Privacy Policy

This notice is given in terms of section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). We have written it to be complete rather than short: every kind of information the application stores is listed here, with the reason and how long it is kept. If something is not described in this policy, we do not collect it.

Contents

1. Who we are and what this policy covers
2. Summary of what we hold
3. Account information
4. Purchases and learning
5. Client portal information
6. Google Search Console and Google Analytics
7. The portal assistant and automated suggestions
8. Staff access to your information
9. Where we get information from
10. Why we process it, and on what lawful basis
11. Who else processes it
12. Sending information outside South Africa
13. How long we keep it
14. How we protect it
15. If there is a security breach
16. Cookies and browser storage
17. Marketing
18. Automated decisions
19. Children
20. Your rights and how to use them
21. Complaining to the Regulator
22. Changes to this policy
23. Contact

1. Who we are and what this policy covers

The responsible party is Urban Catalyst (Pty) Ltd (registration number 2018/306125/07), a company incorporated in South Africa, of 21 Somerset Road, De Waterkant, Cape Town, South Africa, trading as Urban Catalyst("we", "us", "our").

This policy covers Urban Catalyst Clients, the web application at client.urbancatalyst.co.za, which has two parts:

• the marketplace and academy, where anyone can browse, and account holders can obtain and follow courses, templates, packs and guides; and
• the client portal, used by businesses we build websites for, to follow their projects, see invoices, invite colleagues, and see how their website is performing in Google Search and Google Analytics.

It does not cover our studio website at https://urbancatalyst.co.za, or any website we build for a client. A client's own website is governed by that client's own privacy policy.

Email is the way to reach us about anything in this policy, including to exercise any right in section 20. It is monitored, and we answer as soon as we reasonably can.

2. Summary of what we hold

The detail follows in sections 3 to 8. In short:

We do not use advertising trackers, we do not run third party analytics on this site, we never sell personal information, and we do not collect special personal information as defined in section 26 of POPIA, such as health, religion or biometric data.

3. Account information

When you create an account we hold:

• your name, email address and profile photograph if you have one;
• whether you signed up with a password or with Google, and an identifier from that provider;
• whether your account is a learner, client or staff account;
• your marketing preference and when you gave it, and the date and version of the terms and privacy policy you accepted;
• if you ask us to delete your account, the date you asked and the date deletion is due;
• how you have arranged your dashboard: which cards you chose to show, and their position and size. This is saved to your account, not your browser, so it follows you between devices;
• when the account was created and last updated.

We never see or store your password. If you sign in with a password it is held by Google's Firebase Authentication service, not by us. If you sign in with Google, Google tells us your name, email address and profile photograph, and nothing else from your Google account.

Signing in with Google is a different thing from connecting Google Search Console in the portal. Signing in gives us your basic profile only. Connecting Search Console is a separate, optional step with its own consent screen, covered in section 6.

4. Purchases and learning

4.1 Purchases

• what you obtained, the price, the date, your order and invoice records and the payment reference;
• the name and email address on your invoice, and totals of what you have spent and how many orders you have placed;
• a record of which products you are entitled to use.

We never receive your card or banking details. Payment is by electronic funds transfer directly through your own bank. No card data enters our systems at any point.

4.2 Learning

• which courses you own, which lessons you have completed, how far through each video you are, and when you last opened a course.

4.3 Downloads

Paid files are never publicly reachable. When you download one, we check you own it and then issue a private link that stops working after fifteen minutes. We do not keep a record of each download.

4.4 Course video

Course video is streamed by Mux, which receives the playback request and technical data such as your IP address, device and player performance, so that it can deliver the video. We receive your viewing position so we can resume where you left off.

5. Client portal information

If your business is a client of our studio, we also hold:

5.1 Your company

• company name, contact name, contact email address and telephone number;
• which accounts belong to the company, which of them is the owner, and whether the company is invited, active or archived;
• if you were invited by email, the invitation and when it was sent, accepted and due to expire.

5.2 Projects

• each project's name, description, type, stages, current stage, progress, value and currency;
• billing records, the banking reference for payment, and the invoice linked to the project;
• for a retainer, the hours included each month and the hours used;
• the updates we post to you about the project.

