Privacy policy

Introduction

Websay is a product of Avily Pty Ltd, a South African company, and Avily Pty Ltd is the responsible party for your personal information under POPIA. Our registered address is Block B, Greenford Office Estate, Kenilworth, Cape Town, South Africa, and you can reach us at hello@websay.net. This policy covers the information you share in your chat with Websay, the information involved in building and running your website, and your visits to this site.

The short version: we collect what we need to build and care for your website, we protect it, we never sell it, and you stay in control of it.

Websay is intended for people who are 18 or older and acting for a business. We do not knowingly collect personal information from children, and the service is not directed at them.

What we collect and where it comes from

Directly from you, through your chat with Websay: your phone number and the profile name attached to it, the content of the messages you send to the Websay number, including text, photos, documents and voice notes, and your email address if you give it to us. Because that chat is how your website gets made, we also collect the website content you supply through it: your business name, what it does, its address, hours, services, prices and anything else you want on your site.

From the WhatsApp Business Platform, operated by Meta: the delivery details that come with each message, such as the sending number and message timestamps, which we receive because you chose to message us there.

Directly from you, through the enquiry form on this website: your name, your business name and what it does, your suburb or town, your phone number and email address if you give them, and anything you write in the message field. We use those details to reply to you and to start building your website, and they are covered by the same retention, deletion and security terms as the rest of this policy.

From your device when you visit this website: basic technical information such as pages viewed, and a measurement event when you click through to start a chat, described under advertising measurement below. When you pay, we receive confirmation of the payment from our payment provider, but never your card details.

How and why we use your information

We use your information for these purposes: to build, host, publish and maintain your website from what you tell us in the chat, to personalise it to your business, to answer your questions and give you support, to communicate with you about the service, including drafts, support and renewal reminders, to process payments through our payment provider, to improve the service, to measure the performance of our advertising, and to meet our legal obligations.

We never sell your personal information, we do not share it with third parties for their marketing, and we do not use it for any purpose this policy does not describe.

The messaging platform and Meta

Your conversation with Websay takes place over the WhatsApp Business Platform, which is operated by Meta. Avily Pty Ltd is the responsible party for the personal information in that conversation, and Meta processes it as an operator on our behalf in order to deliver messages between you and us. When you chat to a business on that platform, Meta processes information such as your phone number, message content and delivery information under its own terms.

Your use of the app on your phone is separately governed by WhatsApp's own terms and privacy policy, which you can read on their legal pages. This policy does not replace, modify or override Meta's terms, and nothing in it should be read as inconsistent with them.

Message processing

Your chat with Websay is how we deliver the service, so processing those messages is central to what we do. The messages you send are stored and processed so that your website can be built, published, updated and supported, and so that we can answer your questions and send you information about your service, such as your draft link and your renewal reminder.

Information we obtain about you through that chat is used only as reasonably necessary to support your conversation with us: building your website and supporting you. Your chat content is never shared with other customers, never used for advertising targeting, and never reused for purposes unrelated to your service.

Voice note processing

Many of our customers prefer talking to typing, and voice notes are a normal way to use the service. Voice notes you send are transcribed into text so that we can act on them, and the transcript is then processed in the same way as a typed message. Both the audio and its transcript are stored and protected with the same care as your written messages, and both are covered by the retention and deletion sections of this policy.

AI processing

The Websay chat is answered by an artificial intelligence system supervised by our human team, so when you message us you are interacting with automation. Your messages, including transcripts of your voice notes, are processed by AI to understand what you want, to generate and build your website and to make the changes you ask for. A person reviews anything the AI is uncertain about, people remain responsible for the service, and you can ask for a human in the chat at any time.

We do not use automated decision-making that has a legal effect on you, or a similarly significant effect, without human involvement. Decisions such as removing content or ending a service are made by people.

Opting in and out of messages

We only message people who have given us their number and opted in. By sending a message to the Websay number, you opt in to receiving replies and service messages from us about your website, such as drafts, support answers and renewal reminders. We send marketing messages only if you have given prior consent to receive them, as POPIA requires, and every such message tells you how to opt out.

You can stop receiving messages from Websay at any time: say so in the chat, in any words, block the number, or email hello@websay.net. We honour every opt-out request, however you make it, on or off the chat.

Payments

Payments are handled by a secure, independent payment provider. When you pay, your card details go directly to that provider over its own secure systems: we never see, receive or hold them, and we do not collect or store card data. What we receive is confirmation that a payment succeeded or failed, which we need to activate and renew your plan. The payment provider processes your details under its own privacy policy.

Please never send full payment card numbers, PINs or bank account details in your chat messages. If we ever need a payment from you, we send you a secure payment link instead.

Advertising measurement and Meta Business Tools

When you click the button on this website that opens a chat with Websay, our server sends a single click measurement event to Meta through its Conversions API. Meta receives this event from our website and uses it to provide us with measurement and advertising services, which is how we know our advertising is working.

The event contains only a referral code, the path of the page you were on, and a timestamp. It contains no names, no message content and no card data. We never send Meta payment card numbers, financial account details, government identifiers, health information, any other special category of personal information, or any data about children under 13.

