only if you sign up. To count the free questions and stop abuse, we keep a random identifier in your browser and a scrambled (hashed) form of your IP address, which we delete after seven days. A bot-protection service checks that requests come from a person; it processes technical information about your browser and connection for this purpose. Please do not include personal information about yourself or others in these questions.
If you use our free AI tools on the website and create a shareable report link, the report and the details you entered (your name, organisation and sector) are stored for up to 30 days so the link works, then deleted. If you do not create a link, nothing is stored.
You can report an AI answer, or another person's comment, from within the Service. Reports, including the reported text, are stored in South Africa and reviewed by Dimeri staff.
Consultants and other professionals can create a separate workspace for each of their clients, upload or import the client's documents (such as PDF, Word, Excel, PowerPoint and CSV files, and images), work with AI assistants on that client's work, and produce deliverables for the client.
For personal information about a consultant's client, or about the client's staff, suppliers or other people, that is put into a client workspace, the consultant is the responsible party (controller) and Dimeri is the operator (processor) on the consultant's behalf, under our Data Processing Agreement. The consultant is responsible for having the right to share that information with Dimeri.
In a client workspace we process the workspace details you enter (client name, industry, organisation type, country, website and scope), the documents you upload or import and their extracted text, chat messages with the workspace's AI assistants, the deliverables they produce and their version history, forms drafted there, and activity (who did what). Documents, their text and chat content are sent to our AI providers to generate answers and deliverables, on the terms in section 4; client data is not used to train AI models.
Each client workspace is kept separate from every other workspace, and only the people you invite (as Editors or Viewers) can see it. When you delete a document or a client workspace, it is removed from the Service; anything we must keep for the reasons in section 9 is kept only for those purposes.
You can connect a Google account (Google Drive, Gmail) or a Microsoft 365 account (OneDrive, SharePoint, Outlook). Connections use the provider's own sign-in, access tokens are stored encrypted, and you can disconnect an account at any time, which stops our access. When an account is connected, we access only the files you choose to import and, for document requests, the replies (text and attachments) in the threads of drafts that Dimeri saved and you sent. We do not read any other mail.
Dimeri can draft a request for documents or information to your client. It saves the email as a draft in your own Gmail or Outlook; you review and send it yourself. Dimeri never sends email on your behalf.
Dimeri uses service providers (sub-processors) in these categories to run the Service:
Customer data is processed in South Africa. Some providers, including AI providers, process information outside South Africa, including in the European Union and the United States, for example when you use AI features. We make such transfers only where section 72 of POPIA allows it, for example under written agreements that require the recipient to protect the information to a standard comparable to POPIA, and, for data from the EU or UK, under appropriate safeguards such as standard contractual clauses.
You can request the full, current list of sub-processors by emailing privacy@dimeri.ai; enterprise customers also agree it in their contract. We tell customers before we add or replace a sub-processor, so they have the chance to object.
Live customer data stays with our cloud hosting provider in Cape Town, South Africa. To recover from a disaster that affects that region, we keep encrypted backup copies with the same provider in Ireland (European Union). These copies are never used to run the Service; they are restored only to recover from a disaster. This transfer is made under section 72(1)(a) of POPIA, because the recipient is subject to the EU General Data Protection Regulation, together with the provider's data processing terms.
A workspace owner can choose that the workspace's uploaded files are never copied to Ireland (Workspace Settings → Your data). Encrypted database backups are copied to Ireland in every case. Customers that need all data stored only in South Africa can contact privacy@dimeri.ai to discuss in-country-only hosting. Other data residency options may be available by separate written agreement.
We keep personal information while your account is active and for as long as needed for the purposes in this policy, including to meet legal, accounting and security obligations. After that, it is deleted or anonymised. When a workspace is closed, its data is deleted after a short grace period that allows the customer to export it. Backups are kept for a limited period and expire on a rolling basis.
