Privacy Policy (POPIA)

Last Updated: 28 October 2026

GrowthStart (Pty) Ltd ("GrowthStart", "we", "us", "our") respects your privacy and protects your personal information as the Protection of Personal Information Act 4 of 2013 (POPIA) requires. This policy explains what we collect, why, how we use it, who we share it with and the rights you have. It covers our website, our consulting services, and our products: SiteHub (managed websites), ContentEngine (automated content publishing) and GrowDash (the customer dashboard).

1. Who we are

GrowthStart (Pty) Ltd, registration number 2016/178338/07, Cape Town, 7441, is the responsible party for the personal information described in this policy. Our Information Officer can be reached at [email protected] for any privacy question, access request or complaint.

2. Information we collect

• Enquiries and consultations: name, email, phone number, business name and the message you send through our forms.
• SiteHub customers: account details (name, email, login), the domains you use, and the content you add to your site (pages, articles, images). Because we host and run your site, we can access this content to deliver the service: updates, backups and security.
• ContentEngine customers: the briefs and topics you give us, the articles we write, and the connection that lets ContentEngine publish to your SiteHub site.
• GrowDash: your login, billing and subscription status, credit balance and the support requests you raise.
• Billing: the details needed to charge you. We do not store full card numbers: payment is handled by our payment provider.
• Mailing and newsletters: if you subscribe to one of our newsletters, your email address, name (if given), and the date and wording of your consent.
• Website usage: standard technical data collected automatically when you browse (IP address, browser type, pages visited), through cookies and similar technologies.

3. Why we process it

We process personal information only where we have a valid basis under POPIA:

• Contract: to provide the services you signed up for, including billing and support.
• Consent: where you send an enquiry or subscribe to a newsletter, and for marketing, which you can withdraw at any time.
• Legitimate interest: to keep our platform secure and reliable and to improve our services.
• Legal obligation: where we must keep records, for example for tax and accounting.

4. How we use it

• To answer enquiries and arrange consultations.
• To set up, run and support your SiteHub and ContentEngine services.
• To process payments, send invoices and manage credits.
• To send service messages (billing notices, maintenance, security alerts), which are needed for the service itself.
• To send marketing only where you opted in, with an easy way to opt out. Every newsletter has an unsubscribe link.
• To meet our legal and regulatory obligations.

5. Who we share it with

We do not sell or rent personal information. We share it, under written agreements, with the operators (service providers) that help us deliver the services, and we give them only what they need:

• Hetzner hosts our servers, in the European Union.
• Google provides AI services that process data for some SiteHub and ContentEngine features, such as drafting and improving text. We send only what is needed for the task, never passwords or payment details.
• Cloudflare provides DNS, security and spam protection.
• SendGrid delivers email, including newsletters and notifications.
• Our payment provider processes payments.
• Support and business tools that we use to run the company.

We may also disclose information where the law requires it.

6. Where your information is stored

Our servers are hosted at Hetzner in the European Union, where the General Data Protection Regulation (GDPR) applies, which gives your information protection comparable to POPIA. Some providers, such as Google, Cloudflare and SendGrid, may also process information in other countries, including the United States. Whenever personal information leaves South Africa we make sure it is protected as POPIA section 72 requires: the provider is subject to comparable rules or contractually bound to protect it, you have consented, or the transfer is needed to carry out our agreement with you.

7. Your own customers' information

For the personal information of your own customers and website visitors that you collect through a site we host for you, including forms and newsletter sign-ups, you are the responsible party and we act as your operator. We process that information only on your instructions and keep it secure.

8. How long we keep it

We keep personal information for as long as your account is active and for a reasonable period afterwards to meet legal, accounting or dispute requirements: about 5 years for tax and accounting records, and 24 months for enquiries from people who do not become customers. If you cancel SiteHub or ContentEngine, your site and backups are kept for 30 days and then permanently deleted (see our Cancellations and Refunds policy). Newsletter details are deleted when you unsubscribe and ask us to erase them.

9. Cookies

Our website uses cookies to remember your preferences and to understand how visitors use the site. You can control or disable cookies in your browser settings; this may affect some features.

10. Security

We use access controls, encrypted connections, backups and monitoring to protect personal information from loss, unauthorised access and misuse. No system is perfectly secure. If a breach puts your information at risk, we notify you and the Information Regulator as soon as reasonably possible, as POPIA requires.

11. Your rights

You can ask us to:

• confirm whether we hold information about you and give you a copy;
• correct information that is wrong or out of date;
• delete your information, subject to our legal retention duties;
• stop using it, and you can object to processing that rests on our legitimate interest;
• stop relying on your consent, at any time.

Email [email protected]; we reply within 30 days. To ask for access to our records, see our PAIA Manual.

If we have not resolved your concern, you may complain to the Information Regulator: [email protected], inforegulator.org.za.

Data deletion

You can ask us at any time to delete your account and the personal information we hold about you.

How to ask: email [email protected] from the address on your account, or use the contact form on this website. We may ask you to confirm it is you before we delete anything. We reply within 30 days.

What we delete: your GrowDash account, your profile and contact details, your SiteHub site and its content, your ContentEngine settings and articles, your mailing list and your support history. If you signed in with, or connected, a Facebook or LinkedIn account, the details we received from it (such as your name, email address and profile picture) are deleted too. Your site and its backups are permanently deleted within 30 days of cancellation; the rest is deleted within 30 days of your request.

What we keep: records we must keep by law or need to settle a dispute, mainly invoices and payment records, for about 5 years for tax and accounting purposes. These are kept only for that purpose and then deleted. Unused top-up credits are lost when the account is deleted.

The step-by-step instructions are on our Data Deletion page. To end a subscription before you delete your account, see Cancellations and Refunds.

12. Children

Our services are for businesses and people over 18. We do not knowingly collect personal information from children.

14. Changes

We may update this policy when our services or the law change. The "Last Updated" date above always shows the latest revision.

15. Contact

[email protected], GrowthStart (Pty) Ltd, Cape Town, 7441, South Africa.