Skip to content
Deadline Desk

Deadline Desk · Legal

Deadline Desk privacy notice

Last updated: 19 October 2026

This notice explains what personal information Deadline Desk handles, where it goes, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

Who is responsible

Heferon (Pty) Ltd, registration number 2026/337285/07, is the responsible party.

  • Physical address: 30 Ranksuikerbos Street, Protea Valley, Cape Town
  • Email: hello@heferon.com (use "Privacy" in the subject line)
  • Information officer: the head of Heferon (Pty) Ltd, who is the company's information officer under POPIA section 1. Reach the information officer at hello@heferon.com with "Privacy" in the subject line.

The short version

  • The companies you enter, the client roster and your practice's branding stay on your device. Heferon never receives them.
  • If you subscribe to the Practice seat, your work email and practice name go to Paystack, the payment provider. On each sale Heferon keeps the amount, the date, the payment reference, your work email and your practice name in its HubSpot account, so it can set up your seat and keep a customer record. A Telegram message tells the founder about each sale with the amount and the last six characters of the payment reference only.
  • Your card details go only to Paystack.
  • Deadline Desk has no accounts, no advertising and no tracking cookies. It counts page visits with Vercel Web Analytics, which records the page address without its search parameters, the referring site, country, browser and device type. Vercel identifies a visit by a code made from the request and discards it after 24 hours. Your roster and branding are never part of it.
  • The payment record and the sale record are stored outside South Africa (see section 8).

1. The companies you enter, the roster and your branding

What: the facts you type about a company (incorporation date, financial year-end month, which registrations it holds, an optional B-BBEE affidavit date), the client names you give companies in the roster, your practice's name, the contact line you add, and the logo you upload.

Where it goes: nowhere. Deadline Desk works out the deadlines inside your browser and builds calendar files and client packs there. None of this is sent to Heferon, Paystack or anyone else.

Where it is kept: on the free calendar, nowhere: close the tab and it is gone. With the Practice seat, the roster and branding are kept in this browser's storage on your device until you delete them. The logo is redrawn on your device and stored there as a small image. A backup file is something you download and keep yourself. Anyone who uses the same browser could see what is saved.

Because Heferon never receives this information, Heferon cannot see, correct or recover it. The client details in your roster are your practice's to look after; Heferon does not process them for you.

2. Your work email and practice name

What: the work email address and the practice name you type when you subscribe.

Purpose: Paystack needs an email address to take the payment, run the subscription and send your receipts. Heferon uses the email and practice name to set up your seat, to contact you about your subscription (renewals, failed payments, cancellations, price or terms changes), and to keep a customer record. Heferon does not use them to market anything else to you unless you agree.

Voluntary or required: giving them is voluntary. Without them the subscription cannot start. The free calendar needs neither.

Where they go: Deadline Desk's checkout function on Heferon's hosting sends them once to Paystack to open the payment page. The function does not store them and does not write them to any log. When Paystack confirms a payment, it tells Deadline Desk's payment notice function, which passes the sale record described in section 6 to HubSpot, and sends the founder a Telegram message with no name or email address. That function's own log lines carry the event name and the reference tail only.

Who holds them afterwards: Paystack keeps the payment and subscription record (your email, the practice name, the amounts, the dates and the payment references) under its own terms. Heferon can see that record in its Paystack merchant account. Heferon keeps the sale record in HubSpot.

Legal basis: processing that is necessary to carry out the subscription you asked for (POPIA section 11(1)(b)), and keeping financial records the law requires (section 11(1)(c)). Where the practice is a company and the email belongs to someone who works there, the basis is Heferon's legitimate interest in running the subscription the practice asked for (section 11(1)(f)).

How long: Heferon keeps its record of each payment for five years from the date it submits its income tax return for the tax year in which you paid. The Tax Administration Act 28 of 2011 requires business records to be kept for that period. If SARS is auditing or investigating that year, the record is kept until the audit or investigation ends. Heferon keeps your contact details in HubSpot while you subscribe and for 12 months after the subscription ends, so it can answer questions about payments and refunds. Then it deletes them. You can ask Heferon to delete them sooner. The sale record (amount, date and payment reference) is kept for the period above without your contact details. Paystack keeps its own copy under its own legal duties: Paystack states that it keeps transaction data for as long as the law requires, and that personal data is then destroyed or anonymised.

3. Your card details

You enter card details only on Paystack's secure payment page. They never reach Heferon.

