Privacy policy
Ledgr holds the most sensitive thing a business owns: what it earns, who it pays and what its staff take home. This document says what we do with that information, what we do not do with it, and what you can require of us. It is written in plain language, so that you can actually read it.
Effective 1 September 2026 · Last updated 1 September 2026
Who we are
Ledgr is a cloud business platform for South African businesses — accounting, invoicing, banking, payroll, SARS returns, inventory, CRM and the rest. It is operated by BC Mobile Technologies (Pty) Ltd, a company registered in South Africa and based in Cape Town, Western Cape.
In this document, Ledgr, we and us mean BC Mobile Technologies (Pty) Ltd in respect of the Ledgr service. You means the business that holds a Ledgr account and the people who sign in to it. This policy covers the Ledgr application at ledgrsa.com/app, the Ledgr website you are reading, the Ledgr API, the customer, employee, supplier and driver portals, and every email or message Ledgr sends on your behalf.
It applies alongside the terms of service, which govern the commercial relationship, and security & POPIA, which describes in technical terms how the protections below are actually implemented.
We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA) and the Consumer Protection Act 68 of 2008.
Ledgr plays two different roles, and the difference matters
This is the one thing worth reading twice, because almost every question about who may do what with a given record is answered by it.
1. We are the responsible party for your account
Your name, your work email, the business you registered, what plan you are on, what you have paid, which device you signed in from, what your users did in the audit log. That is information we decided to collect in order to run Ledgr as a service. We answer for it.
2. We are your operator for the books you keep
Your customers' names and addresses, your employees' ID numbers and salaries, your suppliers' banking details, the photograph of a till slip. You decided to collect that, for your own purposes. You are the responsible party for it under POPIA. We process it on your instruction and for no other reason.
POPIA section 21 requires a written arrangement between a responsible party and its operator, obliging the operator to establish and maintain the security measures section 19 requires. These terms are that arrangement. Specifically, as your operator we undertake that:
- We process the personal information in your books only with your knowledge and authorisation — to provide the service you asked for, to support you when you ask, and to meet a legal obligation on us. Nothing else.
- We treat it as confidential and do not disclose it, except as section 8 sets out
- We do not sell it, rent it, share it with advertisers, or use it to train any machine learning model — not ours, and not anyone else's
- We maintain the security measures described in section 11 and in security & POPIA
- We notify you immediately where there are reasonable grounds to believe that personal information in your books has been accessed by an unauthorised person
- Where we use another processor to deliver part of the service, we impose the same obligations on them — the list is in section 7
If one of your customers, employees or suppliers wants to know what is held about them, correct it, or have it deleted, the request is yours to answer — you are the responsible party, and the record is in your books. Ledgr's job is to make that request easy to answer: every contact and employee record is viewable, printable and exportable from the app. Where you need our help, ask, and we will assist without charge.
What we collect
3.1 Information you give us directly
When you register, subscribe, invite a colleague, or contact us:
- Name and surname, work email address, telephone number
- Business name, trading name, registration number, VAT registration number, business address and financial year end
- The plan you chose, the add-ons you bought, and the record of what you were charged
- Support correspondence — what you asked us, and what we answered
3.2 Information you put into your books
This is your data, held under section 2.2 above. It typically includes personal information about people who are not Ledgr users:
- Contacts — customers, suppliers, tax practitioners: names, addresses, email, telephone, VAT numbers, credit terms, B-BBEE status
- Employees — full names, identity or passport numbers, tax reference numbers, bank account details, salaries, medical scheme and retirement contributions, leave records, and the payslips and IRP5 certificates computed from them
- Documents you upload or forward — receipts, supplier invoices, bank statements, product photographs, signatures, logos and attachments
- Transactions — invoices, quotes, bills, expenses, journals, bank lines, stock movements, job cards, timesheets and everything else that makes up a set of books
Employee identity numbers, bank details and health-related deductions are special personal information or otherwise sensitive under POPIA. We hold them because a payroll cannot be run without them, and for no other purpose.
