Privacy Policy
Last updated: 1 October 2026
Bild Agency ("we", "us", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights.
Who we are: Bild Agency is a trading name of J E Bild Holdings (Pty) Ltd, a private company registered in South Africa (registration number 2026/604094/07). It is the responsible party for the personal data described here.
1. Data We Collect
From our clients (you)
- Business name, owner name, email address, phone number
- Business details (services, service area)
- Logo and photos you upload
- Color and design preferences
- Payment information (handled by our payment providers; we never see or store your full card number)
From visitors to client websites
- Basic analytics via Cloudflare Web Analytics: page views, visitor count, referrer, country, device type, browser
- Cloudflare Web Analytics does not use cookies and does not collect personal data or IP addresses
From visitors to bildagency.com
- Same Cloudflare Web Analytics data as above
- Your country, which Cloudflare passes to our site so we can choose which currency to show prices in. We don't store it.
- Your email address, and anything else you include, if you email us
- If you use our free-preview form: your name, your business name, and the email address or phone number you give us, plus the website or Google listing and the message if you add them. We also see which country the request came from. To check that a person and not a bot is sending the form, Cloudflare's Turnstile looks at your IP address and browser details (see section 3). We do not store them.
Cloudflare hosts both our site and client websites. Its hosting and security services see the IP address of every visit in order to deliver and protect the site, even though Web Analytics does not store it.
As our client services launch
We will also collect:
- From businesses we may contact: publicly listed business information, such as the business name, category, address, phone number, website, opening hours, ratings, and published email addresses (for example, from Google Maps listings and Facebook business pages). For US businesses, we also note details from the business's own website, such as its services, service area, owner's name, and license numbers, and we take screenshots of the website and test how fast it loads. For South African businesses that have not agreed to hear from us, we keep only the business name, category, published phone number or postal address, and where we found them.
- From businesses we make a preview website for: how the preview is used (pages and sections viewed, time spent, clicks, device type, and approximate location, such as country and city), linked to our record of that business. Each preview says this on the page.
- From calls and messages with us: phone and video call recordings and transcripts, voice notes, and WhatsApp messages. We tell you at the start of a call when it is being recorded.
- From visitors to client websites: the details a visitor enters in a client website's contact form. We pass them to that business (by email, and by WhatsApp if the business gets its lead alerts there) and handle them on the business's behalf.
- Client website statistics: visits and clicks on client websites (pages viewed, taps on call and WhatsApp buttons, device type, and approximate location), collected without cookies. To count visitors without storing IP addresses, we turn each visitor's IP address and browser details into a scrambled code, using a key that we replace and delete every day.
2. How We Use Your Data
- To design and maintain your website
- To take payments for your plan
- To communicate with you about your account and services
- To send you edit confirmations and service updates
- To display your business information on your website (as provided by you)
If you send us a free-preview request, we use it to reply to you, to email you a confirmation that we have it, and to build your preview. We keep the request in our email inbox.
As we launch our client services, we will also use data:
- To find US businesses that may want a website, check the email addresses they have published, and email them (see section 7)
- To find South African businesses that may want a website, and contact them in one of three ways: a single phone call asking whether they would like to hear from us, a letter, or a visit. We do not send South African businesses unsolicited marketing email.
- To see how a business uses the preview we made for it, so we can follow up
- To show clients how their website is doing, such as visits and taps on call buttons
- To record and transcribe calls, so we have an accurate note of what was agreed
- To use AI tools to help read public business websites, summarize calls, and draft website content and email replies
- To message clients on WhatsApp, including lead alerts for clients who get them there
- To keep backups, so we can recover from data loss
- To find and fix errors in our systems
We do not sell, rent, or share your personal data with third parties for marketing purposes.
3. Third-Party Services
These are the service providers we use, or will use as we launch our client services. Most of them process data on our behalf. Some also use it for their own purposes, under their own privacy policies. For example, the payment providers (PayPal, Payoneer, and Paystack) and Meta use it for their own legal, fraud-prevention, and security checks, and domain registries may publish some registrant details. Which providers handle your data depends on how you deal with us.
