Privacy policy

1. Who we are

Webbefy is operated by Saffary Technologies, trading as Webbefy. For your personal information we are the responsible party, as the Protection of Personal Information Act 4 of 2013 (POPIA) uses the term. For the people who visit a website we host, the website's owner is the responsible party and we are their operator (section 5).

Company

Saffary Technologies

Trading as

Webbefy

Email

our support email address

2. Our Information Officer

Our Information Officer is the head of Saffary Technologies, trading as Webbefy, reachable at our support email address. Send any request or question about your personal information to them.

If you are unhappy with how we handle your personal information, you have the right to complain to the Information Regulator at inforegulator.org.za. We would like the chance to put things right first, but you do not have to come to us before you go to the Regulator.

3. What we collect

• Account details: your first and last name, email address and phone number, and whether you want marketing emails.
• Business details: what you tell us about your business so we can build its website: its name, industry and description, contact phone number and email address, physical address and map location, opening hours, social media links, WhatsApp number and message, testimonials, and the logo and photos you upload.
• Your websites: the briefs, generated versions and published files for each site, its web address, and any domain you connect.
• Payments and credits: your credit balance and history, your subscriptions and invoices, and what PayFast tells us about each payment: whether it succeeded, the amount, and a token for charging the card you chose. We never see your card or bank details.
• Enquiries and statistics from your websites: see section 5.
• How you use Webbefy: which pages of the Webbefy app you open and for how long, the buttons you press and steps you complete there, the campaign or website that brought you here, and the main steps of your business with us, such as signing up, publishing a site and paying. See how we record use of the app.
• Technical data: logs and error reports created when you use Webbefy, which can include your IP address and browser details.

Use of the Webbefy app

The Webbefy app, meaning webbefy.app and not the websites we host for you, counts how it is used. For each page you open we record:

• which kind of page it was, such as the dashboard or a site's editor, never the full address
• how long it was open while you were looking at it
• for the first page of a visit, the website that sent you, such as Google, and the labels of the campaign link you arrived through, if any: its source, medium and campaign name, its content and term labels, and whether it carried an ad click id from Google or Meta (never the id itself)
• your country, as reported by our content delivery network
• whether you used a phone, a tablet or a computer, and the browser and operating system family

We do not store your IP address. It is used only as the request arrives, to limit how many requests one address can send and to make a code that tells one visitor from another for that day only. The code changes every day.

We also count some of the things you do in the app: for example, pressing a button to sign up or to publish, completing a step of your business details, editing your brief or a section of your website, replacing an image, starting or returning from a payment, opening an enquiry, and copying your referral link. Each is recorded with the same kind of page, country and device details as a page view, and sometimes a fixed label set by our code, such as which button, which step or whether a payment was for a subscription or for credits. We never record anything you type, and when something goes wrong we record an error code, never the error message.

When you are signed in, we also link these page views and in-app actions to your account, so we can see how customers use the app and help when something goes wrong. If you tick Don't record how I use Webbefy in your profile, we stop linking new page views to your account, stop recording your in-app actions, and remove the link to your account from the page views and in-app actions already recorded. If your browser sends the Global Privacy Control signal, the page views it sends are not linked to your account and its in-app actions are not recorded. Your pages are then still counted, without your account.

Page views and in-app actions are never recorded for admin accounts. The detailed records are deleted after 90 days and the daily totals after 24 months. We also keep weekly counts of how many people who signed up in the same week came back in later weeks. These are numbers only, with no link to any account, and are deleted after 24 months.

If you arrived through a campaign link, such as an ad, in the 30 days before you signed up, we keep on your account which campaign brought you, which we call campaign attribution: the first such link and the latest one. For each we keep the source, medium and campaign name the link carried, any content or term labels it carried, whether it carried an ad click id from Google or Meta (never the id itself), the name of the website that sent you, the kind of page the link opened, and when. If you signed up with a referral code, we keep that code there too, even when no campaign link brought you.