3.3 Information collected automatically
- IP address, browser and version, operating system, device type, and the pages or endpoints you requested, with timestamps — ordinary server logs, kept for operating and securing the service
- An installation identifier generated on your device, so a session can be revoked per device rather than per person
- A push notification token, if you switch push notifications on
- The audit log — who signed in, who changed what, and when. It is written by the server rather than the app, because its whole value is that it records what happened rather than what the interface reported
3.4 Location, and only where you asked for it
If you use Ledgr's driver mode for deliveries, the app records the device's location when a driver captures a proof of delivery, and — only where the business holds the live-tracking add-on — periodically while a trip is running and the app is open. Without that add-on no position is collected during a trip at all, and any kept from before is deleted. Trip positions are kept for 90 days (see How long we keep it). That is what lets you prove a delivery if it is disputed. Three deliberate limits:
- Background location is never requested. Nothing is recorded once the app is closed or the trip has ended
- The distance between the driver and the delivery address is computed on our server from two coordinate pairs, and is never accepted from the device — because it is the figure that makes a proof of delivery contestable
- A refused location permission does not block anything. The proof is simply recorded as weaker evidence, and says so
3.5 What we deliberately do not collect
- Card numbers. Payment card details are entered on the payment provider's own hosted page and never reach Ledgr, whether you are paying us or your customer is paying you
- Online banking credentials. Ledgr does not ask for, store, or screen-scrape a bank login. A bank feed uses read-only API credentials you issue yourself in your own online banking
- The IP address and browser of a customer who accepts a quote. Both are personal information that would need its own purpose and retention period; the acceptance is recorded through a link signed for one document and the time it was answered
- A log of every notification sent. Push messages are delivered and not recorded
- Tracking cookies, analytics cookies and advertising identifiers. See section 13
What we use it for
- Providing the service — keeping your books, computing your returns, rendering your documents, and delivering them to the people you send them to
- Authenticating you, and enforcing the roles and permissions you configured
- Billing you, collecting payment, and issuing renewal reminders and licence keys
- Supporting you when you ask, which sometimes means an authorised member of our team looking at the record you are asking about
- Keeping the service secure and available — rate limiting, abuse prevention, backups, and investigating a fault
- Improving Ledgr, using aggregate and de-identified usage figures rather than the contents of anybody's books
- Meeting our own legal obligations — tax, company law, and a lawful request from a regulator or a court
Not our own, and not a third party's. Document recognition runs on Ledgr's own servers: a receipt you photograph is read where it is stored and is not sent to an outside recognition service. Where Ledgr suggests a category or a match, the suggestion is learned from what your business did before, inside your account, and it is never pooled across customers.
The lawful basis for each of those
Scroll the table sideways to see every column.
| Basis under POPIA section 11 | What we rely on it for |
|---|---|
| Performance of a contract | Running your account, keeping your books, billing you, and supporting you. Most of what Ledgr does sits here. |
| Legal obligation | Keeping the records tax and company law require us to keep, and responding to a lawful request. |
| Legitimate interest | Securing the service, preventing fraud and abuse, and understanding aggregate usage in order to improve the product. |
| Consent | Optional things you switch on: push notifications, location in driver mode, WhatsApp messaging, and any marketing email. Each can be withdrawn without affecting the rest of the service. |
| Your instruction, as responsible party | Everything in section 2.2 — the personal information inside your books. Your lawful basis for holding it is yours to establish; ours for processing it is your instruction. |
Where your information lives
Ledgr runs in Google Cloud's africa-south1 region — Johannesburg.
Your ledger, your documents and your uploaded files are stored in South Africa. Backups stay
in the same region as the data they came from.
- Everything is carried over HTTPS. The app, the API, the portals and the webhook receivers all refuse plain HTTP
- The database and the file storage are encrypted at rest by the platform. Merchant credentials and two-factor seeds carry a second layer, encrypted by Ledgr before they reach the database
- Uploaded files sit in private object storage, one namespace per business. A file is served by a link signed for one file and expiring shortly after — there is no address anyone can guess or forward indefinitely
- A copy of your own data is available on demand, on every plan, from Settings → Data → Export all data
Some of the services in section 7 necessarily process information outside South Africa. Where they do, we rely on POPIA section 72 — the recipient is subject to a law or a binding agreement that upholds principles of lawful processing substantially similar to POPIA's, or the transfer is necessary for the performance of our contract with you. The table says which is which.
