Annex C: Cancellation, refund, data export and deletion terms
DRAFT 0.5 for attorney review, 23 October 2026 (wording ID deletion-policy-0.5). Not published. Not in force.
Annex to the Ledgeforge Terms of Service. Replaces the old FinSight cancellation and refund wording ("all subscription fees are non-refundable") and any Loadwyse equivalent.
Based on: Jeffrey's decision of 21 October 2026 (automatic deletion at day 90, approved 09:22 UTC); shared contracts v0.14 sections 6, 8 and 13 (to be updated in v0.15); attorney brief of 21 October 2026, questions Q3 and Q4.
⚠ IMPORTANT: your data is deleted automatically 90 days after you cancel
When a product's subscription ends, the owner has 90 days to download that product's data, until the end of the 90th day (24:00 UTC). Straight after that, everything your organisation put into that product is permanently and automatically deleted, including your accounting records. No further request or confirmation is needed, and deleted data cannot be recovered by you or by us.
Keeping your records is your sole responsibility. The law requires your business to keep its own records (often for 5 to 7 years). That duty is yours, not Ledgeforge's. You must download everything you need by the end of the 90th day.
Keep your contact details up to date. We warn the owner by email 30 days and 7 days before the deletion. If those warnings, or any invoice or notice, do not reach you because an email address in the system was no longer valid or monitored, Ledgeforge is not responsible, and deletion still goes ahead.
[ATTORNEY: This block is written to meet CPA s49 (clauses that limit risk or impose an obligation on the consumer must be drawn to the consumer's attention in plain language, before agreement, with an opportunity to understand them). It is also shown at sign-up, in the terms, at the moment of cancelling (clause 9) and in the emails. Please confirm that is enough, and whether the cancel screen tick box (clause 9.1) should be required.]
1. Three ways a subscription ends
| What happens | What it means | Can it be undone? |
|---|---|---|
| You cancel a product | You stop subscribing to one product (for example FinSight). Only that product's data is deleted, 90 days after its last day of access. Your organisation, its users and its other products carry on unchanged. | Yes, by subscribing again by the end of its last download date. |
| You close the organisation | Every product's subscription ends at once. | Yes, by reopening and subscribing again by the end of the last download date. |
| We end a subscription | For example after long non-payment (Terms clause 5.3), a serious breach (clause 13.4) or if we withdraw a product, always with written notice. | Only by agreement with us. |
In every case the same 90-day export window and automatic deletion apply.
Moving FinSight to the Free plan is a plan change, not a cancellation. A product that is read-only because a payment failed is not cancelled and is not deleted.
2. Cancelling a product
2.1 An owner can cancel a product at any time in the Services. Before the cancellation goes through, the Services show the deletion policy and the dates that apply (clause 9).
2.2 A paid product keeps working until the last day of the calendar month already being billed. That day is the product's "last day of access". That month is invoiced as usual at month end.
2.3 A product on a trial, or one already read-only for non-payment, ends on the day it is cancelled; that day is its last day of access.
3. Closing the organisation
3.1 Only an owner can close an organisation. They must have signed in with two-factor within the last 10 minutes and type the organisation's name. Every other owner is emailed.
3.2 Closing ends every product's subscription as in clause 2, stops anything the Services send on the organisation's behalf (scheduled emails, reminders, scheduled exports), and stops new members, invitations, products and renames.
3.3 An owner can reopen a closed organisation until the end of the last download date. Reopening restores the members but not the subscriptions: the owner must subscribe again to stop deletion of each product.
3.4 Closing does not cancel any amount already owed. The month in progress is still invoiced, and unpaid invoices stay payable.
3.5 If you are a practice, closing it ends its FinSight seats and client links. Your clients' own companies are separate organisations and are not closed or deleted.
4. The 90-day export window
4.1 For 90 days after a product's last day of access (day 1 is the day after; the 90th day is the "last download date"), the organisation's owner may sign in to that product and download its full export. Nothing else in the product is available, and other Users have no access. Downloads stay available through the whole of the last download date, until 24:00 UTC (02:00 South African time the next morning).
4.2 The product shows the owner the last download date. Deletion starts straight after it ends. Every download is recorded in the audit log.
4.3 If the organisation subscribes to the product again at any time until the end of the last download date, the window ends, normal access returns and nothing is deleted.
