Privacy Policy

Last updated: 13 October 2026

This page explains what personal information Appetite Technology (Pty) Ltd, trading as Appetite Host ("we", "us"), collects, why we collect it, who we share it with, and your rights under the Protection of Personal Information Act, 2013 (POPIA). It is part of our agreement with you. Short version: we collect only what we need to build and run your website, we never sell your details, and you can ask us to correct or delete them at any time.

1. Who is responsible

The responsible party under POPIA is Appetite Technology (Pty) Ltd (registration number 2023/849612/07), trading as Appetite Host, of 350 Parkstation Road, Greenwood Park, Durban, 4051, South Africa. For anything in this policy, email support@appetitehost.co.za or phone +27 31 012 5361 / +27 21 330 5844.

Our Information Officer, the person answerable for how we handle your information, is Wesley Sing, our director, at the address above and on support@appetitehost.co.za. Write to him directly about anything in this policy; it reaches a person, not a queue. He is registered with the Information Regulator under reference 2026-066601.

2. What we collect and why

• What you tell Naya: your business name, what you do, your area, your business phone and email. Why: this becomes the content of your website. It appears publicly on your site because that is its purpose.
• Your existing website, if you give us its address: Naya reads its public pages and keeps the text and contact details she finds there, so she can build on what you already have.
• Your Google listing, if you want your Google reviews shown: we send your business name and area to Google to find your listing, and keep only Google's reference number for it.
• Your email address: to save your website preview, send you its link, sign you in (we use email links, never passwords), send receipts, and tell you about renewals. Why: we cannot deliver the service without reaching you.
• Your name, address and business details at checkout: for your invoice and to register your web address in your name, as .za registry rules require. Some of these details are published in the registry's public records (see section 6).
• Details you add in your account, if you choose to: your name, role, phone numbers and profile picture, and your business's registered name, CIPC and VAT numbers, address, opening hours and social pages. Why: so your account shows them and, when you ask, so your website and invoices can use them. Your profile picture is kept with your website's photos, at an address we do not publish.
• Payment and transaction data, handled by Paystack, our payment provider. Card details go directly to them; we never see or store your card number. We keep a secure payment reference so monthly payments work, plus a record of what you paid and when, as tax and company law require.
• Basic technical information: a device identifier while you build your preview (to prevent abuse of the free preview), and standard technical logs such as IP address and pages visited (to keep the service secure and working). None of this is used to track you around the web, and we do not run advertising trackers.
• Your conversations with Naya, kept so Naya remembers your business and so you can pick up where you left off. See section 4 for how these are processed.
• Support messages: if you email us, we keep the conversation so we can help you properly next time.

The microphone button. If you speak to Naya instead of typing, your own web browser turns your speech into text and only the text reaches us. We never receive your voice. Some browsers, such as Google Chrome, do that conversion on their maker's computers, under that company's own privacy terms.

What you must give us. We need your email address to build a preview, and your name and address to register your web address in your name. Without them we cannot provide the service. Everything else is up to you.

3. Our legal grounds

POPIA requires a lawful basis for every use of your information. Ours are, in plain terms:

• Performing our contract with you: building your site, registering your web address, sending receipts and renewal notices.
• Legal obligation: keeping invoices and records for tax and company law, and giving the .za registry accurate registrant details.
• Legitimate interest: keeping the service secure and preventing abuse of the free preview.
• Consent: anything optional, such as our newsletter. Consent can be withdrawn at any time, and every marketing email has an unsubscribe link. We never make the service conditional on marketing consent.

4. AI processing

Naya, our assistant, is powered by Anthropic's Claude models. What you type to Naya is sent to Anthropic to generate her replies and your website content. Anthropic processes it as our service provider and does not use it to train their models. We never send Naya your payment details; she does not have them.

Naya's voice. Naya can read her messages aloud. When her voice is on, the words she writes to you are sent to ElevenLabs, which turns them into speech as our service provider. Her messages can repeat details you gave her, such as your business name. What you type or say to her is not sent to ElevenLabs, and neither is your voice. The speaker button at the top of the chat turns her voice off.

Naya drafts your website from what you tell her. You always see and approve the result before it goes live, and you can change anything.

5. Who we share it with

Only the service providers who make your website work, each receiving only what it needs:

• Vercel and Cloudflare, which serve and protect websites. Vercel also counts visits to our own website, without cookies (see section 9).
• Supabase, our database, where your account and site content live.
• Anthropic, which powers Naya (see section 4).
• ElevenLabs, which reads Naya's messages aloud when her voice is on (see section 4).
• Resend, which delivers our emails to you.
• Paystack, which takes your payment and stores your card details securely.
• Google: finding your Google listing and showing your reviews and map, if you ask for them; and Google Analytics on our own website, only if you accept (see section 9).
• Slack, where our own team receives alerts that need a person, such as a new order (with your business name or email) or a web address that needs attention.
• Our registrar partner (DiaMatrix CC) and the ZA Central Registry, which register your web address in your name, as registry rules require.

We do not sell or rent personal information to anyone, full stop. We only disclose information beyond this list if the law requires it, for example a court order, and then only what is legally required.

