Privacy policy

Last updated 22 October 2026

Galooly Local Sites handles personal information in line with the Protection of Personal Information Act (POPIA). This policy covers this website, our WhatsApp chat, our client portal and the websites we run for our clients.

What we collect

• Enquiries to us: the details you choose to give us, such as your name, phone number, business name and message.
• WhatsApp chats with us: what you tell us when you message us on WhatsApp. See Chatting with us on WhatsApp below.
• Clients: the business and contact information needed to build and run your website and account, the people you give portal access, your change requests and your billing history.
• Payments: Stitch processes card payments and the other payment methods on its payment pages. To set up your card subscription we give Stitch your name or business name, your email address and an account reference. We receive confirmation of each payment, but never your full card number: Stitch's record of a payment can show the card's first six and last four digits and its expiry date, and we do not store them.
• Visits to our website and sign-up: daily totals we count without cookies, which say nothing about you (see Counting visits without cookies), and, only if you accept cookies, what Google Analytics and Meta's pixel record and what we tell Meta about the steps you take, which Meta may also use to show our ads to people who visited. See Analytics, our ads and cookies below.
• Which of our ads brought you: if you reach us from one of our Facebook or Instagram ads, or from a link carrying an ad's tags, we note which ad it was (its campaign, its name and Meta's ad number, or its headline when you message us on WhatsApp from it) with your enquiry, chat or sign-up. It says nothing more about you, we use it only to see which of our ads work, and we share it with no one.
• Enquiries on client websites: when someone sends an enquiry through a website we run, we store it securely and deliver it to that business by email. If the business has switched on WhatsApp alerts, we also send it a short WhatsApp message with the person's name, phone number, town and what they asked about; Meta processes that message to deliver it, which involves processing outside South Africa. We act on the business's behalf and use these details for nothing else.

How we use it

Only to respond to enquiries, provide and bill for our services, keep our clients' websites working, count visits to our website without cookies and, if you accept cookies, see how our website is used, measure and improve our own ads on Facebook and Instagram, and show those ads to people who visited our website or started a sign-up. We do not sell personal information. Apart from what Meta receives for our own ads when you accept cookies, as set out below, we do not share it with third parties for marketing.

Chatting with us on WhatsApp

When you message us on WhatsApp, our first replies are automated and ask a few short questions. Anything else, we answer ourselves.

• If you start a website sign-up: your business name, kind of business, town or suburb and province, your name, email address and phone number, and your current website or Facebook page if you have one. Answering is voluntary, but we can't set up a website without these details. You finish signing up on our website.
• If you contact us: your name, what your message is about, and your message, with any photos, voice notes or files you send.
• From WhatsApp itself: your WhatsApp profile name, your phone number or username when WhatsApp shares it, and when messages were sent, delivered and read.

We use these details only to reply to you, to set up your website and contact you about it, and to keep a record of our conversation. We never sell them.

WhatsApp is run by Meta. Meta processes the messages you send us and our replies to deliver them, and this involves processing outside South Africa. WhatsApp's own terms and privacy policy also apply when you use WhatsApp.

We only message you on WhatsApp in reply to you, with one exception: if you're a client and switch on WhatsApp enquiry alerts in the portal, we send you each new enquiry from your website there. If we answer more than 24 hours after your last message, WhatsApp only lets us send a short note saying a reply is waiting. Tap it to see the reply. We never send marketing on WhatsApp without your consent.

Reply STOP at any time and our automated replies stop. We record that you opted out and won't message you on WhatsApp again unless you write to us. If you're a client and we send you enquiry alerts on WhatsApp, STOP turns those off too. Reply START to turn them back on.

If you start a sign-up on WhatsApp and don't finish it, we delete it 7 days after it was last used: your answers, the draft and any logo or photos you added. We keep a short note that you started (your name, business and contact details) as an enquiry, like any other enquiry to us. We delete WhatsApp chat messages after 12 months, and the chat itself once it has had no messages for 12 months. A sign-up you finish becomes part of your client record.

Who processes it for us

We use trusted service providers to run the platform: Cloudflare for hosting and data storage, Stitch for payments, and an email delivery service for notifications. Each handles personal information only to provide its service to us. Messages you send us on WhatsApp, and the enquiry alerts we send clients there, also pass through Meta, as set out above. If you accept cookies on this website, Google processes your visits for us and Meta receives what is needed to measure and improve our ads and to show them to people who visited, and on a client's website that uses Google Analytics, Google processes visits from visitors who accept it, all as set out below.

Analytics, our ads and cookies

This website uses Google Analytics, through Google Tag Manager, to count visits and see which pages are useful. This website and our sign-up pages (app.galooly.co.za) also use Meta's pixel to measure how well our own ads on Facebook and Instagram work, to improve them, and to show them to people who visited. Both run only if you accept them, and one choice covers both. Until you choose Accept, nothing from Google or Meta loads and none of their cookies is set. If you choose Decline, they stay off and we tell Meta nothing about what you do in this browser.

