This notice explains how leaffyHUB handles personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). It applies to the leaffyHUB web application and the Imani AI assistant inside it.
Who is responsible
The operator of this leaffyHUB account is the responsible party for the business data loaded into it. Contact the account owner for any request relating to your information.
What we collect
- Account details: email address, name, business name and business type.
- Financial records you add: invoices, expenses, receipts, clients and bank statement lines.
- Conversations with Imani, including voice recordings you choose to send.
- Technical logs needed to keep the service secure and available.
Why we process it
To provide the service you asked for: producing invoices, categorising expenses, estimating tax, forecasting cash flow and answering your questions. We also process information where required by law, and to protect the service against fraud and abuse.
AI processing
Imani is powered by third-party large language models. Content you send in a chat, an uploaded receipt or a voice note is transmitted to the model provider to generate a response. Do not paste passwords, ID numbers or card numbers into a chat. AI answers are general guidance, not certified accounting, legal or tax advice.
Sharing
We share information only with operators that run parts of the service on our behalf: cloud hosting and database storage, AI model providers, and — where you enable it — bank feed and payment providers. Operators are bound to process information only on our instructions. We do not sell personal information.
Storage and security
Data is stored in managed cloud infrastructure with encryption in transit and at rest. Access is restricted by row-level security so each business can reach only its own records. Team members you invite see the data you grant them through their assigned role.
Retention
Financial records are kept for as long as your account is active and, after closure, for any period required by SARS record-keeping rules (generally five years). You may ask for deletion of anything not subject to a legal retention obligation.
Your rights
Under POPIA you may request access to your personal information, request correction or deletion, object to processing, and lodge a complaint with the Information Regulator of South Africa. Requests are actioned within a reasonable period.
Changes
We may update this notice as the service changes. Material changes will be highlighted in the app before they take effect.