Privacy notice
Last updated
Who we are
Indably is a product of Xee Holdings (Pty) Ltd, registration 2021/435618/07, of 160 Belmont Road, Effingham Heights, Durban North, 4051, South Africa. Our Information Officer is Xien Singh, reachable at privacy@indably.com.
When a business uses Indably for its own brands, that business decides what is posted and who sees it. For that content, we process information on the business's behalf, under its instructions.
What Indably does
Indably helps businesses plan, approve, publish and report on their own social media and ads. When you connect an account on a network, Indably publishes the posts your team approves to that account and reads back the numbers the network reports for them.
What we keep
About you as a user. Your name, email address and sign-in details: a hashed password (never the password itself), passkeys, and your authenticator settings. If you choose to get alerts on WhatsApp, the number you verify. If you turn on browser notifications, the browser's notification address (no name or email).
From the networks you connect. Facebook, Instagram, LinkedIn, X, Threads, TikTok, YouTube and Google Business Profile, and the ad accounts on Meta, LinkedIn, Google and TikTok. We keep the name and handle of each account you choose, a sign-in token for it (stored encrypted), and aggregate numbers for posts and ads published through Indably: views, reach, reactions, comments, shares, saves, clicks and follower counts. We don't collect information about the individual people who view, follow or engage with your accounts. Google Business Profile numbers are not kept at all.
Your content. Captions, links, photos and videos you upload, and the reports you create. We remove location and camera data from photos when you upload them.
Billing. Your billing contact, company name, VAT number and address, and the invoices we issue. Card details are typed on PayFast's page; Indably never receives your card number.
Your own keys. If you add your own Anthropic or ChatReach key, it is stored encrypted and only its last four characters are ever shown. API keys you create for other systems are stored only as a fingerprint; webhook signing secrets are stored encrypted.
How Indably is used. Which pages and features people use, how long pages take, and errors, linked to your user and brand, so we can see what works and fix what doesn't. We keep it for 400 days and never share it.
Visits to indably.com. The website sets no cookies and runs no tracking script. We count visits with a code made from your IP address and browser that changes every day and can't be turned back into either, so we can't recognise you or follow you between days. We keep the page, the site you came from and any campaign tag in the link.
What we use it for
To publish what your team approves, when it asks; to show how it performed; to email reports you schedule; to remind people of posts that need them; to bill for the service; and to keep the service secure. We don't sell personal information and we don't use it for advertising.
Who we share it with
- The networks you connect, to publish to your own accounts and run your own ads. Only what your team approved is sent.
- Anthropic, only when someone presses an AI suggestion button, and only the text they typed for it. Anthropic does not train on it.
- ChatReach (South Africa), to send WhatsApp messages to people who opted in to them.
- PayFast (South Africa), to take card payments.
- Our email provider, to send notifications and reports.
Some of these organisations are outside South Africa (Meta, LinkedIn, X, Google and Anthropic are in the United States or Europe; TikTok in Singapore and the United States). We send them information only to do what you asked Indably to do, under their own data processing terms.
How long we keep it
- Network sign-in tokens: deleted the moment you disconnect the account.
- Read notifications: 90 days. Any notification: one year.
- Expired invitations: 30 days.
- Activity log: three years.
- Usage and error records: 400 days.
- Invoices and payment records: five years, as tax law requires.
- Your content, reports and numbers: until you delete them or the workspace is closed.
Security
Every network sign-in is encrypted at rest. Indably supports passkeys and authenticator apps, limits what each person can do by their role in each brand, and keeps an activity log of who did what. Our hosting is in South Africa.
Your rights
You can ask to see the personal information we hold about you, to correct it or to delete it, and you can object to how we use it. Email privacy@indably.com. If you're unhappy with our answer, you can complain to the Information Regulator at inforegulator.org.za.
Deleting your data
Disconnect an account under Connections and its token is erased immediately. To delete everything, see deleting your data.
Changes
We'll email account owners before any material change to this notice.