Ledgeforge privacy notice
DRAFT 0.4 for attorney review, 22 October 2026. Not published. Not in force.
Replaces the separate FinSight (myfinsight.co.za) and Loadwyse privacy wording once approved.
Effective date: [DATE OF PUBLICATION]
Version: [VERSION]
1. Who we are
Ledgeforge Software (Pty) Ltd (registration number 2026/774859/07) ("Ledgeforge", "we", "us") makes online software for businesses and accounting practices:
- Accounting · by Ledgeforge (bookkeeping, invoicing, VAT records)
- FinSight · by Ledgeforge (automated analysis of a business's financial information)
- Loadwyse · by Ledgeforge (a practice management tool for accounting firms)
- the Ledgeforge login and portal at login.ledgeforge.co.za, where people sign in once to every product, and
- Ledgeforge Billing, which issues invoices and takes card payments through PayFast.
Together we call these the "Services". The company, firm or practice that subscribes to a Service is our "Customer". The people who sign in are "Users".
Information Officer: Jeffrey Nash, jeffrey@nashass.co.za
Address: 10 Cloyne Kenmare, Kenmare, Mogale City, Gauteng, 1739
Telephone: 083 550 0535
[ATTORNEY: Confirm Jeffrey Nash is the correct Information Officer (POPIA s55 and PAIA s1: by default the head of the private body) and that registration with the Information Regulator is filed before publication. Confirm the address matches the registered office and the address printed on invoices. Consider a dedicated mailbox such as privacy@ledgeforge.co.za instead of a nashass.co.za address, so the practice and the software company are kept apart.]
2. Two different roles: whose information is it?
We handle personal information in two different capacities. This matters because it decides who you should ask about your information.
(a) Information our Customers put into the Services ("Customer Data"). When a Customer keeps its clients, suppliers, staff, transactions, documents or bank statements in Accounting, imports financial information into FinSight, or keeps its staff, clients and work in Loadwyse, the Customer decides why and how that information is used. Under the Protection of Personal Information Act, 2013 ("POPIA") the Customer is the responsible party and Ledgeforge is its operator: we process that information only on the Customer's instructions, under our Operator Terms (an annex to our Terms of Service).
If you are a client, supplier or employee of one of our Customers and want to know what is held about you, please contact that Customer first. If you contact us, we will pass your request to the Customer and help it respond, but we will not decide the request ourselves.
(b) Information we collect for ourselves ("Account Data"). For the people who sign in, the Customer's billing contact, people who visit our websites or ask for a demonstration, pilot participants and people who contact support, Ledgeforge is the responsible party. The rest of this notice is mainly about Account Data.
[ATTORNEY: Brief Q1. Please confirm the operator / responsible party split. Note one grey area: the sign-in records of a Customer's own staff are held by us as responsible party (we need them to run one login across products), while the same person's details inside a Customer's books are Customer Data. Confirm this is a defensible line.]
3. What Account Data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | first and last name, email address | you, or the person who invited you |
| Sign-in and security | sign-in times, two-factor status (we never see the authenticator secret in readable form), session records, IP address, browser and device type, the result of the Cloudflare Turnstile check | your browser and our sign-in service |
| Membership | which organisations you belong to, your role (owner, admin, member), which products you may use, when your membership began | the organisation's owners and admins |
| Consent records | the date and time you accepted this notice when you accepted an invitation | you |
| Organisation and billing | organisation name, billing contact email, plan, staff or seat count, invoices, payment records and payment results from PayFast, a card token from PayFast (we never receive or store full card numbers) | the Customer, and PayFast |
| Audit records | who did what and when (for example "closed organisation", "downloaded export") | the Services |
| Support and correspondence | messages, emails, call notes | you |
| Website and demo requests | name, email, company, message | you, through a form |
| Email delivery | recipient address, subject, whether delivery succeeded or bounced | our email service |
| Notice records | for every email that carries a legal, payment or account notice (invitations, invoices, payment reminders, suspension notices, cancellation confirmations, deletion warnings, closure notices): the recipient address, the time sent, a copy of the message or a fingerprint (a one-way hash) of it, the email provider's message ID, whether sending succeeded, any later delivery, bounce or complaint status, and the reason for the notice with the related invoice, subscription or closure reference | our systems and our email service |
We do not ask for special personal information (such as health, religion or biometric information) or information about children for our own purposes. Customers should not put such information into the Services unless they have a lawful basis to do so (see our Acceptable Use Policy).
