Privacy Notice

Signal Ledger is the responsible party for your personal information under the Protection of Personal Information Act (POPIA). The Information Officer is the owner, Jerry Pretorius. Contact: privacy@signalledger.co.za. How to ask for records we hold: our PAIA manual.

What we collect and why

When you give us your name and email (to save your report, create an account or buy): your first name and email address, so we can save your report and deliver what you buy.

When you buy: your name, email address, what you bought, the amount (and any special or discount code used), the date, PayFast's payment reference and any refund. We need these to deliver your order, to help you if something goes wrong and to keep the records tax law requires.

Emails: when you sign up we send you one email with a link back to your checklist. More emails (a few tips over the next two weeks) only if you tick the box asking for them and then confirm with the link in that first email, and they stop if you buy. About two weeks after a purchase we ask once whether the documents helped. Every one of these emails has an unsubscribe link, and you can also ask us to stop at any time. Emails about an order you placed are not affected. If you unsubscribe or ask us to delete your details, we keep only your email address on a do-not-email list, so that we can keep honouring your request.

Help chat: the questions you type are used to answer you. If our FAQ has no answer, we keep that question for up to 90 days so we can add one; numbers and email addresses are removed first, and the question is not linked to you. Nothing else you type is saved by us. When the AI assistant is switched on, your question, and the type of business you picked (if any), is sent to our AI provider to produce the answer. If you mark an answer 👎, we keep that question in the same way, so we can improve the answer. Do not type ID numbers, passwords or bank details into the chat.

In your browser: your business profile, checklist ticks, compliance calendar answers, cart and display settings are saved on your own device so the site remembers them. They are not sent to us unless you sign up, buy, ask for reminder emails or save them to an account. So that the site opens without signal, your browser also keeps a copy of the page and its public files (no personal information); clearing the site's data in your browser removes it.

Accounts: if you sign in, we keep your email address and the businesses you save (name, type of business, checklist ticks, calendar answers and tender tracker dates) so you can open them on any device. Signing in uses a link we email you, and one cookie that keeps you signed in for 30 days; it is needed for the account to work and is not used for tracking. If an accountant, bookkeeper or adviser with SignalLedger Pro invites you, your email address is used only to send the invitation; nothing is shared until you accept from your own inbox. Then they can see (not change) the businesses you keep in your account, until you or they stop sharing, which you can do at any time from "My account". If you take SignalLedger Pro, we keep the plan and its payments like any other order (PayFast handles the card or bank details).

Visitor statistics: we count visits with Cloudflare Web Analytics, which does not use cookies and does not collect personal information. The site also counts, per day and by the link a visitor came from, how many visits reach the checklist, the gap report and the cart; nothing that identifies anyone is sent or kept. See "Cookies and what we save on your device" below.

Videos on our Learn pages: nothing loads from YouTube until you press play. The video then plays from YouTube in privacy-enhanced mode: YouTube (Google) receives your internet address and may set cookies under its own privacy policy.

Protection against abuse: to stop automated misuse, the site counts how many requests come from one internet address over a few minutes. The address itself is not saved, and the count is deleted afterwards. When you send the sign-up form, a help request or a partner application, Cloudflare Turnstile checks that a person sent it: it looks at your browser and internet address, may ask you to tick a box, and tells us only whether the check passed (Cloudflare handles that information under its own privacy policy, not for advertising). If the page hits a technical error, a short description of the error is sent to us so we can fix it; email addresses and phone and other long numbers are removed from it first.

Cookies and what we save on your device

One cookie, only if you sign in: it keeps you signed in for 30 days. Scripts on the page cannot read it, it only travels over a secure connection, and it is not used for tracking. We use no advertising, analytics or other tracking cookies, so there is no cookie banner.

On your own device: your business type, checklist ticks, calendar answers, cart, language and display settings (including data saver); your name and email if you gave them, so forms are filled in for you; and, once you start an order, a random number with no name in it. That number is sent to us only with an order, and when the page checks whether this device has paid before, so it can show your orders here. A copy of the page and its public files is kept so the site opens without signal.

Counting visits and videos: Cloudflare Web Analytics counts visits without cookies, and nothing loads from YouTube until you press play on a video.

Clear what this site saved on this device This signs you out and removes everything above from this device. It does not delete what we hold: for that, email us (see "Your rights").

Who else handles it

We do not sell your information. These service providers process it for us, only to do the job named:

• PayFast (South Africa): takes your payment.
• Resend (outside South Africa): sends your delivery email.
• Cloudflare (worldwide): hosts the website and the order database, connects you to the website, counts visits and checks that forms are sent by a person (Turnstile).
• Cloudflare Workers AI (our host, worldwide): answers help-chat questions from our FAQ and reads a "describe your business" description to suggest business types. It is sent without numbers that look like ID or account numbers, and is not kept, apart from help-chat questions the FAQ could not answer (see below).
• Registered professionals we work with (South Africa): only if you ask for help with a checklist item and agree, the one professional who accepts your request receives your details for that request (see "Help from a professional" below).
• Anthropic (outside South Africa): answers help-chat questions only if we switch it on instead of Cloudflare Workers AI.

