Last updated 25 October 2026

Privacy policy

This policy explains how Nathan Mabasa, who runs LedgerMate (“we”, “us”), handles personal information when you use LedgerMate and this website. We wrote it to be read, not skimmed past. It is aligned with the Protection of Personal Information Act, 2013 (POPIA).

1. Who is responsible

We are the responsible party for personal information about you as a LedgerMate user and website visitor. Contact our Information Officer, Nathan Mabasa, at hello@nathanmabasa.com.

For information about your customers and suppliers that you put into LedgerMate (for example on invoices or in bank statement descriptions), you are the responsible party and we act as your operator. We process that information only to provide LedgerMate to you, under the security measures described below (POPIA sections 20 and 21). You are responsible for having a lawful reason to hold it.

2. What we collect

Account details: your name, email address and password (stored in hashed form by our sign-in provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
Business details you enter: trading name, address, VAT and registration numbers and banking details printed on invoices.
Financial records you save: invoices, customers, spending and the bank transactions you choose to add, including the descriptions banks print (which can contain names of people you paid or who paid you).
Receipts you attach to costs (photos or PDFs), which can show supplier details and what you bought. They are deleted with the business or your account.
Messages you send us through the contact form or by email.
Two-step sign-in, if you switch it on: the key for your authenticator app (stored encrypted) and fingerprints of your backup codes, never the codes themselves.
Technical information needed to run a secure service: sign-in cookies, IP address and browser details in server logs.
Website analytics, only if you allow it: which pages of our public website you visit, your approximate location, device and how you found us, through Google Analytics. Never inside the app.

What we do not collect

Your bank statement files. They are read inside your browser and are never uploaded. Only the transactions you choose to save reach our servers.
Statement passwords or banking passwords. We never ask for your online banking login.
Advertising data. We do not use advertising cookies, and analytics never runs inside the app where your records are.

3. Why we use it, and our lawful basis

To provide LedgerMate (sign-in, storing and showing your records, generating invoices and tax estimates): necessary to perform our agreement with you.
To keep LedgerMate secure and prevent abuse: our legitimate interest in protecting you and the service.
To reply to you and give support: necessary to deal with your request.
To meet legal obligations, such as responding to lawful requests from authorities.
Optional sharing (section 5): only with your consent, which you can withdraw at any time.
Website analytics: only with your consent, to learn which pages help people. You can withdraw it with Cookie settings at the bottom of every page.

We do not use your personal information for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

We use carefully chosen operators to run LedgerMate. Each may only use your information to provide their service to us:

Neon (database and sign-in), which stores data in Frankfurt, Germany (European Union).
Vercel, in Frankfurt, Germany (European Union) to host the website and app.
Google, only if you choose to sign in with Google, and for Google Analytics on our public website if you allow it.
Resend, only when you email an invoice or quote from LedgerMate. It delivers the email to your customer, so it handles your customer’s name and email address, the invoice and your message.
Appwrite, to deliver messages sent through our contact form to our inbox.
Sentry (stored in the European Union), to tell us when something breaks. Error reports leave out your records, messages, email address and anything typed into forms.

We do not sell your personal information. We may disclose information if the law requires it, or to a buyer of our business, who would be bound by this policy.

In Settings you can choose, separately, to switch on:

Anonymised insights: allow your records to be included in anonymised, combined statistics (for example, average costs for salons in Gauteng). Before they are used, your records are de-identified and combined with those of many other businesses, so that no business or person can be identified. We may share or sell these statistics. They never include personal information.
Partner offers: allow us to tell you about, and with your go-ahead introduce you to, carefully chosen partners such as business lenders or insurers.

Both are off unless you switch them on, and you can switch them off at any time. Switching them off does not affect your use of LedgerMate. We never share your customers’ details with partners.

If you switch anonymised insights off, we stop including your records in future statistics. Statistics already made cannot be traced back to you, so they cannot be taken apart again. If you never switch it on, your records are never used in statistics that we share or sell.

6. Google user data

If you sign in with Google we request only basic profile access (your name, email address and profile picture) to create and secure your account. LedgerMate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not allow humans to read it except for security, legal or support reasons you agree to, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

7. Information sent outside South Africa

Our database is located in Frankfurt, Germany (European Union). The European Union’s General Data Protection Regulation provides protection substantially similar to POPIA, and our operators are bound by agreements that require them to protect your information (POPIA section 72). If you allow website analytics, Google may process that information in other countries, including the United States, under its data processing terms.

8. How long we keep it

Account and business records: while your account is open.
When you delete your account in Settings, we permanently delete your workspace, records and login straight away. Keeping your tax records is your own duty (SARS generally requires five years), so download your data first.
Backups held by our database provider expire within its retention period.
Contact messages: up to two years.
The record that you accepted our terms (your email, the version and the date): three years after your account closes, in case of a dispute about what was agreed.
Server logs: up to 90 days unless needed to investigate a security incident.
Website analytics: up to 14 months in Google Analytics.

9. How we protect it

Data is encrypted in transit. Each business’s records are separated by database row-level security so that one business cannot see another’s data. Ledger entries are append-only. Access to production systems is limited to people who need it. Read more on our security page. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

10. Your rights

Under POPIA you may ask us to confirm whether we hold your personal information and for a copy of it; to correct or delete it; to object to processing based on legitimate interests; and to withdraw consent. You can download your data yourself from Settings. To make a request, email hello@nathanmabasa.com. See our POPIA and PAIA page for details.

