Ifikile

Privacy notice

Last updated: 19 October 2026

This notice explains what personal information Ifikile handles, where it goes, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

Who is responsible

Heferon (Pty) Ltd, registration number 2026/337285/07, is the responsible party for the payment and sales records described in sections 3 and 6.

• Physical address: 30 Ranksuikerbos Street, Protea Valley, Cape Town
• Email: hello@heferon.com

Information officer: the head of Heferon (Pty) Ltd, who is the company's information officer under POPIA section 1. Reach the information officer at hello@heferon.com with “Privacy” in the subject line.

The short version

• Jobs, photos, signatures and locations stay on the devices of the people who use Ifikile. Heferon never receives them.
• They leave a device only when someone in the operation chooses to send or download a record.
• If your business subscribes to the Operation plan, the payer's work email and the company name go to Paystack, the payment provider. Heferon keeps them, with the amount, the date and the payment reference, in its HubSpot account so it can set up the operation and keep a customer record. A Telegram message tells the founder about each sale with the amount and the last six characters of the payment reference only.
• Card details go only to Paystack.
• Ifikile has no accounts, no advertising and no tracking cookies. It counts page visits with Vercel Web Analytics, which records the page address, the referring site, country, browser and device type. Vercel identifies a visit by a code made from the request and discards it after 24 hours. Job records, photos, signatures and locations are never part of it.
• The payment and sales records are stored outside South Africa (section 7).

1. Jobs, photos, signatures and locations

What: the job details the office types (reference, customer, address, notes, checklist), and what the driver adds: ticks, photos, the signature, the name of the person who received the job and, only if the driver taps for it, the phone's location rounded to about 11 metres.

Where it is kept: in the browser storage of the device that made or received it. Photos are shrunk and re-saved on the phone, which removes the location and camera details phones hide inside photo files.

Where it goes: a job link carries the job inside the part of the link after the # sign, which browsers do not send to any web server, including Heferon's. The link passes through the app the office uses to send it, usually WhatsApp. A sealed record leaves the driver's phone only when the driver taps Send or Download and chooses where it goes. Ifikile's visit counts remove everything after the ? and # in a page address before they are sent, so no job detail is ever part of them.

Who is responsible for it: the business using Ifikile decides why it collects this information and is the responsible party for it. Heferon does not receive it, cannot see it and cannot correct or recover it. Questions about a record go to the business that made it.

2. Your card details

You enter card details only on Paystack's secure payment page. They never reach Heferon.

3. The payer's work email and company name

What: the work email address and the company or operation name typed on the plans page when subscribing.

Purpose: Paystack needs an email address to process the payment, send receipts and run the monthly subscription. Heferon uses the email and company name to confirm the subscription, help the operation set up, answer questions, handle cancellations and refunds, and keep the financial records the law requires.

Voluntary or required: giving them is voluntary. Without them the subscription cannot start. The free plan needs neither.

Where they go: Ifikile's checkout function on Heferon's hosting passes them once to Paystack to open the payment page. The function does not store them and does not write them to any log. When Paystack confirms a payment, it tells Heferon, and the details in section 6 go to Heferon's sales records.

Legal basis: processing that is necessary to carry out the subscription you asked for (POPIA section 11(1)(b)), keeping the financial records the law requires (section 11(1)(c)), and Heferon's legitimate interest in onboarding and supporting its business customers (section 11(1)(f)). Where the business is a company and the email belongs to someone who works there, the basis for that person's email is Heferon's legitimate interest in running the subscription the business asked for (section 11(1)(f)). Heferon does not use these details for marketing.

How long: Heferon keeps its record of each payment for five years from the date it submits its income tax return for the tax year in which the payment was made, as the Tax Administration Act 28 of 2011 requires, or longer while SARS is auditing that year. Contact details in Heferon's sales records are deleted within 12 months after a subscription ends, unless the person concerned asks Heferon to keep in touch. Paystack keeps its own copy under its own legal duties.

4. The plan code on the office device

After a confirmed payment, Ifikile keeps a short signed code in the office device's browser that unlocks the plan. It holds Paystack's customer code for the subscription and an expiry date, and no name or email address.