Who else handles your information
These are our operators. Each does one job, under contract, and none of them is permitted to use your information for anything else. Several are optional — they are only involved if you switch that part of Ledgr on.
Scroll the table sideways to see every column.
| Who | What they do, and when | Where |
|---|---|---|
| Google Cloud | Hosting, the database, private file storage and backups. Always. | South Africa (Johannesburg) |
| Mailjet | Sending email — invoices, statements, payslips, reminders, renewal notices — and receiving documents you forward to your Ledgr inbox address. Always. | European Union |
| Yoco | Our own subscription checkout, always. Separately, and only if you connect your own Yoco account, your customers' card payments to you. | South Africa |
| Firebase Cloud Messaging (Google) | Only if you enable push: delivering a notification to your device. It carries a short title and line of text, not your data. | Outside South Africa |
| WhatsApp Business Platform (Meta) | Only if you enable WhatsApp: delivering a document or a reminder on your instruction. | Outside South Africa |
| PayFast | Only if you connect your own PayFast account: your customers' card payments to you. | South Africa |
| Investec | Only if you connect a bank feed: reading your transactions, with credentials you issue yourself in your own online banking. | South Africa |
| Google Maps | Logistics module only: map tiles, fetched through Ledgr's own server so no key and no request of yours reaches Google directly. | Outside South Africa |
If you connect a third-party product to Ledgr with an API key of your own — a point-of-sale system, your own software, an accountant's tooling — data moves on your instruction and that product's privacy terms then apply to what it receives. An API key is scoped to the modules you tick and can be revoked at any time from Roles & Users → API Keys.
We will keep this list current. If we add an operator that processes personal information in your books, we will update this page and, where the change is material, tell you before it takes effect.
When we disclose anything
We do not sell, rent or trade personal information. There is no advertising business here, and no data brokerage. Disclosure happens in five circumstances and no others:
- To the operators in section 7, to the extent each needs in order to do its job
- To the recipient you addressed. When you email an invoice, send a statement on WhatsApp or share a portal link, we deliver it to the person you named
- To your own professional advisors, where you have granted them access — a tax practitioner or external auditor you invited, or a practice you are linked to
- Where the law requires it — a court order, a statutory demand, or a lawful request from a regulator or law enforcement. We satisfy ourselves that the request is valid, we disclose the minimum it calls for, and we tell you unless we are legally forbidden to
- In a business transfer — if Ledgr is sold or merged, your information would move with it, subject to this policy. You would be told before it happened and would be free to export and close your account
How long we keep it
POPIA says personal information may not be kept longer than is necessary. Tax law says some of it must be kept for years. Both apply at once, and this is how we balance them.
Scroll the table sideways to see every column.
| What | How long | Why |
|---|---|---|
| Your books, while you are a customer | For as long as your account is active | It is needed to provide the service |
| Your books, after the plan ends | Read-only for one month. After that the account can be closed for good | Long enough to export. Warnings go out 21, 7 and 1 days before the closing date, naming it; that date is the earliest the account can be closed. What closing removes, and what it does not, is in the note below this table |
| Audit log | Kept for seven years by default, then deleted | The period the Companies Act sets for company records, which covers the five years the Tax Administration Act requires for records behind a return. Your Owner or Admin can choose a different period under Roles & Permissions → Security, never shorter than those five years |
| Trip positions (live tracking) | Kept for 90 days, then deleted — and not kept at all for a business without the live-tracking add-on. A trip still under way keeps its own until it ends | Long enough to answer a question about a recent trip. The distance a trip covered is recorded on the trip itself when it ends, so deleting its positions changes no figure. Proof-of-delivery locations are evidence of the delivery and are kept with it |
| Billing records | Five years after the transaction | Tax Administration Act 28 of 2011 |
| Support correspondence | Up to 12 months after the conversation ends | To pick up where we left off, and no longer |
| Server and security logs | Short-lived, in the ordinary course of operating the platform | Diagnosing faults and investigating abuse |
| Backups | On the platform's rolling schedule | A deletion works through the backup cycle rather than reaching into every historical snapshot |
| Marketing consent | Until you withdraw it | Withdrawing is one click in any message we send |
Inside your books, a financial record is soft-deleted: it comes out of your working views and the transaction and its audit trail remain. That is not a Ledgr limitation, it is the Tax Administration Act — you may remove a customer's marketing preferences and contact details, but you may not destroy the tax invoices you issued them.
