Privacy policy

1. Who we are

Webbefy is operated by Saffary Technologies, trading as Webbefy. For your personal information we are the responsible party, as the Protection of Personal Information Act 4 of 2013 (POPIA) uses the term. For the people who visit a website we host, the website's owner is the responsible party and we are their operator (section 5).

Company

Saffary Technologies

Trading as

Webbefy

Email

our support email address

2. Our Information Officer

Our Information Officer is the head of Saffary Technologies, trading as Webbefy, reachable at our support email address. Send any request or question about your personal information to them.

If you are unhappy with how we handle your personal information, you have the right to complain to the Information Regulator at inforegulator.org.za. We would like the chance to put things right first, but you do not have to come to us before you go to the Regulator.

3. What we collect

• Account details: your first and last name, email address and phone number, and whether you want marketing emails. We hold a date of birth only if you choose to add one to your profile.
• Business details: what you tell us about your business so we can build its website: its name, industry and description, contact phone number and email address, physical address and map location, opening hours, social media links, WhatsApp number and message, testimonials, and the logo and photos you upload.
• Your websites: the briefs, generated versions and published files for each site, its web address, and any domain you connect.
• Payments and credits: your credit balance and history, your subscriptions and invoices, and what PayFast tells us about each payment: whether it succeeded, the amount, and a token for charging the card you chose. We never see your card or bank details.
• Enquiries and statistics from your websites: see section 5.
• Technical data: logs and error reports created when you use Webbefy, which can include your IP address and browser details.

4. Why we use it

• To create your account and sign you in, which we must do to provide the service you signed up for.
• To draft briefs and to generate, publish and host your websites, for the same reason.
• To take payments, issue invoices, and email you about payments, failed payments and sites taken offline, as our agreement with you and our duty to keep financial records require.
• To answer your questions and help when something goes wrong.
• To keep Webbefy secure and prevent abuse, which is in our legitimate interest and yours.
• To send you marketing emails, but only if you ticked the box to receive them. You can change that in your profile at any time.

5. People who visit websites we host

This section is about the people who visit a Webbefy website rather than our own customers. The website's owner decides what their website collects and is the responsible party for it. We process it on the owner's behalf as their operator, under section 12 of our terms of service.

Enquiries

When a visitor sends a message through a website's contact form, we store what they send, usually their name, email address, phone number and message, and email it to the website's owner. We keep enquiries for 24 months and then delete them automatically.

Visitor statistics

Every website we publish counts how it is used, so that its owner can see whether it is working. For each visit we record:

• the pages opened, without any query string
• the website that referred the visit, reduced to a name such as Google or Facebook
• the country and region, as reported by our content delivery network
• whether the visit was on a phone, a tablet or a computer, and the browser and operating system family
• how long a page was open, and how quickly it loaded
• clicks on contact links, such as tapping a phone number or a WhatsApp button

We do not store the visitor's IP address. It is used only in memory, as the request arrives, to derive a one-way identifier that lets us tell one visit from another. That identifier is specific to one website, so the same person visiting two Webbefy websites cannot be connected between them. The detailed records, which are the only place the identifier exists, are deleted after 30 days. The daily totals that remain contain no identifier and are deleted after 12 months.

Statistics never include names, email addresses, precise locations or anything typed into a page, and we show them only to the website's owner.

Cookies on websites we host

Webbefy's own code sets no cookies on the websites we host and stores nothing on a visitor's device. A website that shows a Google map is different: the map loads from Google, which receives the visitor's IP address and may set its own cookies. If your website shows a map, mention this in your own privacy notice.

6. Cookies and browser storage in the Webbefy app

The Webbefy app uses no advertising or analytics cookies. It keeps two kinds of information in your browser, both needed for the app to work:

• a sign-in token in local storage, which keeps you signed in until you sign out or the session expires; and
• drafts of your business details and brief, and where to return you after a payment, in session storage, which your browser clears when you close the tab.

App pages load their fonts from Google Fonts, so Google receives your IP address when a page loads. When you pay, you move to PayFast's own pages, which have their own privacy and cookie policies.

7. Service providers and transfers abroad

We use these service providers to run Webbefy. Each receives only what it needs for its task, and we do not sell personal information.

Several of these providers process information outside South Africa. Section 72 of POPIA allows that where the recipient is bound to protect the information adequately, or where the transfer is necessary to perform our agreement with you. We rely on each provider's data processing terms, and on the transfer being necessary to provide the service you asked for.

We may also disclose personal information where the law requires it, or to protect the rights, property or safety of Webbefy, our customers or others.

8. How long we keep it

• Account, business and website details: while your account is open. Section 9 explains what happens when it closes.
• Websites taken offline: their files stay in storage while your account is open, so the site can come back. Taking a site offline does not delete it.
• Invoices and payment records: 5 years, as the Tax Administration Act 28 of 2011 requires.
• Enquiries sent through your websites: 24 months, then deleted automatically.
• Visitor statistics: detailed records for 30 days and daily totals for 12 months, each deleted automatically.
• Technical logs: only as long as we need them to run and secure Webbefy.

9. Closing your account

There is no self-service way to delete your account. To close it, email our support email address from the address on your account. We will close the account and delete or de-identify your personal information within 30 days, except records the law requires us to keep, such as invoices and payment records, which we keep for 5 years under the Tax Administration Act.

If you own websites, tell us whether you also want their enquiries and visitor statistics deleted, and we will delete them once the account is closed.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct information that is wrong, out of date, incomplete or misleading;
• ask us to delete information we are no longer allowed to keep;
• object to how we use your information in some circumstances;
• stop marketing emails at any time, from your profile or by asking us; and
• complain to the Information Regulator (section 2).

You can correct your name and phone number yourself in your profile. For anything else, contact our Information Officer, the head of Saffary Technologies, trading as Webbefy, reachable at our support email address. We may ask you to confirm your identity first, and we will respond within the time POPIA allows.

11. Security

We protect your information with reasonable technical and organisational measures, including encrypted connections, access controls, and established providers with their own security programmes. Supabase stores passwords as hashes, so we never see yours. No system is perfectly secure. If we believe your personal information has been accessed or acquired without authority, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

12. Children

Webbefy is for businesses, and you must be 18 or older to use it. We do not knowingly collect personal information about children, and if we learn that we have, we will delete it.

13. Changes to this policy

We will email you at least 30 days before a material change to this policy takes effect. The date at the top of this page shows the current version.

14. Contact us

Email our support email address about anything in this policy, or contact our Information Officer, the head of Saffary Technologies, trading as Webbefy, reachable at our support email address.