You can delete your account in the app under Settings → Delete account, or on the web at app.dimeri.ai/delete-account (no sign-in needed). We handle requests made by email within 30 days. When your account is deleted, we keep only:
We use essential cookies to keep the website and the Service working and secure. With your consent, we use website analytics to understand how visitors use our site. Product analytics in the Service is described in section 2.6. You can manage cookies through our cookie banner and your browser settings; rejecting some cookies may affect how the site works. See our Cookie Policy for details.
Only if you accept analytics cookies, our website records how visitors use it: pages visited, when a demo or video is opened and played, how much of it is watched (25%, 50%, 75% and 100%), and which call-to-action buttons are clicked. This helps us see which content is useful. Nothing is recorded before you accept, and we do not record your screen or what you type. You are recognised by a random identifier stored in your browser, not by your name or email address. When you accept analytics, our analytics provider in the European Union also receives your IP address and uses it to estimate your country and city. We keep this analytics data for up to 12 months, then it is deleted. Our legal basis is your consent, which you can withdraw at any time through Cookie settings at the bottom of every page; we then stop recording and remove the analytics cookies from your browser.
We only send marketing emails if you have opted in. You can unsubscribe at any time using the link in any marketing email or by contacting us. Submitting a form or downloading a resource does not, on its own, sign you up for marketing. We will still send service messages about your account.
We use appropriate technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls, security testing, staff training, monitoring and incident response. No system is completely secure, but if a security compromise affects your personal information, we will notify you and the Information Regulator as required by law. More detail is on our Security page.
To keep the Service safe, we check content that other people will see. From 23 November 2026, images (such as comment attachments, files on public forms, shared items, profile pictures and logos) will also be checked by a cloud image-moderation service in Ireland (European Union); the image is checked in memory and not stored there. Private evidence uploads are not sent. Text (such as comments, public form answers and shared chat messages, when it is at least 40 characters long or contains a link) is checked by our AI provider, with personal details removed first, and only where the workspace allows AI processing. We store the result of a text check against a code derived from the text, not the text itself. Web addresses are checked against lists of harmful sites and a web reputation service.
Flagged content is never deleted automatically. It is hidden or marked and reviewed by a person at Dimeri. We rely on our legitimate interest in keeping the Service safe. If we find child sexual abuse material, we keep it securely as evidence and report it to the South African Police Service, as the Films and Publications Act requires.
Customers may choose to store special personal information (such as health information) or information about children in their workspaces. They are responsible for having a lawful basis to do so, and we protect it in the same way as all customer content.
Our website and Service are not intended for anyone under 18, and we do not knowingly collect their personal information directly. If you believe we have, please contact us and we will delete it.
The Service and our website may link to websites and services we do not run. Their own privacy policies apply, and we are not responsible for their content or practices.
Under POPIA you have the right to be told that your personal information is being collected, to ask for access to the personal information we hold about you, to ask us to correct or delete it, to object to its processing (including for direct marketing), and not to be subject to a decision based solely on automated processing. Where we rely on consent, you can withdraw it at any time. You can update most account details yourself in the Service. To make a request, contact our Information Officer (section 17). We may need to verify your identity first. If you are in the EU, the UK or another country with data protection laws, you may have further rights under those laws.
You also have the right to complain to the Information Regulator of South Africa:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
P.O. Box 31533, Braamfontein, Johannesburg, 2001
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Tel: 010 023 5200
Website: inforegulator.org.za
If you are outside South Africa, you may also complain to your local data protection authority.
We may update this policy from time to time. We will change the date at the top and, for material changes, let customers know by email or in the Service.
Dimeri (Pty) Ltd
Attn: Information Officer
9 Lena Ahrens Road, Glenwood, Durban, 4001, South Africa
Email: privacy@dimeri.ai
Information Officer: Phumelela Mhlongo (appointed 18 May 2023)
Deputy Information Officer: Nozipho Prudence Memela (appointed 6 August 2025)
Registered with the Information Regulator as DIMERI (private body), registration number 2026-005854.