[ATTORNEY: Customers' Customer Data may contain ID numbers, tax numbers, salaries and bank details of employees. Confirm the Operator Terms (and not this notice) are the right place to deal with that, and whether anything in Loadwyse (staff records) needs specific treatment.]
4. Why we use it, and on what basis
| Purpose | Basis under POPIA s11 |
|---|---|
| Creating your login, signing you in once to every product, two-factor, ending old sessions | performing the contract with the Customer and with you (s11(1)(b)); our legitimate interest in keeping accounts secure (s11(1)(f)) |
| Deciding which products and organisations you can use | performing the contract |
| Invoicing, taking payment, keeping financial records | performing the contract; legal obligations (tax and company law) (s11(1)(c)) |
| Security: blocking automated attacks (Turnstile), refusing passwords known to be leaked, rate limits, audit logs | legitimate interest; protecting the Customer's data (s19) |
| Sending service emails (invitations, sign-in notices, invoices, closure notices) | performing the contract |
| Support | performing the contract; legitimate interest |
| Telling Customers about new features or similar products | legitimate interest for existing customers about similar services, with an opt-out in every message (s69(3)); otherwise only with consent |
| Answering demo requests | your request (s11(1)(b) or consent) |
| Keeping notice records as proof that a notice, warning or invoice was sent, when, to which address, and whether it was delivered | legitimate interest in proving that we gave the notices our terms and the law require, and in defending legal claims (s11(1)(f)) |
| Meeting legal duties and defending legal claims | legal obligation; legitimate interest |
We do not sell personal information. We do not use it for advertising profiles.
Automated analysis. FinSight produces automated analysis: figures, ratios and observations calculated by fixed rules from the financial information the Customer imports. It describes a business's accounts. It does not make decisions about individual people and does not profile them. A person reviewing the analysis decides what to do with it.
[ATTORNEY: Confirm the automated analysis does not fall within POPIA s71 (decisions based solely on automated processing with legal or substantial effect on a data subject). The current FinSight policy grants an s71 right; keep a short sentence on it?]
5. Who we share it with
We use a small number of service providers ("sub-processors"). Each receives only what it needs.
| Provider | What it does | Where | What it receives |
|---|---|---|---|
| Amazon Web Services (AWS) | hosting of every Service, the databases, file storage, encrypted backups, and the sign-in directory (Amazon Cognito) | Cape Town, South Africa (af-south-1) | all data held in the Services, stored encrypted |
| AWS Simple Email Service (SES) | sending service emails | [Cape Town, or REGION if SES is not offered in Cape Town] | recipient address, subject and message |
| PayFast | card payments and recurring billing | South Africa | billing contact, amount, card details (entered directly with PayFast, never with us) |
| Cloudflare Turnstile | checking that a sign-in is made by a person, not a program | Cloudflare's global network, which may be outside South Africa | technical browser and connection signals, including IP address, at the moment of sign-in |
| Have I Been Pwned (Pwned Passwords) | checking a new password against known leaked passwords | outside South Africa | only the first 5 characters of a one-way hash of the password; never the password, your name or your email |
We also share information when the law requires it (for example with SARS or a court), with our professional advisers under confidentiality, and with a buyer of the business if the business is sold (with notice to you).
[ATTORNEY: Brief Q6. (1) Confirm whether Cognito and SES are available in af-south-1; the build team has not verified it. (2) Is Turnstile's processing at sign-in a cross-border transfer under s72, and if so which ground applies (contract necessity, adequacy, or binding agreement such as Cloudflare's DPA)? (3) We treat the 5-character hash prefix as not personal information; confirm. (4) Do we need to name sub-processors here or only in the Operator Terms schedule?]
6. Where it is stored
All Services, databases, uploaded files and backups are hosted by AWS in Cape Town. Information leaves South Africa only as described in section 5. Where it does, we rely on [ATTORNEY: ground under s72].
