Privacy Policy

Last updated 28 October 2026

This Privacy Policy explains how Design2Code (Pty) Ltd ("we", "us"), the operator of Apex for WooCommerce, processes personal information. We do this in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). We are the responsible party for account and billing information. For personal information inside your WooCommerce store, you are the responsible party and we act as your operator, processing it only on your instructions.

1. Who we are

Information Officer: Nathaniel Hamann, reachable at info@apexstorefront.co.za.

2. Information we collect

Account information

• Name, email address and password (stored only as a one-way hash).
• Email verification status, plan, trial dates, team membership and role, and team invitations (the invitee's email address).
• The date and time you accepted these policies.

Connected store information

• Store name, store URL and WooCommerce REST API key and secret. The key and secret are encrypted at rest and never shown again after you save them.

Activity records

• An audit log of changes made through Apex: who made the change, which store, the product ID and name, the action, and details of what changed.
• Records of CSV import, backup export and backup restore jobs (status, counts and any errors).
• Technical and performance logs: request timings, error messages and IP addresses, used to keep the Service secure and fast. Registration attempts are rate-limited by IP address.

Billing information

• Payments are handled by PayFast. We receive your PayFast subscription token, payment status, plan, amount and billing dates. We never receive or store your card or bank details.

3. Store data we don't keep

Products, variations, prices, stock, categories, tags and other store content are fetched live from your store each time you use Apex and are not stored in our database. The exceptions are:

• Image uploads: images you upload are hosted temporarily so your store can download them, and deleted after about 60 minutes.
• CSV imports: the uploaded file is held only while the import runs, and deleted when it finishes.
• Backup restores: the backup file you upload to restore is held only while the restore runs, and deleted when it finishes.
• Backup exports: a JSON export you request is stored so you can download it. It is retained until you ask us to delete it or your Account is deleted.
• Short-lived caches: category and tag lists and your product count are cached for about 5 minutes.

4. Why we use your information

We do not sell your personal information or use it for third-party advertising.

5. Who we share it with

We share personal information only with operators that help us run the Service, under written agreements requiring them to protect it:

• PayFast (South Africa): payment processing.
• Resend (United States): delivery of transactional email.
• Laravel Cloud and its infrastructure providers: application hosting, database and storage.
• Your WooCommerce store: we send your requests to the store you connected.

We may also disclose information where required by law or to protect our rights or the safety of others.

6. Cross-border transfers

Some of our operators process information outside South Africa. We only use providers that are subject to laws, binding agreements or binding corporate rules that give protection substantially similar to POPIA, as required by section 72.

7. Security

• All traffic is encrypted with HTTPS. Store API credentials are encrypted at rest using the application's encryption key.
• Passwords are hashed, accounts require email verification, and access to stores is limited to the owner and their invited team.
• If we discover a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA section 22.

8. How long we keep it

• Account and store information: while your Account is open. Deleting your Account (Profile page) deletes your account, connected stores and their API keys, team and invitations, and import, export and restore job records.
• Audit log entries: kept after Account deletion with the link to your user and store removed, so other team members' history stays intact. You may ask us to delete them.
• Billing records: as long as tax and accounting laws require (generally five years).
• Logs: rotated and deleted within a limited period.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy;
• ask us to correct, update or delete it;
• object to processing based on legitimate interests;
• lodge a complaint with the Information Regulator (inforegulator.org.za).

You can update your name, email and password on your Profile page. For anything else, email info@apexstorefront.co.za. We may need to verify your identity first. If you are a customer of a store connected to Apex, please contact that store, since it is the responsible party.

10. Cookies and local storage

We use only essential cookies: a session cookie to keep you logged in and a security token (CSRF) to protect forms. Your light or dark theme preference is saved in your browser's local storage. We do not use advertising or third-party tracking cookies. The website loads fonts from Google Fonts, and Google may receive your IP address when it does.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their information.

12. Changes

We may update this policy. We'll notify you of material changes by email or in the app, and update the "Last updated" date above.