Privacy notice
Version 2026-10-06. This notice explains what personal information [the seller’s registered name to be added] collects about the people who use SARAH, why, and what your rights are under the Protection of Personal Information Act 4 of 2013 (POPIA).
Who is responsible
[the seller’s registered name to be added], [physical address to be added]. Information officer: [information officer to be added], [email address to be added], [phone number to be added].
What we collect about you
- Your name, email address and, if you give it, your phone number, when you sign up, ask for access or are invited.
- The name and details of your business that you put in.
- Records of signing in: when, from which connection (IP address) and which device, so we can protect your account and show you where you are signed in.
- What you were invoiced by us and what you paid. Card payments are handled by PayFast; we never see or keep your card number.
- Emails we send you and whether they were delivered.
The information about other people inside your books (your customers, suppliers and staff) is yours. We handle it only as your operator, as set out in section 5 of the terms of use.
Why we use it
To provide SARAH to you under our agreement, to keep it secure, to send you the emails the service needs (sign-in links and codes, invoices, reminders about your free fortnight), and to meet our own legal obligations such as keeping tax records. We do not sell your information, and we do not use it for advertising.
Cookies
SARAH uses only the cookies it needs to work: one that keeps you signed in, one that remembers a device you have already confirmed so you are not asked for a code every time, and one that lasts two minutes while a new connection key is shown to you once. There are no advertising or tracking cookies. The pages load their lettering from Google Fonts, which means your browser asks Google for it.
Who else handles it
Our hosting and service providers process information for us under contract: the web hosting (Vercel), the database hosting (Railway), the email service (Resend) and, if you pay by card, PayFast. Some of these process information outside South Africa, including in the United States. POPIA section 72 allows this where the information stays protected to a standard substantially similar to POPIA; we use providers bound by contract to keep it secure and confidential.
How long we keep it
For as long as you have an account, then for 90 days after it is closed so you can take a copy, then it is deleted, except records the law requires us to keep (for example, our own invoices and payment records, which tax law requires to be kept for five years).
Your rights
You may ask what personal information we hold about you, ask us to correct or delete it, and object to how we use it. Write to the information officer above. You also have the right to complain to the Information Regulator: inforegulator.org.za.
If something goes wrong
If we have reason to believe your personal information has been accessed by somebody who should not have it, we will tell you and the Information Regulator as POPIA section 22 requires.