Kredit Tools Privacy Policy

1. Who we are

Kredit Tools (Pty) Ltd (registration number K2026528258), of Nooitgedacht Village, Stellenbosch ("Kredit Tools", "we", "us"), provides desktop calculation and compilation software for South African accounting professionals.

This Privacy Policy explains how we process personal information in connection with our website, account system, billing, and support. It should be read with our Terms and Conditions.

Information officer contact for privacy requests: hello@kredittools.co.za.

2. Scope — what this policy covers (and what it does not)

2.1 This policy covers personal information we actually hold: typically account registration details, authentication data, subscription and payment metadata, support correspondence, and limited technical logs needed to run the service.

2.2 The Kredit Tools desktop applications keep client working files on your device. In ordinary use we do not upload, receive, or host your clients' ledgers, source documents, or working papers. For that local personal information, you (or your firm) are the responsible party under the Protection of Personal Information Act, 2013 ("POPIA"). We are not the responsible party for client files that never leave your machine.

3. Personal information we collect

Depending on how you use the service, we may process:

• Identity and contact details — email address; name if supplied by you or by an identity provider (for example Google Sign-In).
• Account and authentication data — password hashes (managed by our auth provider), session tokens, OAuth identifiers, email-confirmation status.
• Billing and subscription data — subscription status, period end dates, payment references, amounts, and PayFast-related tokens or event metadata. We do not store full card numbers.
• Referral codes you choose to enter at signup (free text).
• Support content — emails or messages you send to us, and our replies.
• Legal-acceptance records — Terms and Privacy version identifiers, acceptance timestamp, method (password / Google / re-acceptance), and limited request metadata (IP address and user agent) used as evidence of clickwrap acceptance.
• Technical data — basic server and security logs reasonably necessary to operate, secure, and debug the website and APIs.

4. How we collect it

• Directly from you when you create an account, sign in, subscribe, cancel, delete an account, or contact support.
• From identity providers when you choose Google Sign-In (email and profile name fields the provider shares with us).
• From payment operators (PayFast) when you pay or when payment events are notified to our systems.
• Automatically from your browser or app when you use the website or authenticated APIs (for example IP address and user agent on acceptance and security-relevant requests).

5. Purpose and lawful basis

We process personal information to:

• create and secure your account, and verify email addresses;
• provide, maintain, and improve the Software and website;
• manage subscriptions, trials, billing, cancellations, and refunds where applicable;
• record and evidence your acceptance of Terms and this Privacy Policy;
• respond to support requests and operational communications;
• detect abuse, enforce our Terms, and protect our rights and systems; and
• comply with applicable law.

Under POPIA, these purposes are pursued on the bases that processing is necessary to conclude or perform our contract with you, necessary for legitimate interests that are not overridden by your rights (including security and product improvement), and/or necessary to comply with a legal obligation. Where consent is required, we ask for it — including affirmative acceptance of this policy at account creation or when a material update requires fresh acceptance.

6. Operators and infrastructure (high level)

We use carefully selected operators to process personal information on our behalf, including:

• Supabase — authentication and application database hosting.
• PayFast — payment processing for subscriptions.
• Vercel — website and API hosting.
• Email delivery providers used to send confirmation, security, and transactional messages.

Operators may only process personal information on our documented instructions and as needed to provide their services. The set of operators may change as we evolve the stack; material changes to how account data is handled will be reflected in an updated Privacy Policy version.

7. Cross-border transfers

Some operators host or process data outside the Republic of South Africa (for example cloud infrastructure in other jurisdictions). Where personal information is transferred outside South Africa, we take reasonable steps consistent with POPIA — including using operators under appropriate agreements and assessing that the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection, or that another POPIA ground for transfer applies.

8. Security

We implement reasonable technical and organisational measures appropriate to the nature of the information we hold — including encrypted transport (HTTPS), access-controlled databases, secret keys held only on the server, and least-privilege access patterns for account data. No method of transmission or storage is perfectly secure; you must also protect your devices, local client files, and login credentials.

9. Retention

We retain account and billing records for as long as your account is active and thereafter for a period reasonably required for legal, tax, dispute, and audit purposes. Legal-acceptance records are retained as evidence of contract formation. Support emails are retained for as long as needed to resolve queries and maintain an operational history. When you delete your account through the product flow, we remove or de-identify account data we no longer need, subject to records we must keep by law or for legitimate residual purposes (for example completed payment records).

10. Your rights as a data subject

Subject to POPIA, you may request access to personal information we hold about you, correction of inaccurate information, deletion or destruction where appropriate, restriction of processing, and objection to processing in the circumstances POPIA allows. You may also lodge a complaint with the Information Regulator.

To exercise rights against Kredit Tools for information we hold, email hello@kredittools.co.za with enough detail for us to verify your identity and locate the relevant records. We will respond within the periods POPIA requires.

For personal information in client files stored only on your devices, contact your firm's information officer — we do not hold those files.

11. Children

The Software is aimed at professional adult users. We do not knowingly collect personal information from children under 18 for account creation.

12. Changes to this policy

We may update this Privacy Policy from time to time. The version identifier on this page shows the current version. Material changes require a fresh affirmative acceptance before continued use of the account, consistent with our Terms.

13. Complaints

If you have a concern, contact us first at hello@kredittools.co.za so we can try to resolve it. You also have the right to complain to the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Email: complaints.IR@justice.gov.za (confirm the current address on the Regulator's site)