We also record on your account the main steps of your business with us, with the date and, where there is one, the website concerned: signing up, submitting your business details, generating a brief, generating and publishing a website, paying for a subscription's first month (even if the website then could not go live), a subscription renewing and ending, buying credits, and a refund or chargeback. We call these business steps. Payments, refunds and chargebacks are recorded with their amounts.

Campaign attribution and business steps are kept even if you use the switch in your profile or your browser sends Global Privacy Control, because they are records of our business relationship with you rather than of how you use the app.

We never sell this information, and nothing is sent to an advertising or analytics company. Only the providers in section 7 that run Webbefy process it for us.

4. Why we use it

• To create your account and sign you in, which we must do to provide the service you signed up for.
• To draft briefs and to generate, publish and host your websites, for the same reason.
• To take payments, issue invoices, and email you about payments, failed payments and sites taken offline, as our agreement with you and our duty to keep financial records require.
• To understand how people find and use Webbefy: to know which of our marketing brings customers who stay, and to improve the product. This is in our legitimate interest. In your profile you can stop your page views being linked to your account and your in-app actions being recorded. Campaign attribution and business steps are still kept, as section 3 explains.
• To answer your questions and help when something goes wrong.
• To keep Webbefy secure and prevent abuse, which is in our legitimate interest and yours.
• To send you marketing emails, but only if you ticked the box to receive them. You can change that in your profile at any time.

5. People who visit websites we host

This section is about the people who visit a Webbefy website rather than our own customers. The website's owner decides what their website collects and is the responsible party for it. We process it on the owner's behalf as their operator, under section 12 of our terms of service.

Enquiries

When a visitor sends a message through a website's contact form, we store what they send, usually their name, email address, phone number and message, and email it to the website's owner. We keep enquiries for 24 months and then delete them automatically.

Visitor statistics

Every website we publish counts how it is used, so that its owner can see whether it is working. For each visit we record:

• the pages opened, without any query string
• the website that referred the visit, reduced to a name such as Google or Facebook
• the country and region, as reported by our content delivery network
• whether the visit was on a phone, a tablet or a computer, and the browser and operating system family
• how long a page was open, and how quickly it loaded
• clicks on contact links, such as tapping a phone number or a WhatsApp button

We do not store the visitor's IP address. It is used only in memory, as the request arrives, to derive a one-way identifier that lets us tell one visit from another. That identifier is specific to one website, so the same person visiting two Webbefy websites cannot be connected between them. The detailed records, which are the only place the identifier exists, are deleted after 30 days. The daily totals that remain contain no identifier and are deleted after 12 months.

Statistics never include names, email addresses, precise locations or anything typed into a page, and we show them only to the website's owner.

Cookies on websites we host

Webbefy's own code sets no cookies on the websites we host and stores nothing on a visitor's device. A website that shows a Google map is different: the map loads from Google, which receives the visitor's IP address and may set its own cookies. If your website shows a map, mention this in your own privacy notice.

6. Cookies and browser storage in the Webbefy app

The Webbefy app sets no cookies. Everything it keeps in your browser is listed here.

Local storage

Kept on this device until it expires, you sign out, or you clear your browser's data:

• a sign-in token in local storage, which keeps you signed in until you sign out or the session expires;
• webbefy:pendingClaim, for up to 7 days: a website you were invited to claim, so the claim can finish after you sign up;
• webbefy:pendingReferral, for up to 30 days: the referral codes from links you opened, so one can be applied when you sign up;
• webbefy:campaign, for up to 30 days: the campaign links you arrived through before signing up, the first and the latest, so they can be credited to your account when you sign up. It is cleared when an account is created in this browser. After 30 days an entry is ignored, and it is removed the next time you open the app; and
• webbefy:seenRewards: which free-month notices you have dismissed.