4.4 Exports are in [formats per product: BUILD TEAMS to list, for example CSV and PDF files in a ZIP].
4.5 It is your sole responsibility to download your data within the 90 days. Ledgeforge is not liable for any loss, fine or cost caused by records that were not downloaded by the end of the last download date.
[ATTORNEY: Brief Q4. Is 90 days enough, and is "owner only" the right test? An owner who has left the business, died or cannot sign in must use clause 8 by the end of the last download date.]
5. Warnings before deletion
5.1 We email the organisation's owners when a subscription ends, and again 30 days and 7 days before the last download date (the wording is in clause 9).
5.2 The warnings go to the owners' email addresses as they are in the system on the day of sending. We keep a notice record of each warning (address, time, a copy or fingerprint, the email provider's message ID, and the sending and delivery result), and may rely on it as proof that the warning was sent (Terms clause 15.3).
5.3 It is your responsibility to keep every owner's email address and your billing contact correct, current and monitored. Ledgeforge is not responsible if a warning, invoice or other notice is not received because an address was wrong, no longer exists, or was not monitored. Not receiving a warning does not stop or delay deletion.
[ATTORNEY: Confirm the "not received" wording is enforceable, in light of ECTA s23 (when a data message is received) and CPA s48 (unfair terms) for consumer Customers.]
6. Automatic deletion after the last download date
6.1 Straight after the last download date ends (24:00 UTC), Ledgeforge automatically and permanently deletes everything the organisation put into that product, without any further request or confirmation. No one at Ledgeforge can stop or reverse it once it has run, except by the organisation subscribing again by the end of the last download date.
6.2 What is deleted, per product:
| Product | Deleted straight after the last download date |
|---|---|
| Accounting | everything, including the ledger, journals, accounting records, invoices you issued to your own clients, VAT records, bank statements and lines, uploaded documents, contacts, users' product settings and company settings |
| FinSight | imported financial information, automated analysis results, practice links, settings |
| Loadwyse | staff, clients, work and time records, prepared export files, settings |
6.2A Cancelling one product only. If the organisation cancels one product while it keeps others, only the cancelled product's data is deleted, straight after that product's own last download date, with the same warnings (clause 5) and wording (clause 9). Nothing in the other products is touched, and the organisation, its members, its billing details and its card stay in place for them. Each product has its own last day of access and its own last download date. Subscribing again to the cancelled product by the end of its last download date stops the deletion.
6.3 When no product remains (every product's data has been deleted), the organisation itself is deleted: its memberships and invitations, its name, its billing contact email and its card tokens and card details. People's own logins are kept if they belong to other organisations; otherwise they are removed in line with the Privacy Notice.
6.4 What Ledgeforge keeps: only its own records about you.
| Kept | For how long | Why |
|---|---|---|
| invoices Ledgeforge issued to you (including the customer name printed on each) | [5 / 7] years | Ledgeforge's own tax and company records |
| payments Ledgeforge received from you (including PayFast's payment record) | [5 / 7] years | Ledgeforge's own financial records |
| the audit log of actions in your account (who did what and when, never the content of your data) | [5 / 7] years | proof of what was done, including proof that deletion ran |
| notice records of the legal, payment and account emails we sent you (recipient address, time, copy or fingerprint, provider message ID, delivery result, reason) | 5 years from sending | proof that invoices, notices and deletion warnings were sent [ATTORNEY: confirm period] |
These are small records that belong to Ledgeforge, and the email addresses inside the notice records are kept with them. They are not storage of your data, and we cannot use them to rebuild your account.
6.5 Backups. Copies of deleted data in our backups disappear as those backups expire. We keep daily backups for 35 days and no longer backups, so deleted data is gone from our backups at the latest 35 days after the deletion. [ATTORNEY: Q10 / O-27, confirm the 35-day backup period.] Backups are never used to restore a deleted organisation. If we restore a backup to recover the Services, every deletion made since that backup is applied again first.
[ATTORNEY: (1) Confirm that the duty to keep a company's accounting records for 7 years (Companies Act s24, Tax Administration Act s29, VAT Act s55) rests with the Customer and not with Ledgeforge as its software provider and operator, so that deleting them at day 90 after clear warning is lawful. (2) Confirm the retention period for Ledgeforge's own invoices, payments and audit log (Tax Administration Act s29: 5 years from submission of the return; Companies Act s24: 7 years). (3) Brief Q3, still open: may the organisation name stay inside those kept records for that period? (4) Confirm deletion of a sole proprietor's data is consistent with ECTA and CPA.]
