Privacy Policy
Pic-A-Site is operated by Flemoji Inc. This policy explains what personal information we collect, why we collect it, who we share it with, and how you get it back or have it deleted. It is written to meet the Protection of Personal Information Act (POPIA) of South Africa.
If anything here is unclear, email tatenda@flemoji.com.
Who we are
Flemoji Inc is the responsible party for the personal information described below. Pic-A-Site is a content management service that lets a business build and run its website, publish articles, and connect its own social and analytics accounts.
What we collect
Information you give us
- Account details — your name and email address. If you sign in with a password we store a one-way hash of it, never the password itself.
- Business and site content — everything you create in the product: pages, articles, images, brand material, and settings.
- Billing details — your billing email and subscription plan. Card details are entered directly with our payment provider and never reach our servers.
- What you send the assistant — the messages, documents and images you submit to the AI assistant so it can answer you.
Information from accounts you connect
Connecting a third-party account is always your choice, and you can disconnect it at any time from your dashboard.
- Instagram — if you connect an Instagram business account we request only
instagram_business_basicandinstagram_business_content_publish. That lets us read the account's id and username so we can show you which account is connected, and publish the posts you explicitly choose to publish. We do not read your direct messages, your followers, or anyone else's content, and we never post without you pressing publish. - Google Analytics— if you link a Google account we read only the GA4 traffic metrics you authorise, so we can show your site's performance. Google sign-in cannot be used to create an account here; it only attaches analytics access to an account you already have.
- Your own website — where you connect a site we hold the access credentials needed to manage its content on your behalf.
Information collected automatically
- Standard technical data — IP address, browser type and pages visited — used to keep the service secure, apply rate limits, and diagnose faults.
- Aggregate page-view and performance analytics for the app itself.
Why we use it
- To provide the service and keep your account working.
- To publish content to the destinations you connect and instruct.
- To generate content and images when you ask the assistant to.
- To take payment and manage your subscription.
- To secure the service — detecting abuse, preventing unauthorised access, and keeping audit records.
- To contact you about your account. We do not sell your personal information, and we do not use your business content to train AI models.
Who we share it with
We share personal information only with the processors below, only to the extent each needs it, and only to run the service.
| Processor | Purpose | Data involved |
|---|---|---|
| Microsoft Azure | Application hosting, PostgreSQL database, file and image storage | All account and site data, stored in South Africa North |
| Azure OpenAI / OpenAI | The AI assistant, content generation, and image generation | Prompts, site content, and brand material you submit to the assistant |
| Meta Platforms | Publishing posts to a connected Instagram business account | Instagram account id and username, access token, and the posts you publish |
| Reading Google Analytics traffic data for sites you connect | Your Google account identifier and the GA4 metrics you authorise | |
| Paystack | Subscription billing and payments | Billing email and payment details, handled by Paystack — we never see card numbers |
| Resend | Transactional email (verification, password reset, notifications) | Your name and email address |
| Tavily | Web search used by the assistant when you ask it to research | The search terms derived from your request |
We may also disclose information where the law requires it, or to establish or defend a legal claim.
Where it is stored
Your account and site data is hosted in Microsoft Azure's South Africa North (Johannesburg) region, so it stays in South Africa. Some processors listed above operate outside the country; where personal information is transferred to them it is protected by the contractual terms POPIA requires for cross-border transfers.
How we protect it
- All traffic is encrypted in transit over HTTPS.
- Credentials for connected accounts — access tokens, refresh tokens and client secrets — are encrypted at rest with AES-256-GCM envelope encryption. They are never displayed back to you or written to logs.
- Passwords are stored only as one-way hashes.
- Access is scoped per workspace, so one customer's data is not reachable from another's account.
How long we keep it
We keep your account and content for as long as your account is open. When you delete your account we remove your personal information and content within 30 days, except where we must keep records longer to meet a legal obligation — invoices and payment records, for example, which tax law requires us to retain.
Your rights
Under POPIA you may:
- ask what personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your personal information;
- object to processing, or withdraw a consent you gave us;
- ask for a copy of your information in a portable format;
- complain to the Information Regulator of South Africa if you believe we have handled your information unlawfully.
To exercise any of these, email tatenda@flemoji.com. To delete your data, see how to delete your data. We respond within 30 days.
Children
Pic-A-Site is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.
Changes to this policy
If we make a material change we will update the date below and, where the change affects you meaningfully, tell you by email before it takes effect.