Privacy Policy

Delrity is a website building and hosting platform operated by Mzansi WebApps, based in South Africa. If you have any questions about this policy or how we handle your personal information, contact us at privacy@delrity.com.

We collect the following categories of personal information:

• Account information - name, email address, and password (stored in hashed form) provided during registration.
• Billing information - subscription plan, billing status, and payment references. Card details are handled by our payment processor and are not stored on our servers.
• Website content - the text, images, and settings you add to the websites you build and publish with Delrity.
• Usage and device data - log data, IP address, browser type, and interactions with the Service, collected to keep the platform secure and reliable. We also keep short-lived records of requests by IP address, such as repeated sign-in attempts, so that we can limit abuse.
• Storefront and order information - if you use our Business plan to sell products, we process the order details your customers provide at checkout (such as name, email, phone number, and order contents) so the order can be fulfilled. In this case you are the responsible party for your customers’ information and we act as an operator on your behalf. See our POPIA Compliance page.
• Pre-order information - if you use the Book / Pre-order section of a website, we process the details your visitors enter (name, email address, phone number, delivery address, quantity and notes) and a record of their consent, so the pre-order can be fulfilled. You are the responsible party for that information and we act as an operator on your behalf.
• Messages to us - if you write to us through our contact form, we receive your name, email address, topic and message by email, and use them to reply to you.
• Abuse reports - if you report a website through our abuse report form, we collect the web address you report, the category and description you give, and your email address if you choose to provide one. We keep only a hashed form of your IP address, so we can spot repeated misuse of the form without keeping a readable record of who reported what.

We use email-and-password authentication to sign you in. When you log in we create a session and store a secure session token, together with your IP address and browser user-agent, so we can keep you signed in across our subdomains, protect your account, and detect suspicious activity. A session lasts for up to 7 days from your last visit, or until you sign out. Passwords are never stored in plain text. See our Cookie Policy for how session cookies work.

We process personal information to:

• Create and manage your account and published websites;
• Provide, maintain, and improve the Service;
• Process subscriptions, trials, and payments;
• Send transactional emails such as verification, billing, trial reminders, and important service notices;
• Provide customer support; and
• Detect, prevent, and address security or technical issues.

We process personal information where it is necessary to perform our contract with you, to comply with a legal obligation, for our legitimate business interests (such as securing and improving the Service), or where you have given consent. You may withdraw consent at any time where processing is based on it.

We use strictly necessary cookies to keep you signed in and secure your session, browser storage to remember choices such as your theme, and, where enabled, privacy-friendly analytics. For full detail and how to manage cookies, see our Cookie Policy.

Where analytics are enabled, we use Vercel Web Analytics and Vercel Speed Insights on our marketing website and on published websites, only to understand aggregate usage and page speed so we can improve the Service. Vercel states that Web Analytics identifies visitors with a short-lived anonymous hash rather than a cookie and does not track people across websites. We do not use analytics to sell your personal information or to build advertising profiles.

Published websites load fonts from Google Fonts and, until a website owner replaces a template’s example images, pictures from Unsplash. A visitor’s browser connects to those services directly, so they receive the visitor’s IP address and browser details.

We share personal information only with trusted operators who process it on our behalf, under written agreements and appropriate safeguards. These fall into the following categories:

• Payment processing - our own subscription billing is processed by PayFast. If you use Commerce to sell products, you connect your own account with a payment provider (currently PayFast); that provider processes your customers’ payments directly, under your own agreement with it. If you also accept cash on delivery or on collection, those payments never pass through us. We store only encrypted payment provider credentials and never your customers’ card details.
• Email delivery - sends transactional emails (verification, billing, trial reminders, and service notices), which requires your name and email address. If you run a store, it also sends order confirmations and delivery or collection updates to your customers on your behalf, which requires their name and email address.
• Hosting, content delivery and security - runs the platform and your published websites, stores the images you upload, filters malicious traffic, and provides SSL certificates for your subdomains and connected custom domains.
• Database hosting - stores your account, website, and billing records.

For the current list of the specific providers we use in each category, see our Subprocessors page, and our Data Processing Information for how we process personal information on your behalf. We do not sell your personal information. We may disclose information where required by law or to protect our rights, users, or the public.

Some of our operators - such as our hosting, email delivery, and database providers - process personal information on servers located outside South Africa. Where this happens, we rely on the safeguards permitted under section 72 of POPIA, including contractual protections that require your information to receive a comparable level of protection to that provided under POPIA. Each provider’s location is noted on our Subprocessors page.

We retain personal information for as long as your account is active and as needed to provide the Service. When you close your account, we delete or anonymise personal information within a reasonable period, unless we are required to retain it for legal, accounting, or security purposes. For example, when an account or organisation is deleted, we keep a de-identified financial record of paid orders (amounts and order details, with the customer’s name, email, and phone number removed) as required for accounting purposes. We also keep the records we need to run the platform safely and fairly: payment records, abuse reports, an audit trail of administrative actions, and a one-way hash of the email address used to claim a free trial, so that deleting and re-registering an account does not give a second trial.

Under POPIA, you have the right to:

• Access the personal information we hold about you;
• Request correction or deletion of your personal information;
• Object to certain processing; and
• Lodge a complaint with the Information Regulator of South Africa.

For more on how we apply South African data-protection law, see our POPIA Compliance page. To exercise any of these rights, email us at privacy@delrity.com.

We use technical and organisational measures - including encryption in transit, hashed passwords, encrypted storage of payment credentials, and access controls - to protect personal information. A limited number of authorised Delrity staff can access account and organisation data to provide support, investigate abuse, or maintain security; sensitive access is logged in an internal audit trail. No system is completely secure, but we work continuously to safeguard your data. Learn more on our Security page.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

Questions about this policy or your personal information? Email privacy@delrity.com.