7. How long we keep it
We keep information only for as long as we need it or the law requires. Our periods are:
| Information | How long |
|---|---|
| Finished sign-in sessions and app sessions | 30 days after they end |
| Duplicate-message checks between our systems | 30 days |
| The PDF copy attached to an email we sent | 30 days after sending |
| Email delivery records for ordinary emails (recipient, subject, status) | 365 days |
| Notice records (section 3), including the recipient's email address | 5 years from the date of sending. They are Ledgeforge's own records and are not deleted when a Customer's data is deleted [ATTORNEY: confirm 5 years; it follows the prescription period for most contractual claims under the Prescription Act 68 of 1969 s11(d)] |
| Invitations (accepted, expired or withdrawn) | deleted 90 days after they end (an invitation is valid for 7 days) |
| A former User's name and email inside a product | blanked 90 days after their last access to that product ends; an internal ID is kept so the audit history stays readable |
| Everything a Customer put into a product (Customer Data), including accounting records | while subscribed; deleted automatically 90 days after that product's last day of access (section 8) |
| Ledgeforge's own invoices to the Customer, payments received from it, and the audit log | [5 / 7] years, as the law requires for Ledgeforge's own books [ATTORNEY: confirm period] |
| Prepared export files in Loadwyse | 7 days |
| Backups | daily backups kept 35 days; no monthly or longer backups |
Backups. When information is erased from the live Services, we do not edit old backups. Erased information disappears from backups as they expire, at the latest 35 days later. [ATTORNEY: Q10 / O-27, confirm the 35-day backup period.] If we ever restore a backup, we re-apply every erasure made since that backup was taken before the Services are used again.
[ATTORNEY: Brief Q2. Confirm the periods, and the legal source for Ledgeforge's own records (Companies Act s24 7 years; Tax Administration Act s29 5 years). Confirm the "not inside backups, gone within 35 days" approach is acceptable.]
8. When a Customer leaves: automatic deletion after 90 days
When a Customer cancels a product, closes its organisation, or its subscription is ended, the owner can sign in and download that product's data for 90 days after its last day of access. The owner can download until the end of the 90th day (24:00 UTC). Straight after that, everything the Customer put into that product is permanently and automatically deleted, including accounting records, users, uploaded files and settings. When no product remains, the organisation's details and card tokens are deleted too.
- The Customer is responsible for downloading and keeping its own records. Ledgeforge does not keep them for it.
- We email the owners when the subscription ends, and 30 days and 7 days before deletion. The Customer is responsible for keeping owner and billing email addresses up to date; we are not responsible for warnings sent to addresses that are no longer valid or monitored, and deletion goes ahead regardless.
- Ledgeforge keeps only its own records about the Customer: the invoices it issued, the payments it received, the audit log, and the notice records of the emails it sent (including the addresses they went to), for the periods in section 7.
- Copies in backups disappear as the backups expire, at the latest 35 days later.
Full details are in our Cancellation, Refund, Data Export and Deletion Terms.
[ATTORNEY: Brief Q3 and Q4. Confirm that deleting the Customer's accounting records at day 90 is lawful because the record-keeping duty rests with the Customer.]
9. How we protect it
We use reasonable technical and organisational measures (POPIA s19), described in our Security Statement. In short: encrypted connections, encrypted storage and backups, two-factor sign-in for every staff User, one active session per person, refusal of leaked passwords, separation of each Customer's data with automated tests, audit logs, secrets kept in a secret store, and strictly limited staff access that is itself logged.
If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will tell the Information Regulator and the affected people as POPIA s22 requires. Where it is Customer Data, we will tell the Customer immediately so it can meet its own duties (s21).
10. Your rights
You may:
- ask whether we hold information about you, and for a copy (POPIA s23; requests for records may also be made under our PAIA manual);
- ask us to correct, update or delete information (s24);
- object to processing based on legitimate interest, and to direct marketing at any time (s11(3));
- withdraw consent where we rely on it;
- complain to the Information Regulator.
Write to the Information Officer (section 1). We may need to confirm your identity first. We will answer within a reasonable time and in any event within [30] days [ATTORNEY: confirm]. Some information cannot be deleted while the law requires us to keep it; if so, we will tell you what we keep and until when.
Deleting your own login. If you want your own login removed (rather than an organisation closed), write to the Information Officer. [ATTORNEY and JEFFREY: the shared contracts do not yet cover a person erasing their own account. The draft process is: we remove the person from every organisation (an owner must first be replaced, because an organisation always needs an owner), then blank their name and email, keeping an ID for the audit log.]
Information Regulator
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: POPIAComplaints@inforegulator.org.za
General: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za
[ATTORNEY: confirm current contact details.]
11. Cookies
We use only the cookies needed to sign you in and keep you signed in. See our Cookie Notice.
12. Changes
If we change this notice in a way that matters, we will tell Customers' owners by email and show a notice at sign-in at least [30] days before the change takes effect, unless the law requires a faster change.