6. Public registry records

When we register a web address in your name, the .za registry keeps a public record of the registration, which can include the registrant's name and contact details. This is how web addresses work and is required by registry policy; it is what proves the address is yours. Our Web Address Agreement explains this in full.

7. Where your information lives

Some of our providers store or process data outside South Africa, mainly in the European Union and the United States. We only use providers that are bound by their own privacy laws or by contract terms giving your information substantially similar protection to POPIA, as section 72 of POPIA allows.

8. How long we keep it

• Previews that never become a purchase are deleted automatically, about five weeks after they were started.
• Customer information is kept while you are a customer, so the service works and Naya remembers your business.
• Messages your website visitors send you are kept for 12 months, then deleted (see section 9 of our Terms).
• After you leave, we keep only what tax and company law require (invoices and transaction records, for up to seven years), then delete the rest.
• If you ask us to delete your information sooner, we delete everything the law does not require us to keep.

9. Cookies

We use what the service needs to work: a session cookie so you stay signed in, and a device identifier while you build your free preview. These are always on, because the site cannot work without them.

We count visits to appetitehost.co.za with Vercel Web Analytics. It sets no cookies and stores nothing on your device. We see totals such as which pages were visited, which website sent visitors to us, roughly which country they are in and what kind of device they used. It does not tell us who you are, and our customers' websites do not carry it.

With your permission, and only then, we also use Google Analytics on appetitehost.co.za to count visits and see which pages help people. If you tap “Accept” on our cookie notice, Google sets cookies (named _ga) that tell it whether you have visited before. We see totals such as which pages were read, roughly which area visitors are in, what device they used, and how many people started building, gave their email or paid. Analytics does not tell us who you are, and we do not use it for advertising. If you tap “No thanks”, Google Analytics does not load at all.

Changed your mind? Change your cookie choice.

10. If you visit one of our customers' websites

Each website we build belongs to the business it is about, and that business is responsible for the information you give it. We run the website for them. If you send a message or ask for a quote through the form on their website, we pass it to that business and keep it for 12 months on their behalf, then delete it. We use it for nothing else.

We count how many times each page of a customer's website is opened, so the business can see its visitor numbers. No cookies are used and nothing about you is kept: only the number. Your IP address is used, scrambled and only for an hour, to stop the count being inflated.

Our customers' websites do not carry advertising trackers. A business may choose to add its own Google Analytics; if it has, the website asks you first, and nothing from Google Analytics loads unless you say yes. The websites load their lettering from Google Fonts, which means your browser contacts Google; a map loads from Google only if you tap to show it, and Google reviews, where shown, load from Google.

11. Direct marketing

If you are a customer, we email you about your own website, receipts and renewals. We may also occasionally tell you about something new we have built that is relevant to you, unless you ticked “Don't send me occasional news” at checkout. Every one of those has an unsubscribe link, and using it never affects your service: you still get the messages you need, like receipts and renewal notices.

If you are not a customer, we will not send you electronic marketing unless you asked us to. That is section 69 of POPIA and we treat it as a floor, not a target. We do not buy contact lists, and we never pass yours to anyone who would.

You can ask for our tips and news by giving us your email address in the form at the bottom of our home page. We first email that address a link and add you only once you press the button it leads to, so nobody can sign you up but you. We keep the address, the wording you agreed to, when and from which internet address you asked and confirmed, and, if you leave, when you left. Every one of those emails has a link that stops them at once, without signing in or giving a reason. We keep a record that you unsubscribed so that we do not email you again by mistake.

12. Decisions made by machine

Naya uses AI to write and assemble your website, but nothing she does decides anything about you: no automated system of ours judges your creditworthiness, approves or refuses you as a customer, or produces any legal consequence for you. Every meaningful decision about your account is made by a person. You can ask for a human to look at anything.

13. Your rights

Under POPIA you may, at any time and free of charge:

• Access: ask us what personal information we hold about you.
• Correction: ask us to fix anything that is wrong or out of date.
• Deletion: ask us to delete your information (except what a law requires us to keep, such as invoices).
• Objection: object to a use of your information, including any marketing, which we will stop immediately.
• A copy of your content: ask for your website content and details in a usable format. It is your business and your content.
• Complaint: complain to the Information Regulator of South Africa if you believe we have mishandled your information. You do not have to come to us first, though we would like the chance to put it right. The Regulator is at JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001, on POPIAComplaints@inforegulator.org.za, and at inforegulator.org.za.

Email support@appetitehost.co.za to exercise any of these. We respond within a reasonable time, normally a few days, and we may first verify that the request really comes from you.

14. Children

Appetite Host is a service for business owners and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, email us and we will delete it.

15. Security

Your information is protected with encryption in transit, access controls, and systems that can only reach what they need. We review our safeguards regularly. If we ever discover a breach that affects you, we will notify you and the Information Regulator as POPIA requires.

16. Changes to this policy

If we change this policy we will post the new version here with a new date, and email you about meaningful changes before they take effect.

17. Contact us

Appetite Technology (Pty) Ltd, trading as Appetite Host
Registration number: 2023/849612/07
350 Parkstation Road, Greenwood Park, Durban, 4051, South Africa
Phone: +27 31 012 5361 / +27 21 330 5844
Email: support@appetitehost.co.za
Information Officer: Wesley Sing (Information Regulator reference 2026-066601)