Legal · Privacy

Lepel — privacy statement

Effective 27 October 2026. Heynstech (Pty) Ltd, registration number 2020/849453/07, 114 Strydom Street, Schoemansville, Hartbeespoort, 0216, North West.

Who we are

Lepel is made and run by Heynstech (Pty) Ltd, a South African company. Our information officer is Marthinus Heyns, who can be reached at marthinus.heyns@heynstech.co.za.

Two kinds of information, two roles

• Your organisation's documents. Everything your organisation keeps in Lepel (orders, approvals, timesheets and the rest) belongs to your organisation. Your organisation decides what is kept, who may see it and why. We hold and process it on your organisation's behalf, as its operator under the Protection of Personal Information Act (POPIA).
• Our own records. To sign you in, keep Lepel secure and bill for its use, we keep a small set of records of our own. For those we are the responsible party.

What we receive when you sign in

You sign in to Lepel with your organisation's Microsoft account. Lepel has no passwords of its own and never sees yours. When you sign in, Microsoft sends us:

• the identifier of your account;
• the identifier of your organisation's directory;
• your name and email address.

The consent screen asks for three permissions: to use Lepel as you, to keep you signed in, and to read your basic profile. These are the only permissions Lepel asks for.

What Lepel keeps

• Documents and their history. Each document your organisation saves, and every earlier version of it. Lepel is a record system: an ordinary document's history is kept, and it leaves the work by its workflow (voided, cancelled), not by deletion.
• An audit record of every call. Who asked, when, what was asked, and whether it was allowed. This is how a change, or a refusal, can always be traced.
• Usage records. What was used, so that it can be billed.
• Conversations with Lepel's assistant, kept as part of your organisation's records.

Personal and health information

Some documents an organisation keeps are about people: for example, an employee's sick note, which a South African employer holds under the Basic Conditions of Employment Act and POPIA. Each such record is encrypted with its own key, held in Microsoft Azure Key Vault. Its content is never put into a notification, an email or a support chat.

When your organisation marks a record as personal and then destroys it, its key is destroyed. Every copy, including those in our backups, becomes unreadable within 7 days. We keep the fact that the record existed and was destroyed, and when.

Where it is kept, and for how long

Lepel runs on Microsoft Azure in South Africa (the South Africa North region).

• Database backups are kept for 7 days.
• Stored files can be recovered for 30 days after they are removed.

When your organisation's subscription ends, we keep its documents until it asks us to return them as an export or to delete them.

Who else handles it

We use a small number of service providers, each only for what Lepel needs:

• Microsoft: hosting (Azure), sign-in (Microsoft Entra ID) and email (Azure Communication Services, with its data kept in Africa). Also the AI model behind Lepel's assistant: an OpenAI model provided by Microsoft through Azure OpenAI, in Heynstech's own Azure subscription. Its resource is in South Africa, but it is a global deployment, so Microsoft may process a request in another Azure region to answer it.
• Cloudflare: every request to a lepel.app address passes through Cloudflare's network, which protects it and carries it securely.
• Xero: only when your organisation connects Lepel to its Xero, and only what that connection needs.

What you send Lepel's assistant is not used to train AI models, and it is not shared with OpenAI.

How it is protected

• Sign-in happens only through Microsoft.
• Every read and every write is limited in the database itself, not only in Lepel's code, to what the person's access allows.
• Every call is recorded.

Your rights

Under POPIA you may ask to see the personal information held about you, ask for it to be corrected or deleted, and object to how it is used.

• For anything in your organisation's documents, ask your organisation first: it decides what is kept.
• For our own records, write to our information officer at marthinus.heyns@heynstech.co.za.

If you are not satisfied, you may complain to the Information Regulator (South Africa), at inforegulator.org.za.

Changes

When this statement changes, we publish the new version here with its date.