Privacy policy

1. Who we are

200 Online ("we", "us") provides website monitoring and client-care software at 200online.com. 200 Online is operated by [registered business name and registration number], [physical address].

Our Information Officer is Jordan Sutherland. You can reach us about anything in this policy at support@200online.com.

2. Our two roles under POPIA

For your own account (your name, email, login and billing), we are the responsible party: we decide why and how that information is used.

For information you store about your clients (client names and contact details, website logins, notes, tasks, files and time logs), you are the responsible party and we are your operator. We process that information only to provide 200 Online to you, under your instructions and this policy, and we keep it secure and confidential as POPIA requires of operators. You are responsible for having a lawful basis to store it, and for telling your clients how you use it.

3. What we collect

When you visit our website

• Analytics: we use Google Analytics to see which pages are visited, how people arrive (for example from a search engine) and which buttons are clicked. It records your browser, device, approximate location (city or region, from your IP address) and the pages you view, and sets cookies to recognise repeat visits. We don't use it for advertising.
• Hosting logs: our website host records technical request information, such as IP address, browser and time, to keep the site running and secure.

When you create and use an account

• Account details: your name, email address, password (stored only as a one-way bcrypt hash, never in readable form), plan, and settings such as two-factor login, theme and notification preferences. Optionally, a profile picture.
• Content you add: the website addresses you monitor, and the notes, tasks, comments, checklists, file attachments, links, client details and time logs you create in 200 Online.
• Website credentials: logins you save for client websites, hosting and other services. These are encrypted with AES-256 before they are stored.
• Monitoring data: uptime check results, response times, incidents, SSL details and Google PageSpeed scores for the websites you add.
• WordPress connector data: if you install our connector plugin on a WordPress site, we read its list of plugins and themes, their versions and whether updates are available.
• Payments: Paystack processes your card payment. We receive your plan, subscription status and payment confirmations, but never your full card number.
• Security information: your IP address is used briefly, in memory, to limit repeated login attempts. We don't write it to our application logs.

When you contact us

The email address and anything you include in your message.

4. Why we use it

• To provide 200 Online: monitoring your websites, sending the alerts and notifications you've chosen, and storing your work. This is necessary to perform our agreement with you.
• To secure accounts and the service: login protection, two-factor authentication and detecting abuse.
• To bill you for a paid plan and keep the records the law requires.
• To send service emails: account verification, password resets, downtime alerts and important changes to the service.
• To understand and improve our website and product, using analytics.

We don't sell personal information, and we don't use it for third-party advertising. We'll only send you marketing emails if you've agreed to them, and every one will have a way to opt out.

5. Who we share it with

We use a small number of service providers, who process information on our behalf and only for these purposes:

Inside 200 Online, information is shared with the people you choose: team members you invite, and clients you share a site or board with. If you switch on client alerts, downtime emails go to the client contact you've set for that site.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or the public.

6. Information sent outside South Africa

Some of our providers store or process information outside South Africa. Under section 72 of POPIA, we only use providers that are bound by law, binding agreements or binding corporate rules giving a level of protection substantially similar to POPIA.

7. How long we keep it

• Account and content: while your account is open. When you ask us to delete your account, we delete its information, except what we must keep by law, such as billing records.
• Resolved downtime incidents: 90 days on the free plan, one year on Professional, and kept for as long as the account exists on Enterprise.
• Read notifications: deleted automatically after 90 days.
• Backups: nightly database backups are kept for 14 days, so deleted information leaves our backups within that time.
• Analytics: kept by Google for the retention period set in our Google Analytics account.

8. How we protect it

All traffic to 200 Online is encrypted with HTTPS. Passwords are stored as bcrypt hashes, and saved credentials are encrypted with AES-256. Accounts can use two-factor authentication, the dashboard locks behind a PIN after inactivity, and every request is checked against what that account is allowed to see. If we ever become aware of a security compromise affecting your personal information, we'll notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you, and for a copy of it
• ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully held
• object to us processing your information, including for direct marketing
• withdraw consent where we rely on it
• complain to the Information Regulator

To make a request, email support@200online.com with "Privacy request" in the subject line. We may ask you to confirm your identity first. If your request is about information an agency stores about you in 200 Online, we'll pass it to that agency, as they are the responsible party for it.

You can contact the Information Regulator (South Africa) through its website, inforegulator.org.za.

10. Cookies and browser storage

• Essential: the app uses a session cookie to keep you logged in. It's needed for the service to work.
• Analytics: this website uses Google Analytics cookies (named _ga and similar) to count visits. You can block them in your browser settings, or with Google's opt-out add-on, without affecting how the site works.
• Preferences: the app saves some settings, such as your chosen layout and filters, in your browser's local storage.

11. Children

200 Online is a business service and isn't intended for anyone under 18. We don't knowingly collect information about children.

12. Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll also tell account holders by email before they take effect.