Session storage

Cleared by your browser when you close the tab:

• drafts of your business details and brief, in session storage, so a refresh does not lose them;
• webbefy:creditReturnTo: where to return you after you pay for credits;
• webbefy:pendingClaimSession: that you started a claim in this tab;
• webbefy:pendingReferralSession: that you opened a referral link in this tab;
• webbefy:refForExistingAccount: that you opened a referral link while signed in; and
• webbefy:visit: a random code that groups the pages you open into one visit, and the labels of the campaign link the visit arrived through, if any. A new visit starts after 30 minutes without opening a page, or when you arrive through a different campaign link.

The app's fonts are part of the app itself, so no font provider receives anything when a page loads. When you pay, you move to PayFast's own pages, which have their own privacy and cookie policies.

7. Service providers and transfers abroad

We use these service providers to run Webbefy. Each receives only what it needs for its task, and we do not sell personal information.

Several of these providers process information outside South Africa. Section 72 of POPIA allows that where the recipient is bound to protect the information adequately, or where the transfer is necessary to perform our agreement with you. We rely on each provider's data processing terms, and on the transfer being necessary to provide the service you asked for.

We may also disclose personal information where the law requires it, or to protect the rights, property or safety of Webbefy, our customers or others.

8. How long we keep it

• Account, business and website details: while your account is open. Section 9 explains what happens when it closes.
• Websites taken offline: their files stay in storage while your account is open, so the site can come back. Taking a site offline does not delete it.
• Invoices and payment records: 5 years, as the Tax Administration Act 28 of 2011 requires.
• Enquiries sent through your websites: 24 months, then deleted automatically.
• Visitor statistics: detailed records for 30 days and daily totals for 12 months, each deleted automatically.
• How you use the Webbefy app: page views and in-app actions as detailed records for 90 days and daily totals for 24 months, each deleted automatically. Weekly counts of people returning after signing up are kept for 24 months.
• Campaign attribution and business steps: while your account is open. When it closes, the campaign attribution is deleted. The business steps are kept for our financial reporting, with their dates and amounts, for 5 years after the account closes, and then deleted. They no longer name your account, but each still refers to the record it came from, such as a payment, a subscription or a website, so they are not anonymous.
• Technical logs: only as long as we need them to run and secure Webbefy.

9. Closing your account

There is no self-service way to delete your account. To close it, email our support email address from the address on your account. We will close the account and delete or de-identify your personal information within 30 days, except records the law requires us to keep, such as invoices and payment records, which we keep for 5 years under the Tax Administration Act, and the business steps described in section 8, which we keep for 5 years after the account closes.

If you own websites, tell us whether you also want their enquiries and visitor statistics deleted, and we will delete them once the account is closed.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct information that is wrong, out of date, incomplete or misleading;
• ask us to delete information we are no longer allowed to keep;
• object to how we use your information in some circumstances;
• stop marketing emails at any time, from your profile or by asking us; and
• complain to the Information Regulator (section 2).

If you ask for a copy of your information, it can include the usage records linked to your account: the campaign that brought you, the business steps we recorded, and your page views and in-app actions from the last 90 days.

You can correct your name and phone number yourself in your profile. For anything else, contact our Information Officer, the head of Saffary Technologies, trading as Webbefy, reachable at our support email address. We may ask you to confirm your identity first, and we will respond within the time POPIA allows.

11. Security

We protect your information with reasonable technical and organisational measures, including encrypted connections, access controls, and established providers with their own security programmes. Supabase stores passwords as hashes, so we never see yours. No system is perfectly secure. If we believe your personal information has been accessed or acquired without authority, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

12. Children

Webbefy is for businesses, and you must be 18 or older to use it. We do not knowingly collect personal information about children, and if we learn that we have, we will delete it.

13. Changes to this policy

We will email you at least 30 days before a material change to this policy takes effect. The date at the top of this page shows the current version.

14. Contact us

Email our support email address about anything in this policy, or contact our Information Officer, the head of Saffary Technologies, trading as Webbefy, reachable at our support email address.