7. Deleting sooner
An owner who wants data deleted sooner may ask the Information Officer in writing. We will confirm the owner's identity and authority, confirm in writing what will be deleted and when, and then delete it. [BUILD TEAMS: the existing owner-requested erasure in the portal may stay for this purpose.]
8. Owners who cannot sign in
If no owner can sign in (for example the only owner has left or died), contact the Information Officer by the end of the last download date. We will verify who is asking and their authority (for example a company resolution, letter of executorship or court order) before giving an export. The last download date does not move while this is checked unless we agree in writing. [ATTORNEY: list the documents we should require, and whether we should pause deletion while a request is being verified.]
9. Wording shown when cancelling, and in emails
Wording ID: deletion-policy-0.5 (replaces deletion-policy-0.2; Annex C draft 0.5, 23 October 2026). Apps send this ID as deletion_policy_version. The text in 9.0 is the deletion policy wording: show it word for word on every surface in 9.1 to 9.6, never shortened or paraphrased. Only the bracketed fields change.
[ATTORNEY: Draft wording, still to be confirmed. Once confirmed, the ID becomes
deletion-policy-1.0.]
Date rule. One date is shown to the customer: the last download date (the contract's erasure_due_on; for one product, its cancelled_on plus 90 days, or cancels_on plus 90 while the cancellation is still scheduled). The owner can download, and can stop the deletion by subscribing again, through the whole of that day, until 24:00 UTC. Deletion starts straight after. The wording always says "until the end of [date]" for downloading and subscribing again, and "straight after that" for deletion. It never says "before [date]" or "on [date]" about the deletion. 24:00 UTC is 02:00 South African time the next morning, and the wording says so.
Fields.
| Field | Filled with |
|---|---|
| [Product] | Accounting, FinSight or Loadwyse |
| [Organisation] | the organisation's name |
| [Last access date] | the product's last day of normal use (cancels_on or cancelled_on) |
| [Last download date] | as in the date rule, written as "15 March 2027" |
| [Next day] | the day after [Last download date], written as "16 March 2027" |
| [Content] | Accounting: "your ledger, accounting records, invoices, bank statements, documents and settings"; FinSight: "your imported financial data, automated analysis, reports and settings"; Loadwyse: "your staff, client, work and planning records and uploaded files" |
| [Other products] | the organisation's other products still active, joined with "and" |
9.0 Deletion policy wording
Version A: one product ends, the organisation stays open
What happens to your data
After [Last access date], only an owner can sign in to [Product], and only to download its data. You can download it until the end of [Last download date] (24:00 UTC, which is 02:00 on [Next day] South African time).
Straight after that, everything in [Product] for [Organisation] is permanently and automatically deleted, including [Content]. It cannot be recovered.
Only [Product] is affected. [Other products] carry on as normal, and nothing in them is deleted.
To stop the deletion, subscribe to [Product] again by the end of [Last download date]. Nothing will be deleted and you can carry on as before.
Keeping your business records is your responsibility. Download what you need by the end of [Last download date].
We will email every owner when [Product] ends, and again 30 days and 7 days before the deletion. Please keep the owners' email addresses up to date. We are not responsible for emails sent to addresses that are out of date or not read, and the deletion goes ahead either way.
When the organisation has no other active product, leave out the sentence "Only [Product] is affected. [Other products] carry on as normal, and nothing in them is deleted."
Version B: the organisation is closed (every product ends)
What happens to your data
After the last access date of each product, only an owner can sign in, and only to download data. You can download until the end of [Last download date] (24:00 UTC, which is 02:00 on [Next day] South African time).
Straight after that, everything [Organisation] keeps in every Ledgeforge product is permanently and automatically deleted, including your accounting records. It cannot be recovered.
To stop the deletion, reopen the organisation and subscribe again by the end of [Last download date]. Only the products you subscribe to again are kept.
Keeping your business records is your responsibility. Download what you need by the end of [Last download date].
We will email every owner now, and again 30 days and 7 days before the deletion. Please keep the owners' email addresses up to date. We are not responsible for emails sent to addresses that are out of date or not read, and the deletion goes ahead either way.
