Privacy policy

UpScaleWeb is run by Bernard Botes, trading as UpScaleWeb, a sole proprietor based in Cape Town, South Africa. We build and look after websites. For anything in this policy, write to hello@upscaleweb.co.

This policy covers our own website at upscaleweb.co, the client portal at admin.upscaleweb.co, and the emails we exchange with you. It also explains, in the last section, what happens to visitor data on the client websites we host.

The form on our homepage asks for your name, your email address, a message about what you have in mind and, if you choose to add them, links to your website or social pages. We use these to answer you and, if you go ahead, to build your site. The legal basis is the steps you ask us to take before a contract (and our legitimate interest in answering people who write to us).

The form is delivered to our inbox by email. Nothing from it is stored in a database on our side; it lives in our mailbox, and we delete it within 12 months if we do not end up working together.

To keep bots out, the form carries a signed token, a hidden field no person fills in, and a per-address rate limit. For the rate limit we keep your IP address for ten minutes and then delete it.

Our homepage sets no cookies and runs no analytics or advertising scripts. The fonts are served from our own domain, so no request goes to Google when the page loads.

Our hosting provider keeps standard server logs (IP address, time, page requested, browser type) to run the service and defend it against abuse. These are kept for a short period and are not used to identify you.

To build and run your website we keep your business details (name, address, phone, opening hours and what you tell us about your services), your contact details, your domain settings, the versions of your site, and the billing records the law requires. The legal basis is the contract between us.

You sign in to the client portal (https://admin.upscaleweb.co/portal) with a link sent to your email address; there is no password. The portal sets one strictly necessary cookie to keep you signed in, which expires when the session ends. If you turn on two-step sign-in, we store the secret your authenticator app uses.

Invoices and card payments are handled by Paddle, who acts as the merchant of record. Your card details are entered on Paddle’s checkout page and never reach us; we receive your name, email, billing country and the status of each payment.

We keep client records for the length of our work together and for five years after it ends, as South African tax and accounting law requires, then delete them. Your site can be exported for you at any time.

We share personal information only with the service providers who run our platform, and only as far as each needs to do its job. They act on our instructions and may not use the data for their own purposes. Our servers, your records and your files are in the European Union. Some providers are companies based outside South Africa and the EU; where that involves a transfer, it rests on their standard contractual clauses and equivalent safeguards.

• —Hosting and request logs: Vercel Inc. (servers in Frankfurt, Germany) — https://vercel.com/legal/privacy-policy
• —Database: Neon, Inc. (data stored in Frankfurt, Germany) — https://neon.tech/privacy-policy
• —File storage: Cloudflare, Inc. (data stored in the EU) — https://www.cloudflare.com/privacypolicy/
• —Transactional email: Resend, Inc. (USA) — https://resend.com/legal/privacy-policy
• —Billing and payments: Paddle.com Market Ltd (UK) — https://www.paddle.com/legal/privacy
• —Usage statistics on client sites: Plausible Insights OÜ (Estonia) — https://plausible.io/data-policy

We do not sell personal information, and we do not share it with advertisers. We disclose it to authorities only where the law requires.

You can ask us what personal information we hold about you, have it corrected or deleted, object to how we use it, or ask for a copy in a portable form. Where we rely on your consent, you may withdraw it at any time. Write to the address above; we answer within one month.

In South Africa, the Protection of Personal Information Act (POPIA) applies and you may complain to the Information Regulator (inforegulator.org.za). If you are in the European Union or the United Kingdom, the GDPR or UK GDPR applies to you as well and you may complain to your local supervisory authority.

We do not knowingly collect information from children under 18, and our services are offered to businesses.

When you visit a website we built for one of our clients, that client is responsible for your data and their own privacy policy, linked in their footer, applies. We process visitor data on their behalf and on their instructions: we host the site, deliver the messages visitors send through its forms to the client, and provide cookieless usage statistics.

Form messages sent on a client site are emailed to the client and kept for them in their portal; attachments are stored privately and scanned before download. Client sites set no cookies for analytics or advertising. Where a client embeds a third-party service that would set cookies, it loads only after you agree.

We will update this page when our practices change and show the date of the last change at the top. This version is dated 18 October 2026.