PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), read with the Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0 — July 2026.

1. The body

Custom Artificial Intelligence Solutions (Pty) Ltd, trading as Custom AI Solutions ("the Company"). Registration number 2016/377651/07. Platforms operated: nostoi.ai (AI property-advisory platform) and the Custom AI Solutions tools platform. Information Officer: Steven Glyn Johnstone, registered with the Information Regulator (certificate 2026-061119, registered 3 July 2026). Contact for all PAIA/POPIA matters: the Information Officer, at privacy@nostoi.ai or steven@themodelexplained.co.za, or by telephone on 082 336 3759. The Company's physical and postal address is Highwick Drive, Kenilworth, Cape Town, 7708.

2. How to use this manual

This manual tells you what records the Company holds, and how to request access to a record (PAIA) or exercise your rights over your personal information (POPIA).

3. The Regulator's guide

The Information Regulator publishes a guide, in all official languages, on how to use PAIA: inforegulator.org.za · telephone 010 023 5200 · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. General enquiries: enquiries@inforegulator.org.za. Complaints: PAIAComplaints@inforegulator.org.za (PAIA) or POPIAComplaints@inforegulator.org.za (POPIA). (Contact details verified against the Regulator's own site on 17 August 2026.)

4. Records held by the Company

(a) Statutory and company records — incorporation and statutory registers, tax and accounting records, Information Regulator registrations. (b) Platform-user records (POPIA-governed) — account and authentication records; the consent ledger (including 18+ attestations); advisory chat transcripts (retained up to 90 days after the last message, as described in the Privacy Policy); user-confirmed saved memories; saved searches and listings; enquiry records; conversation integrity fingerprints (non-readable); security and rate-limiting records; payment references (payment card data is never held — it is processed by the payment provider). (c) Listing-side records — listing data supplied by participating agencies; per-asset media rights records; agency subscription and exposure-report records. (d) Custom AI Solutions tools platform records — client account records, tool workspace data, subscription and billing records (payment card data is never held — it is processed by the payment provider), and support correspondence. (e) Operational records — supplier and operator agreements, insurance, correspondence. (f) Safeguarding and compliance records — statutory-report case records (restricted access), data-breach and incident records.

4A. Records held in terms of other legislation

The Company also keeps records required by other laws, including the Companies Act 71 of 2008 (statutory registers and records), the Income Tax Act 58 of 1962 (financial and tax records — the Company is not a registered VAT vendor, so it keeps no records under the Value-Added Tax Act 89 of 1991), the Basic Conditions of Employment Act 75 of 1997 where applicable, the Electronic Communications and Transactions Act 25 of 2002, POPIA itself (processing and consent records), and the Financial Intelligence Centre Act 38 of 2001 to the extent applicable.

5. Records available without a PAIA request

The platform's public pages (listings, trust charters, terms, the Privacy Policy, this manual) — and, for a signed-in user, their own records through self-serve controls: profile, consent states and history, saved memories, saved searches and listings, and account deletion.

6. Requesting access to a record (PAIA)

Use PAIA Form 02 (available from the Information Regulator's website) and send it to the Information Officer, identifying the record, the right you seek to exercise or protect, and the form of access you want. The prescribed request and access fees under PAIA's fee regulations apply, except where exempt — a data subject requesting their own personal information pays no request fee. The Company responds within 30 days (extendable once by up to 30 days on the statutory grounds), granting access or stating the ground of refusal under PAIA Part 3. If refused, you may complain to the Information Regulator or apply to court.

7. Your POPIA rights

Access, correction and deletion of your personal information (largely self-serve on the platform; deletion operates subject to any retention required or permitted by law); objection to processing; withdrawal of consent; and complaint to the Information Regulator. In summary: the Company processes account and authentication records, consent records, advisory chats (processed in part by AI providers outside South Africa under contract), saved preferences and searches, enquiry and introduction records, agent and agency portal records (acceptances, subscriptions, standing), payment references (never card numbers), and security and hosting records. Data subjects are platform users (buyers, sellers, agents and agency staff) and client contacts. Recipients are the categories of service providers and counterparties named in the Privacy Policy's table; some processing crosses borders under contracts requiring appropriate protection. Records are secured with encryption, access controls and audit logging. The Privacy Policy's full table — one row per record type, with retention in plain words — is incorporated here by reference and forms part of this manual.

8. Availability

Published at nostoi.ai, available from the Information Officer, and available for inspection at the Company's principal place of business during ordinary business hours. A copy is provided to the Information Regulator on request. This manual is updated when the Company's structure, records or processing materially change; the version line at the top records the current issue (v1.0 July 2026; contact and numbering updates 17 August 2026).