Privacy Policy

Last updated: September 2026

This is a draft prepared for KF Books and has not been reviewed by an attorney. In particular, appoint and name an actual Information Officer below (POPIA requires this) before treating this page as final.

This Privacy Policy explains how KF Books collects, uses, and protects personal information, in line with South Africa's Protection of Personal Information Act, 2013 ("POPIA").

1. Who We Are

KF Books ("we", "us") is the responsible party for the personal information described in Sections 2–3 below (your own account and billing details). Where you use the Service to capture your own customers' or staff's personal information, you are the responsible party for that information, and we act as an operator on your behalf — see Section 4.

2. Information We Collect

Account & billing information: business name, contact name, email, phone, business address, VAT number, and payment reference details you provide when signing up or paying.
Business data you enter: your customers' names, emails, and addresses; invoices, quotes, expenses, and inventory records; a drawn signature if a customer accepts a quote online.
Technical data: a session cookie needed to keep you logged in, and IP address/timestamp recorded against actions you take in the Service (for security and audit purposes).

3. How We Use Your Information

We use this information to provide and bill for the Service, to communicate with you (invites, receipts, reminders, support replies), to keep the Service secure (audit trail, detecting suspicious login activity), and to comply with our own legal obligations.

4. Your Customers' Data (Operator Relationship)

When you capture your own customers' or staff's personal information in the Service, we process it only as an operator acting on your instructions — we don't use it for our own purposes, and you remain responsible for having the necessary rights and consents to capture it. We apply reasonable technical and organisational measures to keep this data secure.

5. Sharing & Third Parties

We don't sell personal information. It may be shared with: our hosting provider (to run the Service); your own configured email provider, if you've set up Custom Email under Business Profile, for emails sent on your behalf; and payment/banking details you provide us, used only to invoice you. We disclose information where required by law.

6. Security

Sensitive credentials (such as a custom email password) are encrypted at rest. Access to the admin panel is logged in an audit trail, and repeated failed login attempts trigger an internal security alert. No system is perfectly secure, but we take reasonable steps to protect your data and will notify you of any security incident that may affect it.

7. Data Retention & Your Rights

We keep your account data for as long as your subscription is active. If your account is cancelled, you have 14 days to export your data (via Export Data in your portal) before it may be permanently deleted. Under POPIA, you have the right to request access to, correction of, or deletion of your personal information, to object to certain processing, and to lodge a complaint with the Information Regulator (South Africa) if you believe your information has been mishandled.

8. Cookies

We use one session cookie, required to keep you logged in. We don't use advertising or tracking cookies.

9. Children's Privacy

The Service is intended for business use by adults and is not directed at children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Where a change is material, we'll give existing clients reasonable notice by email.

11. Contact & Information Officer

For any privacy-related question or request, or to lodge a complaint, contact kfbooks@kumlehn-frank.life.