Privacy Policy

1. Who we are

VertexWeb is the trading name of VERTEX WEB (PTY) LTD, a private company registered in South Africa (registration number 2026/762640/07). “We”, “us” and “our” mean VertexWeb. “You” means anyone whose information we handle: visitors, people who ask us questions, account holders, clients and partners.

Under the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the information in this policy. That means we decide why and how it is used, and we are accountable for it. Section 13 explains the different position for information about your customers.

• Information Officer: James van Veelen, Director (registered with the Information Regulator, number 2026-068122)
• Email: contact@vertexweb.co.za
• Phone: 072 969 7373

2. What we collect

When you visit our website

• Technical information every website receives: IP address, browser type, the page requested and the time. Cloudflare processes this to deliver our sites and protect them from attacks.
• A bot check (Cloudflare Turnstile) on some forms, to stop spam.
• A partner referral code, if you arrived through a partner link (see Cookies).

We don't use Google Analytics, Meta Pixel or other advertising or tracking tools.

When you ask us a question

Your name, email address, business name (if you give it) and your question.

When you create an account

• With email: your email address and the password you choose. We store passwords only in scrambled, one-way form (a “hash”), so we can't see them.
• With Google: Google shares your email address, name, profile picture and a Google account ID, and confirms you own the email address. We only keep your email address. We don't get your Google password, contacts or anything else in your Google account.
• The package you built on our website, if you used the builder.
• Details we add: an account ID and code, and a line in our activity records (kept for up to 12 months) when you sign up or change things.
• A 6-digit code we email you to confirm your address. It expires after 10 minutes. Until you enter it, we don't create an account. To stop abuse, we keep a scrambled record of sign-up attempts for one day.

When you tell us about your business (the brief)

Your name, phone or WhatsApp number, business or project name, what you do, where you are, your services and prices, style preferences, logo, photos, and the web address you want.

When you use the client portal

• Messages, support tickets and change requests you send, and files you attach.
• Your notes and approvals on website previews.
• Your acceptance of our Terms: the version, date and time, your IP address and your browser. This is our record of the agreement.
• Your marketing preference (whether you want to hear about new VertexWeb tools).
• When you last signed in.

When you pay

• What we keep: your name, email, package, invoice amounts and status, and the references Paystack gives us (customer, subscription and transaction references).
• What we never see: card and bank details are entered on Paystack's secure page. We don't receive or store your card number, CVV, card type, last four digits or bank account details.

If you are a partner

Your name, email, phone number and referral code, which enquiries and clients came through your code, and your commission records. When payouts start, Paystack collects and holds your bank details; we keep only the references Paystack gives us for you as a payout recipient and for each transfer.

Your website's statistics

Visitor and uptime summaries for your website, from Cloudflare, shown in your portal. These are totals, not information about individual visitors.

3. Why we use it

POPIA only allows processing for a lawful reason. Ours are:

We won't use your information for something unrelated to these reasons without asking you first. We don't make decisions about you by automated means alone.

4. Messages we send

• Service messages are part of the service and can't be switched off while you have an account: sign-in and sign-up codes, invoices and receipts, preview-ready notices, security messages, account notices, and important changes to our service or terms.
• News and offers (clients only) are off until you switch them on in your portal settings. If you do, we may tell you about new VertexWeb services, tools and features by email or in your portal. Every marketing email has an unsubscribe link, and you can switch it off again at any time. Switching it off doesn't affect service messages.
• No cold marketing. We don't send marketing emails to people who haven't dealt with us, and we don't use your phone or WhatsApp number for marketing.

5. AI-assisted development

We use artificial intelligence tools, including Claude by Anthropic and ChatGPT by OpenAI, to help build, maintain and update websites and our services. Information you give us for your website may be processed through these tools where reasonably necessary to provide the service. We do not sell your information or use it to train our own AI models.

6. Where your information is stored or processed

We don't currently host email mailboxes for clients. If we add that service, we will update this policy before it launches.

Who is responsible for what

Cloudflare, Resend, Anthropic, OpenAI and GitHub handle information for us, on our instructions (in POPIA terms, they are our operators). Paystack and Google also decide how they use information in their own services, for example fraud checks or your Google account, so they are responsible for that under their own policies. The same applies to domain registries.

Sending information outside South Africa

Our databases and files are stored with Cloudflare, which may use data centres outside South Africa, and our email, AI and code-hosting providers are in the United States. POPIA (section 72) allows information to go outside South Africa in certain cases, for example when the recipient is bound by law or a binding agreement giving adequate protection, when you consent, or when the transfer is necessary to perform our agreement with you. We choose providers that publish data protection terms, and we rely on the transfer being necessary to deliver the service you asked for.