5.3 Project requests

When you ask us for new work through the portal, we hold what you told us: the services you are interested in, your brief, your timeline and budget range if you gave them, when you asked, and our response, including the reason if we declined.

5.4 Colleagues you invite

The owner of a company's portal can invite colleagues by email. For each invitation we hold the colleague's email address, the company, who sent it, when, when it expires (fourteen days after sending), and whether and by whom it was accepted. We send the invitation by email.

Everyone in a company's portal sees the same company information, including projects, invoices, payment details and website statistics. If you invite someone, make sure they should see it. The owner can withdraw an invitation or remove a colleague at any time, and their access ends immediately.

5.5 Results you ask us to count

If you set up results tracking, we hold the goals and journeys you define: the Google Analytics event names you chose, your labels for them, and which one leads. We then store daily counts of those events, described in section 6.

5.6 Your arrangement of the portal

Which insight cards you have dismissed for each website is kept in your browser (section 16). Your dashboard arrangement is kept on your account (section 3).

6. Google Search Console and Google Analytics

The client portal can show you how your own website is performing. To do that it reads data from Google products you already use, using your own Google account, with your permission. This section explains exactly what that involves.

6.1 It is optional, and you start it

Nothing happens until you choose "Connect Google Search Console" in the portal and complete Google's own consent screen. If you never connect an account, we never receive any of this data, and the rest of the portal works without it. Our staff can also set up a website for you, but they still cannot read its Search Console or Analytics data unless a Google account with access to it has granted permission.

6.2 The permissions we ask for, and why

We ask for the narrowest permissions that will do the job. Both are read only. We cannot change anything in your Google account, and we do not ask for permission to.

Google's consent screen lets you untick an individual permission. If you decline Search Console access we cannot set the site up at all and tell you so. If you decline Analytics access everything else still works; you simply do not get the visitor figures.

6.3 Choosing which websites

After you approve, Google tells us which Search Console properties your account can see, and you choose which of them to connect. For up to fifteen minutes while you choose, we hold that list and the access credential on a server-only record. It is deleted as soon as you choose, and properties you do not pick are never read.

6.4 What we retrieve and store

Once a night, for each website you have connected, we retrieve and store:

This is aggregated statistical data about a website. It is not a list of the individuals who visited it, and we neither receive nor store the identity of your website's visitors. Google removes rare search terms that could identify a person before it gives Search Console data to anyone, us included.

6.5 What we do with it

We use it for one purpose: to show you, inside your own client portal, how your website is doing, and to work out recommendations for improving it. Specifically, it is used to:

• draw the charts, tables and figures in the portal and dashboard;
• write the plain-language observations shown at the top of Insights, such as a page that has slowed down;
• rank the growth opportunities on the Growth page, and generate the written page suggestions described in section 7;
• answer questions you ask the portal assistant; and
• let our staff see what you see when supporting you, as described in section 8.

We do not use it for advertising, we do not sell it, we do not share it with data brokers, and we do not use it to train any machine learning or AI model. We do not use it to decide anything about you, and we do not combine it with data from other clients.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.6 The access credential

When you connect an account, Google gives us a long-lived credential so the nightly retrieval can run without asking you each time. It is held on a server-side record that the browser is denied entirely, and it is only ever used to make the read-only requests described above. We also store the email address of the Google account that granted access, and when, so the portal can tell you which account a website is connected through.

6.7 Pausing, disconnecting and revoking

• Pausing a website in the portal stops the nightly retrieval. The figures already collected stay visible, dated, until you resume or disconnect.
• Disconnecting a website deletes its stored statistics and daily history, and tells Google to revoke the credential unless another of your connected websites still relies on the same one.
• Revoking our access yourself at myaccount.google.com/permissions stops the retrieval immediately. The portal notices on the next run, shows a reconnect notice, and stops trying.

7. The portal assistant and automated suggestions

7.1 The assistant

The client portal includes an assistant you can ask about your website figures in plain language.