[ATTORNEY: Version B uses one date for the whole organisation (the latest product window end, contracts v0.15). Confirm this is clear enough, given that a product whose own window ends earlier stops offering downloads on its own date. BUILD TEAMS: list each product's own last download date under Version B on the closure screen.]
9.1 Cancel confirmation screen (one product)
Cancel [Product] for [Organisation]?
Your access to [Product] ends on [Last access date].
[Deletion policy wording, Version A]
The owners' email addresses: [owner emails]. [Change]
☐ I understand that everything in [Product] will be permanently deleted after the end of [Last download date], and that downloading it is my responsibility.
[Download my data now] [Keep my subscription] [Cancel [Product]] (works only once the box is ticked)
9.2 Closure confirmation screen (portal)
Close [Organisation]?
Every product's subscription ends: [list of products with their last access dates].
[Deletion policy wording, Version B]
The owners' email addresses: [owner emails]. [Change]
☐ I understand that everything in every Ledgeforge product for [Organisation] will be permanently deleted after the end of [Last download date], and that downloading it is my responsibility.
Type the organisation's name to confirm: [ ]
[Download my data now] [Keep the organisation open] [Close [Organisation]] (works only once the box is ticked and the name matches)
9.3 Cancellation email (one product; sent by Billing)
Subject: [Product] cancelled: download your data by the end of [Last download date]
Hello [Owner first name],
[Person who cancelled] cancelled [Product] for [Organisation] on [date cancelled]. You can keep using it until the end of [Last access date].
[Deletion policy wording, Version A]
Download your data: [download link]
Ledgeforge Software (Pty) Ltd · 2026/774859/07 · support@ledgeforge.co.za
When Billing's email lists several products (for example after cancel-all), it repeats the [Product] lines and Version A once for each product with that product's own dates.
9.4 Closure email (sent by Identity)
Subject: [Organisation] closed: download your data by the end of [Last download date]
Hello [Owner first name],
[Person who closed it] closed [Organisation] on [date closed].
[Deletion policy wording, Version B]
Download your data: [download link for each product]
Ledgeforge Software (Pty) Ltd · 2026/774859/07 · support@ledgeforge.co.za
9.5 Warning emails (30 days and 7 days before; sent by Identity)
Subject: [30 / 7] days left: [Product] data for [Organisation] will be deleted after [Last download date]
Hello [Owner first name],
This is a reminder that [Product] for [Organisation] has ended.
[Deletion policy wording, Version A, or Version B for a closed organisation with the subject "... [Organisation]'s data will be deleted after [Last download date]"]
Download your data: [download link]
Ledgeforge Software (Pty) Ltd · 2026/774859/07 · support@ledgeforge.co.za
9.6 Banner inside the product during the window
[Product] has ended. You can download your data until the end of [Last download date]. Straight after that it is permanently deleted. [Download my data] [Subscribe again]
10. Refunds
10.1 Because we bill in arrears (at the end of each month, for the month just used), you normally pay only for time already used, so refunds should rarely arise.
10.2 We will refund or credit:
- any amount charged in error (for example a duplicate charge or a wrong staff count caused by us), within [14] days of confirming the error;
- the fee for any period during which we suspended or withdrew a product without a breach by you, pro rata;
- any amount the law requires us to refund, including under the CPA or ECTA (see 10.3).
10.3 Cooling-off for consumers. If you are a natural person contracting with us online (ECTA s44), you may cancel without reason or penalty within 7 days after the agreement is concluded. We will refund any payment within 30 days. [ATTORNEY: confirm application; services begun with consent during the period; interaction with free plans and the card-first rule.]
10.4 Refunds are paid back to the card used, through PayFast. We do not otherwise refund the fee for a month already started because you cancelled during it.
10.5 Raising your Loadwyse staff count bills the whole current month on the new count; lowering it takes effect from the next month. These are not refundable differences.
[ATTORNEY: Confirm 10.4 is fair under CPA s48 for consumer Customers, given that cancellation mid-month gives access to month end.]
11. If we end a product
If we withdraw a product or end your subscription for a reason other than your breach, we give at least [60] days' notice, the 90-day export window applies from the last day of access, and the same warnings and automatic deletion follow. You pay nothing after the last day of access.