Because some of these providers are outside South Africa, your information is transferred and stored outside the country. We send it only to these providers, only for the job named, and only because it is needed to give you what you asked for; each is bound by its terms with us to keep it confidential and secure (POPIA, section 72).

How long we keep it

Order records: at least 5 years, because tax law requires it. Signup details: until you ask us to delete them, and no longer than 24 months after your last activity. Orders that were started but never paid: 30 days. Help-chat questions our FAQ could not answer: 90 days. Deadline reminders: your calendar answers until you stop the reminders (a link in every email deletes them at once), at most 24 months after you last saved your answers. Accounts: until you ask us to delete them, and no longer than 24 months after you last signed in or your Pro plan was last paid. Invitations not accepted: 30 days. Pro plan payments: 5 years, for tax. Sign-in links: 1 day.

Invite links and advisers: if you sign up through someone's invite link, we record that their link brought you, so they get their free document; they see only how many friends signed up, never who. If you invite your adviser (accountant, bookkeeper or consultant), we email them once to ask; they see your businesses only if they accept, and you can stop sharing at any time.

Children: SignalLedger is not meant for people under 18 to give us their personal information. Everyone who signs up, signs in, accepts an invitation or buys confirms that they are 18 or older, and we keep the time they confirmed it (never an age or date of birth). If we learn that we hold a child's personal information without a parent's or guardian's consent, we delete it; a parent or guardian can ask us to at privacy@signalledger.co.za (POPIA, sections 34 and 35).

Deadline reminders (SignalLedger Pro): if you switch on reminder emails in the calendar, we keep the calendar answers you gave (how you trade, registration date, year end, VAT category, whether you employ people and any dates you added) with your account's email address, only to email you before each date, on the days you choose (30, 7 and 1 day before unless you change them). Nothing is sent while your Pro plan is not paid up.

Help from a professional: if you ask for help with a checklist item, we keep what you type in the form (your name, phone, email, province and town, business details and answers about the job) and the time you agreed. A partner offered the job sees the job without your name, contact details, business name, registration number or notes; only the professional who accepts sees those, for your request only, and we email you who it is. Partners are independent responsible parties for what they do with your details after that. We delete your details 90 days after a professional accepts, or 30 days after your request if no one does; the bare record (service, province, dates and fee) stays for our accounts. To withdraw a request, reply to our email.

Partners: if you apply to be a partner, we keep your name, firm, contact details, professional body and registration number, services, areas and the leads you accepted, to check your registration, send you job cards and invoice lead fees, for as long as you are a partner and then as tax law requires for the invoices.

Law update emails (SignalLedger Pro): if you switch them on in My account, we use your account's email address and the business types of the businesses in your account (and of your clients' businesses that you can see) to email you when a law update we publish affects one of them. We keep a record of which updates we emailed you, so you get each one once, for as long as you have the account. Switch them off in My account at any time.

Your rights

You may ask what we hold about you (and for a copy in a common electronic format), ask us to correct or delete it, object to how we use it, and withdraw consent to marketing. Email privacy@signalledger.co.za. We reply within 30 days.

If you are not satisfied, you may complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, inforegulator.org.za.

If you are outside South Africa

We are based in South Africa and SignalLedger is meant for South African businesses. If you use it from elsewhere, we handle your information as this notice describes, under POPIA. If the data protection law of your own country also applies (for example the GDPR in the European Union or the UK GDPR), you have the rights it gives you as well: to see, correct or delete your information, to restrict or object to how we use it, to receive a copy in a common electronic format, to withdraw consent at any time, and to complain to the data protection authority in your country.

Why we may use your information: to deliver what you ask for or buy, and to run your account (contract); to keep the records tax law requires (legal obligation); to send tips, reminders and other optional emails (your consent, which you can withdraw with the link in every email); and to keep the site safe and working and count visits without identifying anyone (legitimate interests). We do not sell or share your information for advertising, and we make no decisions about you by automated means that have legal or similar effects on you.

Security

The site uses HTTPS. Card details never reach us. Download links expire after 7 days. Sign-in, job card and confirmation links are single-purpose random links; we store only a one-way hash of them. Backups are encrypted. No system is perfectly secure: if a breach puts your information at risk we will tell you and the Information Regulator.

SignalLedger is meant for people aged 18 and over who run or are starting a business.

Last updated: 1 November 2026