No sooner than the date in those warnings, the whole account is closed, and that is irreversible. Exactly what happens:
- every file anyone uploaded to it — receipts, photographs, signatures, logos, and the backups Ledgr made of the account — is deleted outright;
- the email address and name of every user on it are overwritten and their passwords cleared, so nobody can sign in again;
- the account itself is closed, so nothing in it can be opened through Ledgr again, and none of it can be restored.
What closing does not do is erase the records you typed in. Your accounting entries, invoices, contacts, and employees with their payroll details stay in Ledgr's database, closed off from use but not erased and not anonymised. If you want personal information in them destroyed once the account is closed, ask us under section 10; the tax-record duty described above still applies to what the law requires you to keep.
Your rights, and how to use them
Under POPIA you may:
- Ask what we hold about you, and be given access to it
- Correct or complete anything inaccurate, irrelevant, misleading or out of date
- Have it deleted or destroyed where we are no longer entitled to keep it
- Object to processing on reasonable grounds, where we rely on legitimate interest
- Withdraw consent at any time, without affecting processing that was lawful before you withdrew it
- Receive a copy of the data you gave us in a usable format — which for your books is the export in the app, available at any time and without asking us
- Complain to the Information Regulator, at section 18
Most of these you can exercise yourself in the app, immediately: your own profile under Settings, your team's access under Roles & users, and the export under Settings → Data. For anything else, email support@bcmobiletech.co.za. We respond within 30 days. We may need to verify who you are first — which is a protection for you, not an obstacle — and POPIA prescribed forms are accepted where you would rather use them.
If your details are in a Ledgr account because a business you deal with keeps its books here — you are their customer, their employee or their supplier — then that business is the responsible party and your request goes to them. If you cannot reach them, or you do not know who holds your information, write to us anyway. We will identify the responsible party where we can, pass the request on, and help them answer it.
How we protect it
POPIA section 19 requires appropriate, reasonable technical and organisational measures. In summary, ours are:
- Encryption in transit (HTTPS/TLS) and at rest, with a second layer of encryption applied by Ledgr to merchant credentials and two-factor seeds
- Strict separation between businesses. Every row of every table carries the identity of the business it belongs to, every query is scoped to the business on your signed session token, and the database enforces that separation underneath the application as well as inside it
- Role-based access control with per-module, per-action permissions, two-factor authentication, single-use recovery codes, lockout policies, session timeouts, and the ability to revoke a session on one device
- An immutable audit trail of who did what
- Access by our own staff limited to those who need it to support or operate the service, and logged
- Regular review of the above, and a published route for reporting a vulnerability to us
Security & POPIA sets all of this out in the detail a due-diligence questionnaire asks for. No electronic system can be guaranteed absolutely secure, and we do not claim otherwise — what we commit to is the standard above and to improving it.
If something goes wrong
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, POPIA section 22 requires notification. We will:
- Notify the Information Regulator, and the affected data subjects, as soon as reasonably possible after establishing what has happened
- Notify you immediately where the information affected is in your books, because you are the responsible party and the obligation to notify your own data subjects is yours
- Describe what happened, what information was involved, what we are doing about it, and what you should do — in plain terms, not a holding statement
- Say so even where the answer is embarrassing. A breach nobody is told about is a second failure on top of the first
If you believe you have found a vulnerability, please tell us before you tell anyone else: security@bcmobiletech.co.za. The disclosure terms are on the security page.
Cookies, and why there is no banner
Ledgr sets no cookies at all — not on this website, and not in the application. There is no cookie banner because there is nothing to consent to.
The web application keeps your signed-in session, your device identifier and your appearance preference in your browser's local storage instead. That is a deliberate choice rather than a technicality: a cookie is attached to every request the browser makes to the domain, where local storage is read only by the application that wrote it, and is cleared when you sign out or clear your browser's site data.
