What does Heyhannah actually do?

Hannah is an AI receptionist for your business. She answers every call and message 24/7, asks the right questions about the job, and sends you the lead on WhatsApp within seconds, so you never lose an enquiry because you couldn't pick up. If you need a website, we build and run one for you as part of the package.

R1,999 a month with 100 minutes of calls included, or R23,988 a year with 150 minutes a month. Extra minutes are R6 each and Hannah never stops answering. A website is included if you need one, and that package is for one business at one location with a small team (up to 5 people). Businesses with several branches, a bigger team or a lot of calls get a custom package.

How does call forwarding work?

You forward your existing mobile number to your Heyhannah number by dialling a few short codes on your phone. It takes about three minutes and works on all the major South African networks; rain is the one exception, so talk to us first if you're on it. When you're available, turn forwarding off and answer calls yourself. When you're busy, turn it on and Hannah handles everything.

Does it sound like a real person?

She holds a normal conversation rather than reading a script: she answers with your business name, listens, asks follow-up questions about the job, and reads the details back to check she got them right. If she mishears something she asks again instead of guessing.

What happens during load shedding?

Heyhannah runs in the cloud, so it keeps answering calls even when your office has no power. This is one of the biggest advantages: you never miss a call due to load shedding again. WhatsApp summaries are delivered over mobile data.

Can it handle Afrikaans callers?

Ja. Hannah can run entirely in Afrikaans: she greets your callers in Afrikaans and understands them in Afrikaans, not just English with an accent. We set your language when we set your account up, and each Hannah answers in one language, so tell us which one your customers actually phone in.

How is this different from a normal answering service?

An answering service takes a message, usually charged per call and often only during business hours. Hannah answers every hour of the day and actually qualifies leads: she asks what they need, when, and how to reach them, and you get a structured WhatsApp message, not a vague callback note. A full-time receptionist doing the same job averages R7,865 a month for office hours alone (Indeed, September 2026).

What about data privacy?

Heyhannah is fully POPIA compliant. We don't collect ID numbers, bank details, or other sensitive information. Call data is stored securely and you can request deletion at any time.

How does billing work?

Pay monthly or yearly. Monthly has no contract: you're billed when you sign up and then each month, and you can cancel anytime. Yearly is paid once for 12 months and renews each year, with an email reminder well before it does. Hannah can be answering your calls within 24 hours of you finishing setup, and if you're not happy in your first 30 days, tell us and we refund your first payment in full, monthly or yearly.

POPIA fines are real now, and one person's details are enough

By André Bergan, 2026-11-04

If a job comes in, you probably have that customer's name, number, address and maybe a photo of their roof or geyser sitting on your phone or in a WhatsApp chat right now. That is personal information under South African law, and this year the regulator that enforces that law showed how little it takes to end up with a fine.

What happened this year

POPIA, the Protection of Personal Information Act, has been fully in force since mid 2021. In April 2026 the Information Regulator went to the High Court to enforce a fine against the Blouberg Local Municipality, after a complaint that one staff member's personal information had been put on the municipality's website. The Regulator had issued an enforcement notice and then a R500,000 fine when the municipality didn't comply. The judge cut the fine to R250,000, because only one person was affected, the municipality had taken the information down, and it was a first offence (Information Regulator). One person's details, still a R250,000 fine.

That wasn't a one off. In May the Regulator published an enforcement notice against the Central Johannesburg TVET College, which it found had unlawfully shared employees' personal information and hadn't reported the security compromise to the Regulator or the people affected. The college was given deadlines starting at 31 days to put things right (Legal 500). And at a media briefing on 31 August 2026, the Regulator said it had issued several more enforcement notices this financial year (Werksmans).

None of these are construction companies, salons or courier operators. They're a municipality and a college. But the pattern in each case is the same: personal information ended up somewhere it shouldn't, or with someone who shouldn't have it, and the Regulator acted once it found out. Size didn't protect either of them, and nothing in any of this says it would protect a two person plumbing business either.

Why this is your problem too

POPIA doesn't care how big you are. If you take down a customer's name, number and address to arrange a job, you are "processing personal information" under the Act, the same thing a bank is doing when it takes your ID number. The one real exemption is for a private individual acting purely in their own personal capacity, and running a business isn't that.

What actually bites most small businesses isn't a government inspection, it's a lost phone, a WhatsApp group where customers end up seeing each other's numbers, or a staff member who leaves and takes your customer list with them on their own handset. Those are all "security compromises" under POPIA, and section 22 of the Act requires you to tell the Information Regulator, and the people affected, "as soon as reasonably possible" once you know about one. There's no fixed deadline like the GDPR's 72 hours in Europe, which sounds like it buys you time. It actually buys you less: there's no clock to watch and wait out, and "as soon as reasonably possible" can mean sooner than 72 hours, not longer (mjkinc.co.za).

Ignoring an enforcement notice once one has been issued against you is a separate offence under the Act. The most serious contraventions carry a fine, up to ten years in prison, or both, and the Regulator's own administrative fines are capped at R10 million (michalsons.com).

Three things worth doing this week

Decide what you actually need to ask for. A job needs a name, a number, an address and the scope of the work. It almost never needs a customer's ID number or banking details up front. The less sensitive information you hold, the less damage a lost phone can do.
Don't run your customer list through one person's personal WhatsApp. If that phone is lost, stolen, or the person leaves the business, your customer list goes with it, and you may not even know what left with them.
Have a real answer ready for "what happens if a phone with customer details on it goes missing". If you don't have one, that's the gap worth closing now, not after it happens.

Where Hannah fits

I built Hannah to be careful about this by default, not as a reaction to any of the above. When she takes a call or a WhatsApp message, she doesn't ask for an ID number, banking details or anything else sensitive, and every lead lands in one dashboard instead of being scattered across whoever's phone happened to answer that day. If someone leaves your business, your customer list doesn't walk out the door with them. That's not a POPIA compliance certificate, it's just one less place for things to go wrong. If you want to see how it works, have a look at the receptionist page.