Privacy notice

Who we are

LocalLedger is accounting software for South African businesses, operated by [TO COMPLETE: legal entity name and registration number], [TO COMPLETE: physical address]. We are the "responsible party" (as defined in the Protection of Personal Information Act, 2013 — POPIA) for your account information, and an "operator" for the business records you capture about your own customers, suppliers and staff.

What we collect

• Account details: your name, email address and an encrypted password.
• Organisation details: business name, registration, tax and VAT numbers, address and contact details.
• Business records you capture: invoices, bills, contacts, bank statement lines, journals and uploaded documents.
• Usage and security data: sign-in times, IP addresses and an activity log of changes made in your organisation.

Why we use it

To provide the service you signed up for (keeping your books, producing reports and returns), to secure your account, to send the emails you ask for (invoices, invitations, password resets and reminders), and to meet our legal obligations. We don't sell personal information or use it for advertising.

Who we share it with

Only the service providers we need to run LocalLedger, under contract:

• Hosting: [TO COMPLETE: provider and country — note any transfer outside South Africa under POPIA section 72].
• Email delivery: [TO COMPLETE: e.g. Google (Gmail SMTP) / Resend].
• Error monitoring: [TO COMPLETE: e.g. Sentry].
• AI features (only when you use them): Anthropic, which processes the text and documents you submit (for example a supplier invoice you import) to generate suggestions.

How long we keep it

Account information is kept while your account is active. Accounting records are kept for as long as your organisation uses LocalLedger and as required by law — SARS generally requires businesses to keep records for five years. [TO COMPLETE: retention period after an organisation is closed.]

Your rights

You may ask to see, correct or delete your personal information, object to its processing, and complain to the Information Regulator. You can edit your profile or delete your account yourself under Account settings; an organisation's accounting records are kept (not deleted with an account) while the law requires them.

POPIA: Information Officer

Information Officer

[TO COMPLETE: name]

Email

[TO COMPLETE: privacy contact email]

Registered with the Regulator

[TO COMPLETE: registration reference]

If you're not satisfied with our response you can complain to the Information Regulator (South Africa): inforegulator.org.za.

Security

Passwords are hashed, API tokens are stored as hashes, SARS eFiling credentials are encrypted, and access to an organisation is limited to its members and their roles.