This notice explains how Web60 (Pty) Ltd ("Web60") processes personal information when you use our service. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
1. Responsible party
Web60 (Pty) Ltd, Johannesburg, South Africa.
Information Officer: privacy@web60.co.za
2. What we collect
- Account data: name, email, business name, password hash, role.
- Business inputs: the prompts, photos, and details you give us so we can generate your site.
- Site visitor leads: name, email, phone, and message that visitors submit through your published Web60 site. You are the responsible party for those leads; we process them on your behalf.
- Billing data: top-up amount and PayFast reference. PayFast handles card details directly — we never see them.
- Usage and security logs: IP hash, browser, request times, rate-limit hits. Used to detect abuse and improve the product.
3. Why we use it
- To provide the service you signed up for (generate sites, host them, deliver leads).
- To process payments and send receipts.
- To send service emails like auto-topup reminders and admin alerts.
- To enforce abuse limits and protect the platform.
We do not sell your personal information. We do not use it for third-party advertising.
4. Sharing
We share data only with operators that help us run the service:
- PayFast — payment processing (South Africa).
- Supabase / Lovable Cloud — database, auth, and hosting.
- AI providers — to generate copy and images from your prompts.
- Our email transport — to deliver receipts and notifications.
Each operator is bound to process data only on our instructions.
5. Retention
- Account and billing records: 5 years after account closure (SARS requirement).
- Site content: until you delete the site or close your account.
- Visitor leads: until you delete them, or 24 months after your account closes.
- Security logs: 90 days, then aggregated.
6. Your rights
Under POPIA you can:
- Request a copy of the personal information we hold about you.
- Ask us to correct or delete it.
- Object to processing and withdraw consent (this may end the service).
- Lodge a complaint with the Information Regulator (inforegulator.org.za).
Email privacy@web60.co.za to exercise any of these.
7. Security
We use TLS in transit, encryption at rest, row-level security on user-owned data, rate-limiting on AI endpoints, and per-account spend ceilings. No system is perfectly secure — if you believe yours is compromised, email us immediately.
8. Cookies
We use a small set of strictly-necessary cookies for sign-in and CSRF protection. We do not run third-party advertising trackers.
9. Changes
We may update this notice. Material changes will be announced via email or a banner in the dashboard at least 14 days before they take effect.