5. Website hosting and visit counts

Ifikile is hosted on Vercel. Like any website, each request from a browser reaches the host with its IP address. Ifikile's payment functions keep the IP address in memory only, while that server instance runs, to stop repeated automated requests. It is never written to storage. For each request to those functions, Vercel's platform logs record the time, the page address and its search parameters (for the payment check, the random payment reference), the result, the browser type and the server region. Vercel can match these logs to the IP address of the request. Ifikile's own log lines carry status codes only, never an email or a company name. Vercel keeps these logs for no more than one day, and collects log data to run its own service under its privacy notice at vercel.com/legal/privacy-policy.

Visit counts: Ifikile uses Vercel Web Analytics to count page visits. It records the page address (without its search parameters or anything after the #, so no job detail or payment reference is ever part of it), the referring site, country, browser and device type. It sets no cookies. Vercel identifies a visit by a code made from the request and discards that code after 24 hours. Job records, photos, signatures and locations are never part of it.

6. Who receives personal information

• Paystack (payment provider): the payer's work email, the company name, and the payment and subscription details.
• Vercel (hosting and visit counts): IP addresses and ordinary request data, the visit counts described in section 5, and the work email and company name as they pass through the checkout function on their way to Paystack.
• Heferon's own sales records: for each first payment, the amount, the date, the last twelve characters of the payment reference, the payer's work email and the company name go to Heferon's HubSpot account, so Heferon can set up the operation. A Telegram message to the founder announces each sale or renewal with the amount and the last six characters of the payment reference, and each cancellation or failed payment by product only. It carries no name or email address.
• Email and WhatsApp: if you write to hello@heferon.com or send Heferon a WhatsApp message, your message and contact details are held in Heferon's Google Workspace mailbox or its WhatsApp account.

Heferon does not sell, rent or share personal information with anyone else, and does not use it for advertising or marketing.

7. Information outside South Africa

The payment and sales records are stored and processed outside South Africa.

• Paystack states that its data is stored on a private AWS cloud with servers located in Ireland, and that it may transfer personal data to other Paystack companies under its Binding Corporate Rules, or to its service providers.
• Vercel states that its primary processing facilities are in the United States, and that it may process data anywhere Vercel or its subprocessors operate.
• HubSpot (Heferon's customer records) holds the payer's work email and the company name under a data processing agreement that, HubSpot states, uses the EU-US Data Privacy Framework and standard contractual clauses for transfers. Telegram carries the founder's sale messages, which hold no name or email address.

These transfers are needed to carry out and set up the subscription the business asks for (POPIA section 72(1)(c)). Paystack, Vercel and HubSpot also receive the information under their own binding rules or written agreements (section 72(1)(a)). Vercel states that it uses standard contractual clauses or other legal mechanisms when it transfers information. Paystack states that transfers between Paystack companies follow its Binding Corporate Rules. HubSpot's data processing agreement forms part of its customer terms.

8. Security

Ifikile sends information only over encrypted connections. Payment runs on Paystack's hosted page. The checkout function passes the email and company name to Paystack and keeps no copy. Sealed records carry a SHA-256 fingerprint so changes after sealing can be detected.

9. Your rights

Under POPIA you have the right to:

• ask Heferon whether it holds personal information about you, and for a copy;
• ask Heferon to correct or delete personal information about you;
• object to the processing of your personal information on reasonable grounds; and
• lay a complaint with the Information Regulator.

To use any of these rights, email hello@heferon.com with “Privacy” in the subject line. Heferon only holds the payment and sales records described in sections 3 and 6. For a job record, ask the business that made it. Paystack also takes requests about the data it holds at dpo@paystack.com.

10. The Information Regulator

The Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Telephone: 010 023 5200, toll free 0800 017 160. General enquiries: enquiries@inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za.

(Contact details checked on inforegulator.org.za/contact-us on 19 October 2026.)

11. Changes to this notice

If this notice changes, the date at the top changes. A change that affects information already collected is emailed to subscribers before it applies.