• What is sent. Your question, the conversation so far in that visit, and a summary of the website statistics needed to answer it: totals, top search terms and pages, speed results, growth opportunities and the like. Your name, email address, invoices and payment details are not sent.
• Who answers. The request goes to OpenRouter, which routes it to the AI model provider that produces the answer, currently Anthropic. Both are listed in section 11.
• Web search. Where you ask something that needs current information, the assistant may run a web search to answer, through OpenRouter. The search is based on your question.
• What we keep. For each question and answer we store your account identifier, which website and period it concerned, the question, the answer, whether a web search was used, the model used, and measurements such as length and time taken.
• Why we keep it. So that our team can check the assistant is answering accurately and safely. The portal tells you this on screen, above every conversation. Do not put information into it that you would not want our team to read.
• Your browser keeps nothing. The conversation itself is not saved in your browser and is gone when you leave the page.
• Limits. To keep the service fair we count how many questions each person asks per day, and briefly count requests per minute by account and by IP address. The daily count is stored; the per-minute counts are held in memory only and never written down.

7.2 Growth suggestions

Each night we send the search terms and page addresses from your Search Console data, and nothing about you personally, to OpenRouter and the model provider behind it, which write suggestions for pages worth creating or improving. We store the suggestions and a fingerprint of the search terms they were written from, so the same suggestions are not regenerated needlessly.

7.3 What neither of these does

Neither the assistant nor the suggestions makes a decision about you. They comment on a website's statistics, and they can be wrong. We do not use any of this material to train an AI model ourselves.

8. Staff access to your information

A small number of our staff have administrative access. They use it to run the service: to set up clients and projects, post project updates, confirm payments and support you.

To support a client, a staff member can open that client's portal and see exactly what the client sees. While they do:

• the portal is read only for them. They cannot connect or disconnect a website, request a project, change your settings or act in your name;
• a banner shows them whose portal they are in, and the access ends automatically after eight hours;
• every start and end of such access is recorded, with the staff member's identity, the client and the time. The record cannot be edited from the application.

Staff access is checked against the staff member's current permissions on every use, so withdrawn access stops working at once. Staff also read assistant conversations for the quality review in section 7.1.

9. Where we get information from

• From you, for almost everything: when you sign up, buy, learn, request a project, invite a colleague or ask the assistant a question.
• From Google, when you sign in with Google (your name, email address and photograph), and when you connect Search Console or Analytics (section 6).
• From a colleague, who gives us your email address when they invite you into their company's portal.
• From our staff, who enter your company and project details when setting you up as a client.
• From your browser, which sends your IP address and basic request details with every visit.

10. Why we process it, and on what lawful basis

Providing your name and email address is voluntary, but we cannot create an account, sell you anything, give you access to what you have bought, or issue a valid invoice without them. You can browse the public parts of this site without giving us anything.

11. Who else processes it

We use the following operators. Each processes personal information only on our instructions, under a written agreement as section 21 of POPIA requires.

We also disclose information:

• to the other members of your company's portal, as section 5.4 explains;
• where the law requires it, or to protect our legal rights;
• to our professional advisers, under duties of confidentiality;
• to a purchaser if the business is sold, who would be bound by this policy.

We do not sell personal information, and we do not share it with advertisers or data brokers.

12. Sending information outside South Africa

Your information is stored and processed outside South Africa. That is a transfer under section 72 of POPIA, and we tell you about it as section 18(1)(g) requires.

• Netherlands and European Union. Our database, files, scheduled jobs and email delivery are hosted in the EU, where the General Data Protection Regulation applies. It provides a level of protection substantially similar to POPIA, so the transfer is made under section 72(1)(a).
• United States.Course video, AI request routing, the AI model provider and parts of Google's own infrastructure are in the United States, which does not have a general data protection law comparable to POPIA. Those transfers are made under binding agreements with the providers imposing obligations substantially similar to POPIA's conditions for lawful processing, including restrictions on onward transfer, again under section 72(1)(a).
• Transfers are also necessary for the performance of our contract with you under section 72(1)(c), since the service cannot be delivered without them.

13. How long we keep it

13.1 When you delete your account

You can request deletion from your account settings. What then happens:

1. You are signed out everywhere at once, and marketing email stops.
2. For thirty days nothing else changes, so a mistaken request can be reversed. Email us within that time to cancel it.
3. After thirty days your sign-in account is deleted; your profile is anonymised; your name and email are removed from your orders and invoices; and your assistant conversations, usage count, course progress and any pending website connection are deleted.