You may also complain to the Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za, or enquiries@inforegulator.org.za.

11. Cookies

We use cookies that are needed to keep you signed in and secure, and Google Analytics cookies on our public website only if you allow them. See our cookie policy.

12. Children

LedgerMate is for businesses and is not intended for anyone under 18.

13. Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.

Last updated 25 October 2026

Privacy policy

1. Who is responsible

We are the responsible party for personal information about you as a LedgerMate user and website visitor. Contact our Information Officer, Nathan Mabasa, at hello@nathanmabasa.com.

2. What we collect

Account details: your name, email address and password (stored in hashed form by our sign-in provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
Business details you enter: trading name, address, VAT and registration numbers and banking details printed on invoices.
Financial records you save: invoices, customers, spending and the bank transactions you choose to add, including the descriptions banks print (which can contain names of people you paid or who paid you).
Receipts you attach to costs (photos or PDFs), which can show supplier details and what you bought. They are deleted with the business or your account.
Messages you send us through the contact form or by email.
Two-step sign-in, if you switch it on: the key for your authenticator app (stored encrypted) and fingerprints of your backup codes, never the codes themselves.
Technical information needed to run a secure service: sign-in cookies, IP address and browser details in server logs.
Website analytics, only if you allow it: which pages of our public website you visit, your approximate location, device and how you found us, through Google Analytics. Never inside the app.

What we do not collect

Your bank statement files. They are read inside your browser and are never uploaded. Only the transactions you choose to save reach our servers.
Statement passwords or banking passwords. We never ask for your online banking login.
Advertising data. We do not use advertising cookies, and analytics never runs inside the app where your records are.

3. Why we use it, and our lawful basis

To provide LedgerMate (sign-in, storing and showing your records, generating invoices and tax estimates): necessary to perform our agreement with you.
To keep LedgerMate secure and prevent abuse: our legitimate interest in protecting you and the service.
To reply to you and give support: necessary to deal with your request.
To meet legal obligations, such as responding to lawful requests from authorities.
Optional sharing (section 5): only with your consent, which you can withdraw at any time.
Website analytics: only with your consent, to learn which pages help people. You can withdraw it with Cookie settings at the bottom of every page.

We do not use your personal information for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

We use carefully chosen operators to run LedgerMate. Each may only use your information to provide their service to us:

Neon (database and sign-in), which stores data in Frankfurt, Germany (European Union).
Vercel, in Frankfurt, Germany (European Union) to host the website and app.
Google, only if you choose to sign in with Google, and for Google Analytics on our public website if you allow it.
Resend, only when you email an invoice or quote from LedgerMate. It delivers the email to your customer, so it handles your customer’s name and email address, the invoice and your message.
Appwrite, to deliver messages sent through our contact form to our inbox.
Sentry (stored in the European Union), to tell us when something breaks. Error reports leave out your records, messages, email address and anything typed into forms.

We do not sell your personal information. We may disclose information if the law requires it, or to a buyer of our business, who would be bound by this policy.

In Settings you can choose, separately, to switch on:

Anonymised insights: allow your records to be included in anonymised, combined statistics (for example, average costs for salons in Gauteng). Before they are used, your records are de-identified and combined with those of many other businesses, so that no business or person can be identified. We may share or sell these statistics. They never include personal information.
Partner offers: allow us to tell you about, and with your go-ahead introduce you to, carefully chosen partners such as business lenders or insurers.

Both are off unless you switch them on, and you can switch them off at any time. Switching them off does not affect your use of LedgerMate. We never share your customers’ details with partners.

6. Google user data

7. Information sent outside South Africa

8. How long we keep it

Account and business records: while your account is open.
When you delete your account in Settings, we permanently delete your workspace, records and login straight away. Keeping your tax records is your own duty (SARS generally requires five years), so download your data first.
Backups held by our database provider expire within its retention period.
Contact messages: up to two years.
The record that you accepted our terms (your email, the version and the date): three years after your account closes, in case of a dispute about what was agreed.
Server logs: up to 90 days unless needed to investigate a security incident.
Website analytics: up to 14 months in Google Analytics.

9. How we protect it

10. Your rights

You may also complain to the Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za, or enquiries@inforegulator.org.za.

11. Cookies

We use cookies that are needed to keep you signed in and secure, and Google Analytics cookies on our public website only if you allow them. See our cookie policy.

12. Children

LedgerMate is for businesses and is not intended for anyone under 18.

13. Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.

Privacy policy

1. Who is responsible

2. What we collect

What we do not collect

3. Why we use it, and our lawful basis

4. Who we share it with

5. Your choices about sharing

6. Google user data

7. Information sent outside South Africa

8. How long we keep it

9. How we protect it

10. Your rights

11. Cookies

12. Children

13. Changes

Your books, sorted from day one.

Privacy policy

1. Who is responsible

2. What we collect

What we do not collect

3. Why we use it, and our lawful basis

4. Who we share it with

5. Your choices about sharing

6. Google user data

7. Information sent outside South Africa

8. How long we keep it

9. How we protect it

10. Your rights

11. Cookies

12. Children

13. Changes

Your books, sorted from day one.