On a phone or a desktop install, the same information is kept in the operating system's own app storage. Where you have worked offline, a copy of the pages you opened is cached on the device so they can be read again with no signal — that copy lives on your device, is scoped to the business and company you were in, and is removed when you sign out.
There is no third-party analytics, no advertising pixel, no session recording and no cross-site tracking anywhere in Ledgr. If that ever changes, this page will change first, and anything that requires consent will ask for it.
Automated processing, and where a person decides
Ledgr suggests things: a category for an expense, a match between a bank line and an invoice, a supplier read off a photographed receipt, a figure extracted from a statement. POPIA section 71 restricts decisions made solely by automated means that have legal consequences for someone.
- Every suggestion is a proposal a person accepts or overrides. Nothing is posted to your ledger, paid, approved or filed because software concluded it should be
- Where a bank rule you configured acts on its own, it acts on the rule you wrote, and every action it takes is on the transaction and in the audit log
- Ledgr makes no decision about any person — no credit scoring, no profiling, no risk rating of your customers or your staff
- A recognised figure is always shown next to the document it was read from, so it can be checked rather than trusted
Messages — ours to you, and yours to your customers
What we send you
Service messages — a renewal reminder, a licence key, a security alert, a notice that your plan is about to lapse — are part of the service and are not marketing. You cannot switch those off while you hold an account, because they are how you find out about your own money. Anything genuinely promotional is separate, is opt-in, and every one carries an unsubscribe that works.
What you send through Ledgr
When Ledgr sends your customers an email or a WhatsApp message on your instruction, you are the sender in law. Direct marketing by electronic means is restricted by POPIA section 69 and by the Consumer Protection Act, and obtaining the consent those require is your responsibility, not ours. Ledgr gives you the place to record it: each contact carries their marketing consent per channel — given or withdrawn, how, when and by whom, with every change kept — and a marketing list exported from Contacts holds only the people whose consent on that channel stands. Invoices, statements and reminders are not marketing and are not affected. Ledgr sends what you tell it to, to the people you tell it to, and keeps a record so you can show what went where.
Every notification Ledgr sends on your behalf can be switched off, per channel and per type, in Settings → Notifications — including the collections reminders that chase your customers, so you can stop them for a customer who has asked you to.
Children
Ledgr is a business product and is not offered to, or directed at, anyone under 18. We do not knowingly collect the personal information of a child as a user, and will delete it promptly if we discover we have.
Where a customer lawfully employs a person under 18 and records them in payroll, that information is processed under section 2.2 on the customer's instruction, and the customer is the responsible party — including for the additional protection POPIA gives a child's personal information.
Changes to this policy
We update this page when what we do changes. The effective date at the top always says which version you are reading. Where a change materially affects how we handle your information — a new operator with access to your books, a new purpose, a shorter or longer retention period — we will tell you by email before it takes effect, rather than relying on you to notice.
Continuing to use Ledgr after a change takes effect means you accept the updated policy. If you do not, you may export your data and close your account; the terms of service say how.
The Information Regulator
If you are not satisfied with how we have handled your information or your request, you may complain to the regulator. You do not need our permission and you do not have to come to us first — although we would rather you did, because we can usually fix it faster.
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints about your personal information (POPIA):
POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Telephone: 010 023 5200, or toll-free 0800 017 160
inforegulator.org.za — check
there for the current details and complaint forms before you write.
Contact us
Our Information Officer, and everyone else at Ledgr, can be reached at the addresses below. Say what you need in plain terms — you do not have to cite a section of the Act to be answered.
BC Mobile Technologies (Pty) Ltd — operator of Ledgr
Cape Town, Western Cape, South Africa
Privacy, access requests and general enquiries:
support@bcmobiletech.co.za
Security and vulnerability reports:
security@bcmobiletech.co.za
Billing: billing@bcmobiletech.co.za
Information Officer (a request under PAIA or POPIA): Andrew Ian Cameron,
andrew@bcmobiletech.co.za — how to make one is in our
PAIA manual
The technical version of all of this
How the isolation, the encryption, the portals and the audit trail actually work — written for the person doing your security review.