Privacy Policy

Last updated: [DATE — set when this policy is confirmed and published]

Draft notice: this policy is a working draft prepared to cover the personal information this site actually collects and processes. It has not yet been reviewed by a lawyer and should be before this site takes real client data or payments. Bracketed items marked [TBD] need real information filled in before publishing.

Build Your Mould ("we", "us", "our") is operated by BUILD YOUR MOULD (PTY) LTD (registration number 2026/598651/07), registered at 83 Chattan Road, Glenferness, Midrand, 2191, South Africa. This policy explains what personal information we collect through buildyourmould.co.za, why we collect it, and what rights you have over it, in line with the Protection of Personal Information Act, 2013 ("POPIA").

Who to contact about your information

Kai Fabry is the Information Officer responsible for this site's compliance with POPIA, registered with the Information Regulator as required under section 55(2) of POPIA. For any request, question, or complaint about your personal information, contact: admin@buildyourmould.co.za or by post to the registered address above. See also our PAIA Manual for how to formally request access to records we hold.

What we collect

Brief submissions: your name, email address, and the business details you type into the brief form.
Uploaded files: any logo, photo, brochure, or flyer you attach — used only to inform the design of your site.
Account details: if you create an account after approving your draft, a password (stored as a salted hash, never in plain text) and your email.
Communications: feedback, change requests, and messages you send us about your project.
Payment information: we do not collect or store your card or bank details ourselves — deposits and final payments are processed directly by PayFast, a licensed South African payment gateway. We retain a record that a payment was made and its amount, not your payment credentials.
Technical data: standard server logs (IP address, browser type, timestamps) generated by normal web hosting operation.

Why we collect it

To generate, review, and deliver the website you've requested.
To communicate with you about your project, including sending your private review link and account-related emails.
To process payment for the service via PayFast.
To provide the ongoing care plan you've subscribed to, where applicable.

We do not sell your personal information, and we do not use it for advertising or marketing to third parties.

Who we share it with

Your information is shared only with the service providers ("operators" under POPIA) that make the service work, strictly for that purpose:

Anthropic (Claude API) — your brief text and any uploaded files are sent to Anthropic to generate your site design. See Anthropic's own privacy policy for how they handle API data.
Resend — used to send transactional emails (review links, account verification codes).
PayFast — processes your deposit and final payment directly; we never see your card/bank details.
Netlify — hosts your finished site if you choose our managed hosting option.

We do not share your information with any other third party, and none of the above are permitted to use your data for their own purposes beyond providing the service to us.

How long we keep it

We keep project-related information for as long as your site and care plan are active, and for a reasonable period afterward for record-keeping and legal purposes [TBD — confirm a specific retention period, e.g. 5 years after the relationship ends]. You can request earlier deletion — see "Your rights" below.

Security

Passwords are stored as salted cryptographic hashes, never in plain text. Account access requires both a password and a one-time code sent to your email (two-factor authentication). Payment is handled entirely by PayFast's own secure systems — we never receive or store your card or banking details.

Your rights under POPIA

You have the right to:

Ask what personal information we hold about you, and request a copy of it.
Ask us to correct inaccurate or outdated information.
Ask us to delete your personal information, subject to any legal obligation we have to retain it.
Object to how we process your information, or withdraw consent where processing is based on consent.
Lodge a complaint with the Information Regulator (South Africa) if you believe your information has been mishandled — inforegulator.org.za.

To exercise any of these rights, contact us using the details above.

Children's information

This service is intended for business owners and is not directed at children. We do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy as the service changes. Material changes will be reflected by updating the "last updated" date above.