Privacy policy

Who we are

Sitebook is operated by Hybridio (Pty) Ltd, a company registered in South Africa. This policy explains how we handle personal information under the Protection of Personal Information Act (POPIA).

Two kinds of information

This distinction matters, because our obligations differ:

• Information about you, our subscriber. Your email address, your business and banking details for your invoices, and your subscription record. For this we are the responsible party.
• Information about your clients. The client names, contact details, site addresses, quotes, invoices and compliance records you enter. For this you are the responsible party and we are an operator processing it on your instruction. We do not use your client data for our own purposes.

What we collect and why

• Account information — your email address and password, to create and secure your account. Passwords are stored hashed; we never see them.
• Business information — your banking and payment details, so they can appear on the invoices you send.
• Billing information — your subscription tier, status and payment history. Card details are handled by our payment provider and are never stored by Sitebook.
• Records you create — clients, quotes, jobs, invoices and Certificate of Compliance records, to provide the service.
• Usage data — aggregate analytics about page visits, to understand which parts of the product get used.

Who we share it with

We do not sell personal information. We share it only with the service providers required to run Sitebook: our hosting and database provider, our payment provider for subscription billing, and our email provider for transactional email such as invoice reminders. Each processes data on our instruction.

Some of these providers process data outside South Africa. POPIA permits this where the recipient is subject to comparable data-protection rules.

How we protect it

Data is encrypted in transit. Every database table enforces row-level security, so an account can only read its own records — this is enforced by the database itself, not only by application code. Access to production systems is limited to people who need it.

How long we keep it

We keep your records for as long as your account exists. If your subscription lapses, your records remain readable rather than being deleted — Certificate of Compliance records in particular may be needed years later. If you ask us to delete your account, we will delete your data, subject to any records we must retain by law.

Your rights under POPIA

You may ask what personal information we hold about you, ask us to correct or delete it, object to processing, or complain to the Information Regulator. To exercise any of these, email us and we will respond.

Changes

If we change this policy we will update the date above and, for material changes, tell subscribers by email.

Contact

Privacy questions: privacy@sitebook.co.za