| Service | Purpose | Data involved |
|---|---|---|
| Cloudflare | Website hosting, DNS, file storage, security and bot protection, website analytics, and sending service emails | Its hosting and security services see the IP address, country, and device type of each request. Web Analytics records page views, with no IP addresses. Cloudflare also stores the files and photos you send us, and carries the addresses and content of our service emails. |
| Supabase | Our main database, hosted in the EU (Frankfurt) | Business and contact details, account and project records, messages, call notes, preview and client website statistics, and payment records (not card numbers) |
| GitHub | Storing our code, the files that build client websites, and our system settings and secret keys. Some website builds may run there. | Business details, text, and images that appear on client websites |
| Trigger.dev | Running background jobs, such as building websites. Jobs run in the EU (Frankfurt); job records may be stored in other countries. | Record IDs. While a job runs, it looks up the business and contact details it needs from our database. |
| Anthropic | AI processing of business information, such as reading public business websites, summarizing calls, and drafting website content and email replies | Business details, website content, call transcripts, and messages |
| Apify | Collecting publicly listed business information, such as Google Maps listings and Facebook business pages | Business name, category, address, phone number, website, opening hours, ratings, and published email addresses |
| Google (PageSpeed Insights and Gemini) | Checking how well US businesses' public websites load, and generating decorative background images for websites | Website addresses, and written descriptions of the images we want |
| MillionVerifier | Checking that email addresses are valid before we email them | Email addresses |
| Instantly | Sending our outreach emails to US businesses, and handling replies and opt‑outs | Business names, contact names, business email addresses, email content, and replies |
| Google Workspace | The mailboxes that send our outreach emails to US businesses. They use separate outreach domains, not bildagency.com. | Business names, contact names, email addresses, and email content, including replies |
| Zoho Mail | Our bildagency.com email for one‑to‑one messages | Names, email addresses, and anything you include in an email to us |
| Resend | Sending service emails if Cloudflare's email sending is unavailable | Email addresses and email content |
| Cal.com | Booking calls with us | Name, email address, phone number, and booking details |
| Quo (or, for calls to South African businesses, a South African phone provider we have not yet chosen) | Business phone calls, call recordings, and transcripts, including the one recorded call in which we ask a South African business whether it would like to hear from us | Phone numbers, call recordings, transcripts, and call notes |
| National Consumer Commission (South Africa) | Checking South African phone numbers against the national opt-out registry before we call them | The phone numbers we plan to call |
| Postal and courier services | Delivering our letters to South African businesses | Business name and postal address |
| Microsoft Teams and Zoom | Video calls | Names, email addresses, and the video and audio of the call |
| Fireflies | Recording and transcribing video calls | Call recordings, transcripts, and participants' names and email addresses |
| Deepgram | Transcribing audio you send us, such as voice notes | Audio recordings and transcripts |
| Fillout | Forms, such as the onboarding form where you confirm your business details | Business and contact details, and anything you enter in the form |
| Meta (WhatsApp) | WhatsApp messages with clients, and lead alerts sent to clients by WhatsApp | Phone numbers, names, messages and photos, and the details of leads from your website (for lead alerts) |
| PayPal | Payments from clients whose business is in the US | Name, email address, and payment details |
| Payoneer | Bank transfers from clients whose business is in the US and who ask to pay by invoice | Name, business name, and payment details |
| Paystack | Payments from clients whose business is in South Africa. If PayPal is ever unavailable, we may offer a client in the US a card payment through Paystack, which may be charged in a currency other than the one in their order form. We only do this if the client agrees. | Name, email address, and payment details |
| Zoho Books | Invoicing and accounting | Business name, contact name, email address, billing address, and invoice and payment records |
| Domain registrars (Cloudflare Registrar and a .co.za registrar we have not yet chosen) | Registering and renewing domain names in your name | Registrant name, business name, address, email address, and phone number. Domain registries may publish some of these in public registration records (WHOIS). |
| Sentry | Error monitoring | Technical error reports, set to strip out personal details |
| Backblaze B2 | Backups | Copies of our database, website and media files, code, and accounting records |
Several of these providers are based outside South Africa, so your data may be processed in other countries, including the United States and countries in the European Union.
4. Data Retention
- Clients: Your account and contact details, and our messages with you (such as emails and WhatsApp messages), are kept while you are a client and for the 24 months your site is archived after your plan ends. Then we delete them.
- After your plan ends: Your plan ends when your cancellation takes effect, 60 days after a missed payment was due, or when we end it for a breach of our Acceptable Use Policy. We then archive your website, its design, and your business content for 24 months, so you can switch your site back on in one step. If we ended your plan for a breach of that policy, we switch it back on only once the problem is fixed and we agree to it. We email you 7 days before we delete the archive. If we close the business, the archive ends when we close, after we have sent you your files (section 10 of our Terms of Service).
- Free-preview requests: If you ask for a free preview and do not become a client, we delete your request, and our messages with you about it, 90 days after the last message between us.
- Leads and other personal data from your website: Deleted 90 days after your plan ends. We send you a spreadsheet (CSV file) of your leads before then.
- Call recordings: Deleted 180 days after the call.
- Backups: Copies in our backups are deleted within 90 days of the original.
- Invoices and payment records: Kept for 7 years, as the law requires. They hold amounts, dates, and invoice details, never card numbers.
- Earlier deletion: You can ask us to delete your data sooner at any time. We will, except for records the law requires us to keep.
- Email outreach: If you received a cold email from us and did not become a client, your email address is removed from our outreach lists promptly, and always within 10 business days of your opt-out request.
5. Your Rights
You have the right to:
- Access: Request a copy of the data we hold about you.
- Correction: Ask us to correct inaccurate data.
- Deletion: Ask us to delete your data (subject to legal retention requirements).
- Opt-out: Unsubscribe from marketing emails at any time.
- Export: When you leave, get a copy of your whole website as files (which any website hosting company can put online), your images, all the text on your website, and a spreadsheet of your leads. If you leave before your setup fee is paid in full, you get back only what was always yours: your own content (including your images), your domain, and your leads, not the website we built or the text we wrote. Section 4 of our Terms of Service sets this out.
To exercise any of these rights, email josh@bildagency.com. We will respond within 14 days.
6. Cookies
- bildagency.com: We do not set cookies on bildagency.com. We choose which currency to show prices in from your country (see section 1), not from a cookie. Cloudflare Web Analytics is cookie-free.
- Client websites: We do not place cookies on client websites. Cloudflare Web Analytics is cookie-free.
- If we add cookie-based features in the future, we will update this policy and notify affected clients.
7. Cold Email Outreach
We may email US businesses at an address the business published itself (for example on its own website or Google Business Profile). We do not send unsolicited marketing email to South African businesses. These emails:
- Identify us as the sender (Bild Agency)
- Tell you how to opt out
- Comply with CAN-SPAM Act requirements
- Are sent from dedicated outreach domains, not from bildagency.com
Our outreach emails are plain text, with no links. If you do not want to hear from us again, reply NO or "unsubscribe", or use the Unsubscribe button your email app shows next to our message. We will remove you promptly, and always within 10 business days.
8. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to active clients at least 14 days before taking effect.
9. Contact
For privacy questions or requests:
Email: josh@bildagency.com
Website: bildagency.com