Counting visits without cookies

Whether or not you accept, this website counts visits itself, without cookies and without anything that identifies you. Each page that loads adds one to that day's page views. The first page you open in a browser tab also adds one to that day's visits, under where you came from: Facebook or Instagram (one of our ads or posts), Google, another website, or none of these. To work that out, your browser sends the name of the website you came from and the tags in our ads' links, and we keep only which of the four it was. This website and our sign-up pages also count how often our cookie banner is shown and how often visitors accept or decline it.

We keep only these daily totals: never your IP address (not even in a scrambled form), a cookie, the addresses of the pages or anything else about you or your device, and your browser sends no cookies with them. So that a visit counts once, your browser keeps a note in this tab's session storage, which it deletes when you close the tab. The counting runs on our own systems at Cloudflare, and we share the totals with no one.

Google Analytics

If you accept, Google Analytics records the pages you view and for how long, how you arrived (for example from a search or another website), your type of device, its operating system, your browser, screen size and language, and an approximate location worked out from your IP address. It sets cookies whose names start with _ga so that later visits from the same browser can be recognised. Advertising storage and ad personalisation are switched off, so this information is not used for advertising. Google processes it for us as an operator (the word POPIA uses for a processor) and may store it on servers outside South Africa.

Meta's pixel and our ads

If you accept, Meta's pixel records the pages you view on this website and our sign-up pages (up to the page you come back to after paying), and these steps: tapping our WhatsApp link, sending us a message, starting a sign-up, finishing it, going to pay, and your first payment and its amount. It sets a cookie called _fbp and, when you arrive from one of our ads, one called _fbc (our pages set that one too, so the click still counts if Meta's script is blocked), so that Meta can link these steps to the ad you saw. Meta's script also reads technical details such as your browser, your IP address and the address of the page.

So that these steps are counted even when the pixel is blocked, our servers also tell Meta about them: your email address, phone number, name, town and province, each in coded (hashed) form and never as plain text, together with your IP address, your browser details and the _fbp and _fbc values. They do this for a step only if you accepted in the browser you take it in, and for your first payment only if you accepted during your sign-up and have not declined since. We never send Meta the words of your message, your business name or your card details.

Meta uses this to tell us how many people our ads brought and what they did, and to improve which people see our ads. Meta processes it outside South Africa, and also under its own terms and privacy policy.

Meta may also use it to show our ads again, on Facebook and Instagram, to people who visited our website or started a sign-up. From what was recorded (the pages you viewed, and whether you started a sign-up, finished it or went to pay), Meta can add you to a group of people we show our ads to, for up to 180 days after the visit or step that added you. If you are already a client, we may leave you out of our ads. Meta shows us only roughly how many people are in a group, never who they are. If you decline, nothing from this browser is used for this. If you withdraw later, nothing more from this browser is added, but Meta keeps you in a group you have already joined until your time in it is up.

With your sign-up we keep your IP address, your browser details and the _fbp and _fbc values until your first payment has been reported to Meta, and for no more than 30 days after you last used our sign-up pages. We keep the time you accepted for 12 months, as our record that you agreed. For a message to us we keep none of them. The websites we run for our clients never load Meta's pixel.

Your choice

Your choice is remembered for 12 months in a cookie called galooly_consent, which this website and our sign-up pages share. It holds only your choice, when you made it and which version of our question you answered, and it is needed to remember it. You can change your choice here at any time, through the Cookie settings link at the foot of every page, or with Cookie settings on the sign-up pages. If you withdraw, Google Analytics and Meta's pixel stop in this browser straight away and their cookies are removed. Our servers hear of it at once: they remove what we kept for Meta with a sign-up made in this browser, or with your account if you are signed in to our client portal in this browser, and tell Meta nothing more from it. If you signed up on another device, withdraw there too, or ask us to remove it.

Our banner used to ask only about seeing how our website is used and measuring and improving our ads. If you accepted then, we ask you again, and Google Analytics and Meta's pixel stay off in this browser until you choose. If you declined then, your choice still holds.

Google Analytics and Meta's pixel in this browser: Off.

Accept Decline

Other cookies

The client portal uses a cookie to keep you signed in, and one to save your progress while you sign up. Your cookie choice is kept in the galooly_consent cookie, as set out above.

On the websites we run for our clients, taps on the call, WhatsApp and booking buttons are counted without cookies. Unless the business has asked us to add Google Analytics, its website sets no tracking cookies. If it has, that website asks each visitor first: Google Analytics loads, and sets its cookies, only after the visitor accepts. Until then nothing from Google loads. The visitor's choice is remembered on their device and can be changed at any time from the Cookie settings link at the foot of that website. Google processes this information for the business and may store it outside South Africa.

How long we keep it

We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires for financial records. WhatsApp chats and what we keep for Meta have their own periods, set out above.

Your rights

You may ask what personal information we hold about you, including what you sent us on WhatsApp, ask us to correct or delete it, or object to how we use it. Contact us using the details below. You may also complain to the Information Regulator of South Africa.

Contact us

Galooly Local Sites Phone 070 591 5591 WhatsApp 070 591 5591 Email hello@galooly.co.za Website galooly.co.za Send us a message

See our pricing and services, or send us a message.