4. The seat on your device

After a confirmed payment, Deadline Desk keeps a short code in your browser that switches the Practice features on. It holds the product name, Paystack's customer code and customer number for your subscription, and an expiry date. From time to time the browser sends that code to Deadline Desk's payment check, which asks Paystack whether the subscription is still running. No client information, email or name travels with it.

5. Website hosting and visit counts

Deadline Desk is hosted on Vercel. Like any website, each request from your browser reaches the host with your IP address. Deadline Desk's payment functions keep the IP address in memory only, while that server instance runs, to stop repeated automated requests. It is never written to storage.

For each request to those payment functions, Vercel's platform logs record the time, the page address and its search parameters, the result, the browser type and the server region that handled it. The payment reference travels inside the request, never in the page address, so it is not part of these logs. Vercel can match these logs to the IP address of the request. Deadline Desk's own log lines carry status codes only, never your email. Vercel keeps these logs for no more than one day.

Vercel also collects log data, including IP addresses, to run its own service, under its own privacy notice at vercel.com/legal/privacy-policy.

Visit counts: Deadline Desk uses Vercel Web Analytics to count page visits. It records the page address (without its search parameters, so no payment reference is ever part of it), the referring site, country, browser and device type. It sets no cookies. Vercel identifies a visit by a code made from the request and discards that code after 24 hours. Your roster and branding are never part of it.

6. Who receives personal information

  • Paystack (payment provider): your work email, practice name and the payment and subscription details.
  • Vercel (hosting and visit counts): IP addresses and ordinary request data, the visit counts described in section 5, and your email and practice name as they pass through the checkout and payment notice functions.
  • Heferon's own sales records: for each sale, the amount, the date, the last twelve characters of the payment reference, your work email and your practice name go to Heferon's HubSpot account. A Telegram message to the founder announces each sale or renewal with the amount and the last six characters of the payment reference, and each cancellation or failed payment with the product name only. It carries no name or email address.
  • Email and WhatsApp: if you write to hello@heferon.com or send Heferon a WhatsApp message, your message and contact details are held in Heferon's Google Workspace mailbox or its WhatsApp account.

Heferon does not sell, rent or share personal information with anyone else.

7. Security

Deadline Desk sends information only over encrypted connections. Payment runs on Paystack's hosted page. The checkout function passes your email and practice name to Paystack and keeps no copy.

8. Information outside South Africa

Your work email, practice name and the payment record are stored and processed outside South Africa.

  • Paystack states: "Your data is stored on a private AWS cloud with servers located in Ireland." Paystack also states that it may transfer personal data to other Paystack companies under its Binding Corporate Rules, or to its service providers.
  • Vercel states that its "primary processing facilities are in the United States", and that it may process data anywhere Vercel or its subprocessors operate. Your email and practice name pass through Vercel's servers on their way to Paystack and to Heferon's sales records, and the request logs and visit counts described in section 5 are held by Vercel.
  • HubSpot (Heferon's customer records) holds your work email and practice name under its data processing agreement with Heferon, in the data centre location HubSpot's terms state for Heferon's account. Telegram carries the founder's sale messages, which hold no name or email address. Telegram's privacy policy names Telegram Group Inc in the British Virgin Islands as its parent company.

These transfers are needed to carry out and set up the subscription you ask for (POPIA section 72(1)(c)). HubSpot also receives your details under a written data processing agreement with Heferon.

The level of protection: Vercel states that the countries where it processes information may have different data protection laws and may not offer the same level of protection as your own country, and that when it transfers information it uses standard contractual clauses or other legal mechanisms. Paystack states that transfers between Paystack companies follow its Binding Corporate Rules. HubSpot states that its data processing agreement forms part of its customer terms, that HubSpot, Inc. participates in and certifies compliance with the Data Privacy Framework, and that standard contractual clauses apply to transfers under that agreement.

9. Your rights

Under POPIA you have the right to:

  • ask Heferon whether it holds personal information about you, and for a copy;
  • ask Heferon to correct or delete personal information about you;
  • object to the processing of your personal information on reasonable grounds; and
  • lay a complaint with the Information Regulator.

To use any of these rights, email hello@heferon.com with "Privacy" in the subject line. Heferon only holds the payment and sale records described in sections 2 and 6; your companies, roster and branding are on your own device, where you can change or delete them yourself. Paystack also takes requests about the data it holds at dpo@paystack.com.

10. The Information Regulator

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200, toll free 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za

(Contact details as published in apps/will-desk/content/privacy.md, taken from inforegulator.org.za/contact-us on 29 September 2026.)

11. Changes to this notice

If this notice changes, the date at the top changes. A change that affects information already collected is emailed to subscribers and shown on the subscribe screen before the next payment.

Back to Deadline Desk