7. Who we share it with

Only the providers in section 6, and only what each needs to do its job. Apart from them, we share information only:

• when the law requires it (for example, a court order or SARS);
• with our professional advisers (such as an attorney or accountant), who must keep it confidential;
• if VertexWeb is sold or merged, in which case the new owner must keep this policy's promises.

We don't sell personal information and don't share it for other companies' marketing.

8. Cookies

We use only cookies our sites need to work. No advertising or analytics cookies.

The portal cookies can only be read by our servers, not by scripts on the page, and are only sent over secure connections. vw_ref can be read by our contact form so it can pass on the referral code.

9. How we protect your information

POPIA requires reasonable technical and organisational measures to keep personal information safe (section 19). Ours include:

• Encrypted connections: our sites use HTTPS.
• Encrypted storage: Cloudflare encrypts our databases and files at rest.
• Scrambled passwords: stored only as one-way hashes.
• Codes that expire: email codes last 10 minutes, with limits on how often they can be tried.
• Limits on repeated attempts: sign-in, sign-up and code checks are rate-limited.
• Signed sessions: sign-in sessions are digitally signed, and changing your password signs out your other sessions.
• Separate test systems: our test environment has its own databases and storage and uses test data.
• Limited access: today only our director has administrator access to client data. If we hire staff, each person will get access only to what their work needs.
• Backups: Cloudflare keeps encrypted, point-in-time copies of our database for a limited period, so we can recover from mistakes.
• Protected secrets: system keys and passwords are kept in protected settings, not in our source code, and every code change is automatically scanned for leaked secrets.

No system is completely secure. We can't promise an attack will never succeed, but we work to prevent one and to respond quickly if it happens.

10. Security incidents

If there is a security compromise involving personal information (for example, someone gaining access to or taking information they shouldn't have), we will:

1. act to contain it and limit the harm;
2. notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires, unless a public body responsible for investigating crime tells us a delay is needed;
3. explain what happened, what information was involved, what we are doing, and what you can do to protect yourself.

11. How long we keep it

We keep information only as long as we need it, then delete it or make it anonymous.

We keep information longer only where the law requires it, for an active security investigation, or while a dispute is being resolved.

12. Your rights

Under POPIA you have the right to:

• know whether we hold information about you, and get a copy of it;
• correct information that is wrong or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object to us using your information, including for marketing;
• withdraw consent where we rely on it;
• complain to the Information Regulator.

Email contact@vertexweb.co.za, ideally from the address on your account. We may ask you to confirm who you are first, so we never give your information to someone else. We aim to respond within 30 days, and simple requests are free. You can change your password and email preferences in the portal. For anything else, just email us.

13. Your customers' information

Some VertexWeb tools collect information about your customers, for example bookings, enquiries and leads, quote requests, reviews, and messages with your customers.

When we process that information only to provide the tool to you:

• you are the responsible party, and we are your operator;
• we process it only on your instructions and under the data processing terms in our Terms of Service;
• we keep it secure, don't use it for our own purposes, and tell you promptly if a security compromise affects it.

You are responsible for having a lawful reason to collect your customers' information and for telling them how you use it. We can give you a privacy notice template for your website.

If you booked with one of our clients

If you book with a business that uses VertexWeb, that business may ask you for a Google review after your visit.

• The booking form tells you this and lets you tick “Please don't ask me for a review”.
• If the business has switched on review emails, we send at most one email per booking, in the business's name. Replies go to the business.
• We record when the request was sent and whether you opened the review link. We don't know whether you left a review.
• Every email has a “Don't email me again” link. If you use it, that business will not email you for a review again. We keep a code made from your email address so we can honour this, not the address itself.
• The business is responsible for your information and we process it for them. To see, correct or delete it, contact the business, or contact us and we will help.

14. Children

A person under 18 can't enter into a paid VertexWeb agreement on their own. If a client is under 18, a parent or legal guardian must enter into or approve the agreement for them.

Your website and tools: if your business deals with children (for example, bookings for a child's class), you are responsible for collecting that information lawfully, including getting a parent's or guardian's consent where POPIA requires it. We process it only as your operator (section 13).

If you believe we hold a child's information without the right consent, contact us and we will deal with it promptly.

15. Changes to this policy

When we change this policy we update the date at the top. For important changes, we tell account holders by email or in the portal before the change takes effect.

16. Contact us

• Privacy questions and requests: contact@vertexweb.co.za
• Support: support@vertexweb.co.za
• Billing: billing@vertexweb.co.za
• Phone: 072 969 7373