Privacy Policy

Our privacy promises

• We never sell your personal information, and we never rent it or trade it.
• We collect only what we need to run your account and build your projects.
• We never see your card number. Card payments are handled by Paystack, a regulated payment provider.
• Your projects are private. Only you can see them until you choose to publish.
• We do not use your projects to train AI models, and we do not allow the services that help us to do so.
• No advertising cookies or tracking, and no marketing emails unless you ask for them.
• If something goes wrong, we tell you. If your information is ever accessed without permission, we will tell you and the Information Regulator as soon as reasonably possible.

1. Who is responsible for your information

iGoNexa (“we”) is the responsible party for your personal information under POPIA. Our Information Officer, who oversees how we protect your information, can be reached at support@igonexa.com or through our contact form.

2. What we collect

• Account details: your email address and password. Passwords are stored only in scrambled (hashed) form, so nobody at iGoNexa can read them. If you sign in with Google, we receive your email address, name and profile picture from Google.
• Your projects: the ideas you describe, the details and requests you add in the chat, and the websites created for you.
• Plan and payment records: your plan, credits, payment amounts and dates, and your card's type and last four digits. Paystack gives us a secure token so it can charge your monthly renewal; we never receive or store your full card number or security code.
• Messages to us: your name, email address and message when you use our contact form or email us.
• Technical information: your IP address, browser type and the pages you open, recorded by our hosting provider for security and to fix faults.

Please do not put other people's personal information, or sensitive information such as health or banking details, into your project descriptions.

3. Why we use it

We use your information only for these purposes, each of which POPIA allows:

• to create and protect your account, and sign you in (to provide the service you asked for);
• to build, save and reopen your projects (to provide the service);
• to take payments, renew your plan, and send receipts and billing emails (to fulfil our agreement with you);
• to reply to your messages and support requests (because you asked us to);
• to keep iGoNexa secure, prevent fraud and fix problems (our legitimate interest in a safe service);
• to keep financial records, as tax law requires (a legal obligation).

We will only send you news or offers if you have agreed to receive them, and every such email will let you unsubscribe in one click.

4. Who helps us, and where your information goes

We use a small number of trusted service providers. Each one may use your information only to provide its service to us, under a written agreement that requires it to keep the information secure and confidential.

• Supabase (sign-in and database): stores your account, projects, plan records and messages, in a data centre in Europe.
• Anthropic (the AI that builds your website and runs the website chat assistant): receives your project descriptions and change requests to create the result, and visitors' chat questions to answer them. Anthropic does not use this information to train its models.
• Paystack (card payments): processes your payment and stores your card securely, under the payment card industry's security standard (PCI DSS).
• Vercel (website hosting): runs the iGoNexa website and the websites our customers publish, and keeps short-term technical logs.
• Resend (email delivery): sends our emails to you, such as renewal notices and replies, and delivers enquiries from your website to you.
• Google: only if you choose to sign in with your Google account.

Some of these providers process information outside South Africa, mainly in the European Union and the United States. Section 72 of POPIA allows this where the information is protected by laws or binding agreements that give it protection substantially similar to POPIA, or where the transfer is needed to provide the service you asked for. We only use providers that meet these standards. We will update this policy before connecting any new provider that handles your personal information.

We may also share information where the law requires it, for example with a court or regulator, and only to the extent required.

5. How we protect it

• All information is encrypted while it travels over the internet (HTTPS) and while it is stored.
• Database security rules ensure each customer can see only their own projects, plan and payment records.
• Access to our systems is limited to the people who need it, and protected with strong passwords.
• Secret keys are kept on our servers only and never sent to your browser.
• If we suspect your information has been accessed without permission, we will investigate at once and notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires, with what happened and what you can do.

6. Cookies and your browser

We use only essential cookies that keep you signed in and protect your account. We do not use advertising or tracking cookies. An idea you type before signing up is kept in your own browser for up to 7 days, so you do not lose it.

7. How long we keep it

• Your account and projects: while your account is open. Ending a paid plan does not delete them.
• When you ask us to delete your account, we delete your projects and personal information within 30 days, apart from what we must keep by law.
• Payment and invoice records: 5 years, as South African tax law requires.
• Messages to us: up to 2 years after our last reply, unless they form part of a dispute.
• Technical logs: kept by our hosting provider for a short period, usually no more than 30 days.

8. Your rights

Under POPIA, you have the right to:

• know whether we hold personal information about you, and get a copy of it;
• ask us to correct information that is wrong, or to delete information we no longer need;
• object to us using your information, including for any direct marketing;
• withdraw any consent you have given, at any time;
• complain to the Information Regulator.

To use any of these rights, email support@igonexa.com with the subject “Privacy request”. We may need to confirm your identity first. We will respond within 30 days and will not charge you for a reasonable request.

The Information Regulator (South Africa): inforegulator.org.za. We would appreciate the chance to resolve your concern first.

9. Children

iGoNexa is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us their information, please contact us and we will delete it.

10. Visitors to websites built with iGoNexa

This section is for people who visit a website that one of our customers built and published with iGoNexa, for example at a name.igonexa.com address or the business's own domain.

• The business is responsible for your information. The business that owns the website decides what happens to the details you give it, and is the responsible party under POPIA. iGoNexa processes those details on the business's behalf, only to run the website for it. Questions about a specific enquiry should go to that business.
• Chat assistant: on Pro and Business websites, your questions are sent to Anthropic to write an answer from the website's own content. We don't keep the conversation afterwards.
• Quotation and contact forms: the name, phone number or email address and message you send are saved for the business and emailed to it. Only that business can see them. They are deleted automatically after 12 months, or sooner if the business deletes them.
• No tracking: iGoNexa adds no advertising or tracking cookies to these websites. Our hosting provider keeps short-term technical logs, such as IP addresses, for security.
• Search engines are told each website's public address so they can find it. No visitor information is shared with them.

To ask about or remove information you sent through a website, contact the business directly, or email support@igonexa.comand we will pass your request on.

11. Changes to this policy

If we make an important change, we will email you before it takes effect. The date at the top of this page shows when it was last updated. See also our Terms and Conditions.