Privacy
Privacy notice
This notice explains what personal information Invasion collects when you use this website, order a build, or use the client portal — and what you can ask us to do with it. It is written to be read, not to be survived.
What we collect
- Account details: your name, email address, and a phone number if you give one. If you sign in with Google, we receive your name and email from Google.
- Order details: the package you bought, the price, the order reference, your domain preference and the business name you want on the site.
- Payment records: what was paid and when, the PayFast reference, and the outcome of the transaction. We never see or store your card number — card details are entered on PayFast's own page.
- Your brief: the answers you give about your business, the content and images you send, and the documents you upload to the portal.
- Support: the messages you send us and the files you attach to them.
- Security information: the IP address and browser a request came from, when you sign in, and what changed on the account. This is what lets us detect a hijacked session and answer "was that me?".
Why we hold it
- To create your account, take payment and deliver the website you ordered.
- To let you sign in, view your project and download your invoices.
- To answer support questions and tell you about the order.
- To keep the records tax and consumer law require us to keep.
- To keep the platform and your account secure.
Who else sees it
We do not sell personal information and we do not run third-party advertising or analytics trackers on this site. Information reaches only the services needed to run your order:
- PayFast processes the payment. It receives your name, email and the order total.
- Our email provider delivers order, invoice and account messages. It sees the address and the content of the message.
- A domain registrar, only when you ask us to register a domain, and then the registrant details required by that registry.
- Our hosting provider, which stores the database and the files that make up the platform.
Cookies and local storage
__Host-invasion_session— keeps you signed in. Removed when you sign out.invasion_checkout— lets a guest see the order they just placed without an account. Expires after 24 hours.inv_ref— remembers which referral link brought you here, so a referrer is credited if you buy. Expires after 30 days.inv_display_currency— your choice of display currency. Prices are always charged in rand.- Theme preference — stored in your browser's local storage, never sent to us.
How long we keep it
Account, order and brief information is kept while your account is open and, after that, for as long as tax and consumer law require us to keep the transaction record. Support conversations are kept while they may be needed to help you. Security logs are kept long enough to investigate an incident.
Your rights
You can ask for a copy of your information, correct it, ask us to delete it, or object to a particular use. Two of those are self-service in the portal:
- Download your data from the account settings — a machine-readable export of your profile, orders, briefs and support history.
- Request deletion from the same screen. We delete the account and its content, and keep only what the law requires us to keep (for example an invoice already issued).
For anything else, email hello@invasion.co.za with the address on your account. We answer within one working day and act within 30 days.
How it is protected
Passwords are stored only as Argon2 hashes. Identity and bank details given for reward payouts are encrypted before they are stored. The site is served over HTTPS only, sessions are HttpOnly cookies, and staff accounts require a second factor to sign in.
Children
This is a service for businesses. It is not intended for anyone under 18, and we do not knowingly hold information about children.
Changes
If this notice changes materially we will tell account holders by email. The date at the top is the version in force. The terms that apply to an order are in the service terms.