Privacy Policy & POPIA Privacy Notice

eScripts is a South African software service that helps individuals, freelancers, commission earners, sole proprietors and small businesses organise tax records, receipts, documents, mileage and business admin. eScripts is operated by Skarsity (Pty) Ltd, which is the responsible party under POPIA for the personal information processed through the eScripts platform.

• Legal entity (responsible party): Skarsity (Pty) Ltd
• Registration number: 2020/891049/07
• Brand and service: eScripts
• Physical / business address: 49 Sweet William Street, Terenure, Kempton Park, 1619, South Africa
• Website: https://escripts.live
• Privacy and legal email: info@escripts.live
• Support and WhatsApp: +27 76 381 3360

Note: the appointed Information Officer particulars and registration status are still being formally confirmed and will be published here once verified. Until then, all privacy requests are handled through the contact details above.

Depending on how you use eScripts, we may process:

• Account and profile data — name, email address, password credentials (stored in hashed form by our authentication provider), user type and preferences.
• Tax profile data — SARS tax reference number where you choose to supply it, tax residency, taxpayer type and tax-year selections.
• Income and tax documents — IRP5s, payslips, medical certificates, SARS correspondence, retirement and investment certificates you upload.
• Expenses and receipts — captured amounts, categories, notes and scanned receipt images, including text extracted by our scanning tools.
• Bank statement data — transaction lines from CSV or PDF statements that you import. These stay evidence until you classify them.
• Mileage, trip and location data — vehicles, odometer readings, trips, place names, and device location where you enable location assistance, plus tracker logbook files you import.
• Business data — business profile, clients, quotations, invoices and VAT information, which may include personal information about your own customers.
• Practitioner collaboration data — consents you grant, the practitioner relationship record and assisted-filing case information.
• Support and communications — emails, WhatsApp messages and service requests.
• Authentication, security and audit data — sign-in events, device and technical logs, and an append-only audit trail of key actions.
• Subscription and payment status — plan, interval, status, payment references and outcomes.

Card details: card and payment credentials are entered directly with our payment processor, PayFast. eScripts does not receive or store your full card number.

POPIA requires a justification for each processing activity. We rely on the following:

• Performance of a contract with you — creating and running your account, storing and organising your records, producing estimates, readiness scores, Tax Packs, reports, quotations and invoices, and processing subscriptions.
• Your consent — optional features such as device location assistance, sharing records with a tax practitioner, and any future optional marketing. Consent can be withdrawn at any time.
• Compliance with the law — tax, accounting, consumer protection, anti-fraud and record-keeping obligations.
• Our legitimate interests (balanced against your rights) — securing the platform, preventing abuse and fraud, supporting users, improving reliability and defending legal claims.

We collect information for the specific purposes described here and do not use it for unrelated purposes without a lawful basis.

An email address and password (or a social sign-in) are required to create an account. A plan or trial is required to use the workspace. Everything else — tax number, documents, receipts, bank statements, mileage, business details, location assistance and practitioner sharing — is voluntary.

If you do not supply required information, we cannot create or maintain your account. If you leave optional information out, the related features simply produce fewer results — for example, a readiness score or estimate will be less complete.

We use carefully selected service providers (operators under POPIA) who process personal information on our behalf and under our instruction:

• Lovable-managed application hosting and backend infrastructure.
• Supabase (PostgreSQL database, authentication and private file storage).
• PayFast for subscription payments and payment notifications.
• Google and Apple, where you choose to sign in with a social account.
• OpenStreetMap-based place search and geocoding services, where you use place lookup or device location assistance for trips.
• Email delivery providers for transactional and account emails.
• Tax practitioners and assisted-filing professionals — only where you request the service or grant consent.

We may also disclose information where required by law, a court order or a lawful request from a competent authority, or to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not share your tax records with third parties for their own marketing.

A tax practitioner or accountant can only view your records after you create a consent-based relationship in the app. You can withdraw that consent, after which the practitioner workspace access ends. Withdrawal is not retrospective: records the practitioner lawfully accessed, and any records they must keep under professional or tax legislation, may remain with them.

Some of our service providers may process or store information outside South Africa. Where that happens, we only transfer personal information in the circumstances allowed by section 72 of POPIA — for example where the recipient is subject to a law, binding agreement or corporate rules providing an adequate level of protection, where the transfer is necessary to perform our contract with you, or where you consent. We do not make claims about specific data-centre locations that we cannot verify.

We keep personal information only as long as we have a lawful reason to, including:

• while your account is active and for as long as you need access to your records;
• for the periods required by tax, accounting and company legislation — South African tax records commonly need to be retained for five years or longer;
• for the resolution of disputes and the defence of legal claims; and
• for security, audit and fraud-prevention purposes.

If your trial or subscription ends, your records remain visible in a read-only state rather than being deleted, so that you do not lose your history. You can ask us to delete your account and data at any time; we will do so except where we are legally required or entitled to retain specific records. Deleted data may persist in encrypted backups for a limited backup cycle before being overwritten.

We apply reasonable technical and organisational safeguards, including:

• row-level security so that users can only reach their own records;
• authenticated access, role-based permissions and administrative controls;
• private document storage with controlled access;
• encrypted transport (HTTPS/TLS) between your device and the service;
• audit logging of key account, practitioner and administrative actions; and
• ongoing security review of the platform.

No online service can promise absolute security. You also play a part: use a strong unique password, keep your device secure and do not share your login.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator (South Africa) and the affected data subjects as soon as reasonably possible after discovering and investigating the compromise, as required by section 22 of POPIA. Notifications will describe what happened, the likely consequences and the steps you can take to protect yourself.

Under POPIA you may:

• ask what personal information we hold about you and request access to it;
• ask us to correct, update or delete information that is inaccurate or excessive;
• object to processing based on legitimate interests, on reasonable grounds;
• withdraw consent for processing that relies on consent;
• object to direct marketing at any time; and
• complain to the Information Regulator (South Africa) at https://inforegulator.org.za/.

To exercise a right, email info@escripts.live or follow the steps on our data rights page. We may need to verify your identity before we act, and only to the extent reasonably necessary.

eScripts is intended for adults (18 and older) and for business users. We do not target the service at children and we do not knowingly process a child's personal information except where it is lawful and necessary — for example where you record a dependant's medical contribution details for your own tax return, which POPIA permits where processing is necessary to comply with an obligation of law. Some records you upload (such as medical scheme certificates) may contain special personal information; we process them only to provide the tax-readiness service you asked for and apply the safeguards described above.

We send service and transactional messages (verification, billing, reminders, security notices) because they are necessary to operate your account. We do not send unsolicited electronic marketing. If we introduce marketing communications, they will be optional and never pre-ticked, and every message will contain an easy opt-out. You may object to direct marketing at any time by emailing info@escripts.live.

We may update this notice as the service, our providers or the law change. The revision date at the top of this page always shows the current version, and material changes will be communicated in the app or by email where appropriate.