Privacy Policy

Last updated: 24 September 2026

Topaz Creations ("we", "us", or "our") operates the Topaz AI Website Builder platform at topazcreations.co.za. We serve users worldwide and are committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA) of South Africa, the General Data Protection Regulation (GDPR) of the European Union and the United Kingdom, the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

This Privacy Policy explains what information we collect, how we use it, where it is processed, and what rights you have in relation to it.

1. Information We Collect

Personal Information You Provide

Full name and email address (when you create an account)
Username and password (securely hashed using bcrypt)
Billing information (processed securely through PayFast; we do not store card numbers)
Any content you provide in support requests or contact forms

Information Collected Automatically

IP address
Browser type, version, and operating system
Pages visited and time spent on the platform
Referring website or source
Device type and screen resolution

Website Content

When you use Topaz to build websites, we store the HTML, CSS, and other content you create. This content is necessary to provide our service and is treated as your intellectual property.

2. How We Use Your Information

To provide, operate, and maintain the Topaz platform
To create and manage your account
To process AI-powered website generation requests
To send transactional emails (password resets, account notifications)
To analyse usage patterns and improve our product
To detect and prevent fraud or abuse
To comply with legal obligations
To respond to your support inquiries

We will never sell your personal information to third parties. We do not send marketing emails unless you have explicitly opted in.

3. Cookies and Session Data

We use cookies strictly for essential functionality:

Session cookie: To keep you logged in and maintain your session state. It is cryptographically signed so it cannot be tampered with or forged, and it is sent only over HTTPS and cannot be read by scripts in your browser. It expires when you log out, or when you close your browser unless you asked us to keep you signed in.

This session cookie is the only cookie we set. We protect against cross-site request forgery by checking the origin of each request rather than by storing an additional cookie.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in cross-site tracking. We do store a randomly generated identifier in your browser's local storage, which is not a cookie and is never shared with anyone else, so that we can count how our own pages are used. It is not linked to your identity and we do not set it if your browser sends a Do Not Track signal.

4. Third-Party Services

We use the following third-party services to operate the platform. Each has its own privacy policy governing data processing:

Anthropic (Claude AI) — United States

Powers our AI website generation. Text prompts and instructions are sent to Anthropic's API for processing in the United States. Anthropic does not use your data to train their models when accessed via the API. Avoid pasting sensitive personal information into AI prompts.

Microsoft Azure — Netherlands (EEA)

Our platform is hosted on Microsoft Azure's West Europe region (Netherlands). Azure provides compute, storage, networking, TLS encryption in transit, AES-256 encryption at rest, automated DDoS protection, and ISO 27001 / SOC 2 compliance.

PayFast — South Africa

Handles all payment processing. Your payment card details are sent directly to PayFast and never touch our servers. PayFast is PCI DSS compliant.

Microsoft Office 365 SMTP

Sends transactional emails on our behalf (password resets, account notifications, contact form replies). Only your email address and the message content are processed.

Google (Gemini image generation) — United States

Our main AI image generator. When a website needs a picture that no stock photo provides, an image prompt is sent to Google's Gemini API. The prompt is written from your business description, so it can include your business name or what you sell. No account information is sent.

Leonardo.Ai — Backup Image Generator

Used only when we switch it on as a backup to Google. The same kind of image prompt is sent; no account information.

Unsplash and Pexels

Provide royalty-free stock photos for generated websites. We send them search words (for example "bakery interior"), never personal data.

Google Fonts

Supplies the typefaces used across this site. Your browser requests these fonts directly from Google, which means Google receives your IP address and browser details on each page you visit. We send Google nothing else — no account information, no page content, and no identifier of any kind.

5. Data Retention

Account data: Retained for as long as your account is active. If you delete your account, your personal data will be removed within 30 days.
Website content: Your generated websites and project data are retained while your account is active. Upon account deletion, project data is permanently removed within 30 days.
Server logs: Automatically purged after 90 days.
Password reset tokens: Expire and are deleted after 1 hour.
Session data: Cleared upon logout or after 24 hours of inactivity.

6. Your Rights

You have the following rights regarding your personal information:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure: Request deletion of your personal data and account.
Right to data portability: Request an export of your data in a structured, machine-readable format.
Right to object: Object to the processing of your personal data for certain purposes.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at info@topazcreations.co.za. We will respond to your request within 30 days.

7. International Data Transfers

Topaz is a global service. Your personal information may be processed in the countries where our service providers operate:

European Economic Area (Netherlands): account data, website content, sessions, logs (Microsoft Azure West Europe).
United States: AI prompts and instructions (Anthropic Claude API). When a website needs AI-generated images, image prompts are also processed in the US (Google Gemini, or Leonardo.Ai when used as a backup).
South Africa: payment processing (PayFast), business records, and the founder's administrative records.

Where personal information is transferred outside the EEA or the UK, we rely on the adequacy decisions of the European Commission, the EU Standard Contractual Clauses (SCCs), or equivalent UK International Data Transfer Agreements offered by our processors. You can request a copy of the relevant transfer mechanism by contacting us at info@topazcreations.co.za.

7.1 POPIA (South Africa)

Topaz Creations complies with the Protection of Personal Information Act, 2013 (POPIA). In terms of POPIA:

We are the responsible party for the processing of your personal information.
We process personal information only for lawful purposes directly related to providing our service.
We implement appropriate technical and organisational measures to secure your data, including encryption at rest and in transit, secure password hashing, and access controls.
We minimise the personal information we collect to only what is necessary.

If you believe your personal information has been processed in violation of POPIA, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

7.2 GDPR (European Union & United Kingdom)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and UK GDPR apply to your personal information. Topaz Creations is the data controller for the personal data described in this policy.

Lawful bases we rely on:

Contract (Art. 6(1)(b)): to create and maintain your account, process payments, and deliver the service you signed up for.
Legitimate interest (Art. 6(1)(f)): security, fraud prevention, product analytics, and platform integrity. You may object at any time.
Legal obligation (Art. 6(1)(c)): tax, accounting, and record-keeping requirements.
Consent (Art. 6(1)(a)): for any optional processing such as marketing emails (you may withdraw consent at any time).

In addition to the rights listed in Section 6, you have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the United Kingdom, the CNIL in France, the AP in the Netherlands). For routine requests, contact us first at info@topazcreations.co.za — we respond within 30 days.

7.3 California Privacy (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights regarding the personal information we collect about you:

The right to know what personal information we collect, use, share, and disclose.
The right to delete personal information we have collected.
The right to correct inaccurate personal information.
The right to opt out of sale or sharing of personal information.
The right to limit use of sensitive personal information.
The right to non-discrimination for exercising any of these rights.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. To exercise any CCPA/CPRA right, contact us at info@topazcreations.co.za. We will respond within 45 days as required by California law.

8. Data Security

We take the security of your data seriously. Measures we implement include:

HTTPS encryption for all data in transit
Bcrypt password hashing with salt
PostgreSQL database with access controls
CSRF protection on all forms
XSS sanitisation on user input
Rate limiting on authentication endpoints
Session management with secure, HTTP-only cookies

No method of transmission over the Internet is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, contact us at:

Topaz Creations

Email: info@topazcreations.co.za

Website: topazcreations.co.za

Country: South Africa

Loading…