The event is sent only when you deliberately tap or click a button to start a chat: that action is what triggers it, nothing is sent while you simply browse, and the site sets no tracking cookies. If we ever add measurement tools that legally require consent beforehand, we will ask for that consent on the site before they are switched on. You can opt out of the use of your data for ad targeting through Meta's ad preferences at facebook.com/adpreferences, and through the industry opt-out tools at aboutads.info and youronlinechoices.eu.

Cookies and local storage

This website sets no tracking cookies. If you arrive through an advert or a referral link, a referral code may be kept in your browser's session storage so that we can attribute your visit; it is cleared when you close the tab and identifies a campaign, not a person.

Who we share information with

We share information only where the service requires it. That means Meta, which operates the WhatsApp Business Platform carrying your chat and receives the measurement events described above, the hosting and domain infrastructure providers that keep your website online, the payment provider described above, and service providers who process information on our behalf under contractual confidentiality and security obligations, including the AI processing described in this policy. We may also disclose information where the law requires it, such as under a court order or a lawful request from a competent authority. We do not sell or rent your personal information to anyone.

What we never do with your information

We never sell, license or buy personal information, including any information obtained through the WhatsApp Business Platform or any other Meta platform. We never use your information to discriminate, or to decide anyone's eligibility for housing, employment, insurance, credit, education, government benefits or immigration status. We never use it for surveillance or for law enforcement purposes. We never use it to build or add to profiles of people without their consent.

Cross-border transfers

Some of the providers we rely on process information outside South Africa. Meta processes chat and measurement data in the United States and other countries, and our hosting, infrastructure and AI processing providers may do the same. Where information leaves South Africa, we transfer it in line with section 72 of POPIA: to recipients bound by law, binding corporate rules or contracts that provide protection substantially similar to POPIA, or otherwise on a lawful basis such as your consent or the necessity of the transfer for performing our agreement with you.

Data retention

We keep your information for as long as your service is active, because your messages, photos and business details are what your website is built from. After your service ends, we keep information only as long as we have a legitimate business purpose for it: to meet legal, accounting and tax obligations, to resolve any disputes, and to make it easy to restore your site if you come back. Once information is no longer necessary for those purposes, we delete it or de-identify it. Those purposes and the legal periods that apply to them are the criteria we use to set retention times, and we act promptly on every deletion request, as described in the next section.

How to delete your data

Anyone, anywhere in the world, can ask us to delete their personal information at any time, free of charge, and we do not make deletion conditional on our approval. Here is how it works, step by step:

1. Send the request in your chat with Websay, in any words, for example "please delete my data", or email our Information Officer at hello@websay.net with the subject "Data deletion request" and the phone number you used with Websay.
2. We confirm your identity so that we do not act on someone else's request. A request sent from the number that used the service is usually confirmation enough; for email requests we may ask a verification question.
3. We delete your data and confirm to you that it is done, within 30 days of your request.

What gets deleted: your phone number and profile name, your chat history with Websay, including photos, documents, voice notes and their transcripts, the website content you supplied, and your account records. If your website is live, deleting the content it is built from means the site comes down, and we will confirm that with you before we act.

What may be retained: records we are legally required to keep, such as invoices and payment records under South African tax and company law, and records needed for an active dispute. Anything retained is kept only for as long as the law requires and is then deleted.

Security

We take appropriate, reasonable technical and organisational measures to protect your personal information, as section 19 of POPIA requires, and we maintain administrative, physical and technical safeguards that meet or exceed industry standards to protect it against unauthorised access, loss or disclosure. These include encrypting information in transit, limiting access to the people who need it to do their work, using reputable infrastructure providers, and reviewing our safeguards as the service grows. If a security compromise affecting your personal information ever occurs, we will notify you and the Information Regulator as POPIA requires.

Your rights under POPIA

You have the right to ask what personal information we hold about you, to ask us to correct it, to ask us to delete it, and to object to processing in certain circumstances. These rights are free to exercise and apply to everyone who uses Websay, wherever they are. You can exercise any of them by sending the request in your chat with Websay or by emailing hello@websay.net. Deletion requests follow the steps under how to delete your data above. We may ask you to confirm your identity so that we do not act on someone else's request, and we will respond within a reasonable time and within any period POPIA sets.

Deleting information that your live website depends on may mean parts of the site come down. If that applies to your request, we will explain the effect before we act on it.

Information Officer

Avily Pty Ltd's Information Officer is responsible for privacy at Websay and handles all POPIA requests. You can reach the Information Officer at hello@websay.net or by post at Avily Pty Ltd, Block B, Greenford Office Estate, Kenilworth, Cape Town, South Africa.

Complaints to the Information Regulator

If you believe we have handled your personal information unlawfully and we have not resolved your concern, you have the right to lodge a complaint with the Information Regulator of South Africa. The Regulator's contact details and complaint process are available at inforegulator.org.za. We would appreciate the chance to put things right first, so please consider contacting our Information Officer before you do.

Changes to this policy

We may update this policy from time to time, for example when the service or the law changes. The current version always lives at this page with its "last updated" date, and it always reflects what we actually do with your information. If a change materially affects how we handle your information, we will tell you through your chat or by email before it takes effect.

Contact

Questions about this policy or your information? Message Websay in your chat or email hello@websay.net. You can also write to Avily Pty Ltd, Block B, Greenford Office Estate, Kenilworth, Cape Town, South Africa. Websay is a product of Avily Pty Ltd.