Transparent Data Protection

1. Data We Collect

What information we collect and how

2. How We Use Your Data

• To create and administer your account, projects, and CodeMax sites
• To process payments, issue invoices, and manage subscriptions/usage credits
• To provide customer support via tickets, live chat and WhatsApp
• To send service notifications (e.g. publish status, billing, security alerts)
• To detect, investigate and prevent fraud, abuse, and security incidents
• To improve our products through aggregated, anonymized usage analytics
• To send marketing communications, but only where you have opted in or as otherwise permitted by law — you can withdraw consent at any time (see Section 9)

3. Legal Basis for Processing

Where GDPR or equivalent frameworks apply, we rely on the following legal bases:

• Contract: processing necessary to deliver services you've purchased (hosting, CodeMax, development work)
• Consent: non-essential cookies, analytics where required, and marketing communications
• Legitimate interest: fraud prevention, service security, and core product analytics, balanced against your rights
• Legal obligation: tax, accounting, and regulatory record-keeping requirements in Zimbabwe and other applicable jurisdictions

4. Who We Share Data With

We do not sell your personal data. We share limited data only with the processors below, strictly to deliver our services, and under contractual confidentiality obligations.

Our self-hosted AI (Ollama) used by CodeMax and live chat runs on our own infrastructure — your prompts and generated content are not sent to any third-party AI provider.

Sub-processor changes: if we add or replace a sub-processor that materially changes how your data is processed, we will update this table and notify business clients with an active Data Processing Agreement (see Section 5) at least 14 days in advance, giving you the opportunity to object on reasonable data-protection grounds.

6. International Data Transfers

Some processors we use (e.g. Google Analytics, PayPal, Meta/WhatsApp) operate servers outside Zimbabwe, including in the United States and European Union. Where we transfer personal data internationally, we rely on the processor's applicable safeguards, which may include Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms recognized under GDPR, POPIA, and Zimbabwe's data protection framework. You may contact us for more information about the safeguards applicable to a specific transfer.

7. Security Measures

• TLS 1.2/1.3 encryption in transit for all production traffic
• Password hashing, JWT-based authentication, and role-based access control
• Rate limiting, connection limits, and Web Application Firewall-style protections at our edge (nginx)
• Database access restricted to internal services; no public database exposure
• Regular backups of production data
• Principle of least privilege for staff access to personal data

No system is 100% secure. We continuously work to improve our safeguards, but cannot guarantee absolute security of information transmitted over the internet.

8. Data Retention

• Account & project data: retained while your account is active, and for up to 90 days after closure to allow recovery, unless you request earlier deletion
• Billing & invoicing records: retained for 7 years to comply with Zimbabwean tax and accounting law
• Support tickets & chat logs: retained for 2 years for quality and dispute-resolution purposes
• Analytics data: retained per Google Analytics' default retention settings (currently up to 14 months for user-level data)
• Security/server logs: retained for up to 12 months
• Partner/DPA data: retained per the deletion/return terms agreed in the applicable Data Processing Agreement

9. Your Data Rights

Depending on your location, you may have some or all of the following rights under GDPR, POPIA, Zimbabwe's Cyber and Data Protection Act, or CCPA/CPRA. To exercise any right, email [email protected] with your request — we will respond within 30 days (or sooner where local law requires).

We will verify your identity before fulfilling a request (e.g. confirming the email associated with your account) to prevent unauthorized disclosure or deletion of someone else's data.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority — for Zimbabwe, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) Data Protection division; for the EU/UK, your national supervisory authority; for South Africa, the Information Regulator; for California, the California Privacy Protection Agency.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, this section supplements Section 9:

• Categories collected (last 12 months): identifiers, account/commercial information, internet/network activity, geolocation (approximate), and audiovisual or message content you submit to support channels
• Sources: directly from you, automatically via cookies/analytics, and from our service providers (e.g. payment processors)
• Business/commercial purpose: as described in Section 2
• Sale or sharing of personal information: we do not sell personal information for money. We do not knowingly "share" personal information for cross-context behavioral advertising as defined by the CPRA. If this changes, we will provide a clear "Do Not Sell or Share My Personal Information" mechanism before doing so.
• Sensitive personal information: we do not use sensitive personal information for purposes beyond what is necessary to provide the Services.
• Shine the Light: California residents may request information about disclosures of personal information to third parties for direct marketing purposes; we do not make such disclosures.

11. Cookie Policy

We use a cookie consent banner on first visit. Essential cookies are always active because the site cannot function without them; analytics and marketing cookies only load after you accept them. You can change your choice at any time by clearing the cookie_consent cookie or using the consent banner's "Manage Preferences" option.

12. Children's Privacy

Our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [email protected] and we will delete it promptly.

13. Data Breach Notification

If we become aware of a security incident that creates a risk to your rights and freedoms, we will notify affected individuals and, where required, the relevant supervisory authority, without undue delay and in line with applicable legal timelines (e.g. 72 hours under GDPR where feasible). Business partners with an active Data Processing Agreement will be notified per the timelines specified in that agreement.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be announced via email or an in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.