Privacy Policy

This Privacy Policy explains how LicenseDesk (operated by Siphamandla Blowu, "we", "us") collects, uses and protects personal information when you use the LicenseDesk service (the "Service"), in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information we collect

• Account information: name, email address, organisation name, and password (stored as a salted bcrypt hash, never in plain text).
• Licence & contract data: the licence, vendor, contract and attachment records you or your team enter into the Service.
• Billing information: for paid plans, our payment processor Stripe collects and stores your card details directly — we never see or store full card numbers ourselves.
• Usage & log data: login timestamps, IP address, and basic audit-log entries (who changed what, and when) used for security and accountability.

2. Why we process it

We process personal information because it is necessary to:

• create and administer your account and provide the Service you've signed up for (performance of a contract);
• send licence-expiry alerts and account/security emails (e.g. password resets) to the responsible users you designate;
• process subscription payments and prevent fraud;
• maintain audit logs and enforce plan limits, for security and legitimate business purposes;
• comply with legal obligations, such as tax and accounting record-keeping.

3. Who we share it with

We do not sell personal information. We share it only with service providers who process it on our behalf, under contract, to help us run the Service:

• Supabase — hosts our PostgreSQL database (Customer Data and account records).
• Render — hosts our backend API.
• Vercel — hosts our frontend web application.
• SendGrid — sends transactional email (expiry alerts, password resets).
• Stripe — processes subscription payments for paid plans.

Some of these providers may process data on servers outside South Africa. Where that happens, we rely on the provider's own compliance certifications and contractual safeguards (such as standard data-processing agreements) as required by POPIA for cross-border transfers.

4. How long we keep it

We retain your account and Customer Data for as long as your account is active, and for at least 30 days after trial expiry or subscription cancellation in case you reactivate. After that period, we may permanently delete it. You can request earlier deletion at any time (see Section 6).

5. Security

Passwords are hashed with bcrypt; sessions use short-lived JWTs with rotating, HttpOnly-cookie refresh tokens; all traffic is encrypted in transit (HTTPS); and every record is scoped to your organisation so other tenants cannot access it. No method of storage or transmission is 100% secure, but we take reasonable technical and organisational measures to protect your information.

6. Your rights

Under POPIA, you have the right to:

• ask us to confirm what personal information we hold about you and access it;
• ask us to correct or delete inaccurate or outdated personal information;
• object to processing of your personal information in certain circumstances;
• lodge a complaint with the Information Regulator (South Africa) if you believe we have not handled your information lawfully.

To exercise any of these rights, email privacy@licensedesk.co.za.

7. Cookies

We use only strictly necessary cookies — an HttpOnly session cookie that keeps you signed in and lets your browser talk to our API. We do not use third-party advertising or tracking cookies.

8. Children

The Service is intended for business use and is not directed at, or knowingly used by, children.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

10. Contact & Information Officer

For any privacy question or request, email privacy@licensedesk.co.za. As required by POPIA, LicenseDesk designates an Information Officer responsible for compliance with this policy; details of the appointed Information Officer are available on request.