Company records in section 5 are not removed when one person leaves, because they belong to the business. To close a company's portal entirely, the owner should email us.

Section 14 of POPIA does not allow us to keep records longer than necessary, but expressly permits retention required by law. Tax records must generally be kept for five years and company records for seven, with longer where a return is outstanding or an audit or dispute is unresolved.

14. How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. In practice we:

• serve the entire site over encrypted connections;
• store everything in Google Cloud, which encrypts data at rest;
• keep your session in a cookie that cannot be read by JavaScript, and verify it on the server on every request to a protected page;
• enforce access rules at the database level, so one account cannot read another account's orders, invoices, progress, project records or website statistics, and the browser cannot read Google credentials, assistant logs, invitations or staff access records at all;
• check on the server, for every portal request, that the website asked about belongs to the person asking;
• protect the Google connection against request forgery with a single-use token;
• serve paid downloads only through short-lived links issued after we have checked that you own the product;
• limit request rates, to slow down abuse and automated attacks;
• restrict administrative access to staff who need it, record their access to client portals, and check that such access has not been withdrawn each time it is used;
• rely on our hosting providers for physical and network security;
• review these measures periodically and update them as risks change, as section 19(2) requires.

We keep the IP address and basic details of each request in our hosting provider's logs for a short period, for security and diagnosis.

No system is perfectly secure. Please use a strong, unique password and tell us immediately if you think your account has been accessed without your permission.

15. If there is a security breach

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify both the Information Regulator and you, as soon as reasonably possible after discovering it. We will tell you what happened, the likely consequences, what we are doing about it, and what you can do to protect yourself. Where a Google credential may be affected, we will also revoke it.

16. Cookies and browser storage

We use no advertising or analytics cookies, and nothing here tracks you across other websites. What we do use:

16.1 Cookies

16.2 Browser storage

Some small preferences are kept in your own browser's storage. They never leave your device and we cannot read them.

All of these are necessary for the site to work as you would expect. Blocking them will sign you out or reset your preferences, and may break parts of the site. You can clear them at any time from your browser settings.

17. Marketing

We send marketing email only if you have opted in. Transactional messages such as receipts, invoices, security notices, team invitations and messages about your project are not marketing and are always sent, because we need them to deliver the service.

You can withdraw consent at any time from your account settings or by using the unsubscribe link in any marketing email. Withdrawal is free and takes effect immediately. Every marketing message identifies us and tells you how to opt out, as section 69(4) of POPIA and section 45 of ECTA require. If you ask, we will tell you where we obtained your details.

18. Automated decisions

We do not make any decision about you based solely on automated processing that has legal consequences for you, as contemplated by section 71 of POPIA. Whether an order is fulfilled, a project request is accepted or an account is suspended is decided by a person. The insights, rankings and suggestions in the portal are automated, but they are observations about a website, not decisions about a person.

19. Children

The site is not intended for anyone under 18 and we do not knowingly collect information about children. If you believe a child has given us personal information, contact us and we will delete it.

20. Your rights and how to use them

Under POPIA you have the right to:

• be told whether we hold information about you, and to receive a copy of it (sections 23 and 24);
• have it corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
• object to processing based on legitimate interests, on reasonable grounds (section 11(3));
• withdraw consent at any time, where processing is based on consent;
• object to direct marketing at any time (section 69);
• complain to the Information Regulator (section 74);
• claim damages through a civil court under section 99.

Much of this you can do yourself, straight away:

For anything else, including a copy of what we hold, email [email protected]. We respond as soon as we reasonably can. A formal access request under the Promotion of Access to Information Act must be made on Form 2 and a fee may apply. We may ask you to verify your identity first, so that we do not disclose your information to someone else.

21. Complaining to the Regulator

If you are not satisfied with how we have handled your information, you may complain to:

We would rather resolve it directly, so please contact us first if you are willing to.

22. Changes to this policy

We update this policy whenever the application starts handling information in a new way. The version and effective date are shown at the top. Where a change materially affects your rights we will tell you by email or by notice on the site before it takes effect, and where the change relies on your consent, such as a new Google permission, we will ask for it again.

23. Contact

Urban Catalyst (Pty) Ltd
21 Somerset Road, De Waterkant, Cape Town, South Africa
[email protected]

See also our Terms of Service.