Privacy policy
VoltAdmin · Last updated 16 August 2026
This policy explains what VoltAdmin holds about you, the contractor using it, and why. What you put into VoltAdmin about your own customers is covered separately, by the operator agreement — because that data is yours, not ours, and the difference decides who answers for it.
Written in plain language on purpose. Where the Protection of Personal Information Act 4 of 2013 (POPIA) uses a term of art, it is named the first time and then used normally.
1. Who we are
VoltAdmin is operated by [registered entity name] (registration number […]), of [registered address].
- Information Officer: [name], [email]
- General enquiries: [support email]
For the data described in this policy we are the responsible party — the one who decides why it is collected and what happens to it.
2. What we collect, and why
We collect four things, and nothing else.
2.1 Your account
Your name, email address and password (stored only as a scrypt hash — we cannot read it, and neither can anyone who takes a copy of our database). If you signed in with Google, we hold the verified email address Google gave us and nothing from your Google account beyond it.
Why: to know who you are and to let you back in. Without it there is no account.
2.2 Your business
Trading name, registered name, registration and VAT numbers, address, phone, email, logo and banking details.
Why: these print on your quotes and invoices. Your banking details are printed so your customers can pay you; they are stored so you do not retype them on every document, and we never initiate a payment with them.
2.3 Your subscription
Which plan you are on, when it renews, and a record of each payment: the amount, the date, and the reference the payment gateway gave us.
Why: to bill you and to prove what you paid. No card details ever reach VoltAdmin. The gateway's own page takes them; we store its reference and nothing that could be used to charge a card.
2.4 What happens in the account
An activity log — who did what and when — and technical logs of requests, each carrying a correlation identifier, a timestamp and, where our rate limiting needs it, an IP address.
Why: so you can answer "did I actually remove that person's access?", and so we can investigate a fault or an attack. §6.11 puts the activity log in the product for exactly the first reason.
3. What we never do
- We do not sell your personal information, or your customers'.
- We do not share it for advertising, and there are no advertising or analytics trackers in the product.
- We do not use your business data to train machine-learning models.
- We do not read your records except when you ask us to help with a specific problem, and then only as far as that problem needs.
4. Who else can see it
Only where the work requires it, and each is bound to confidentiality:
| Who | What they see | Where |
|---|---|---|
| Our hosting | Everything, at rest, on the server | [hosting location] |
| Our email provider (Amazon SES) | The address, subject and body of mail we send you — invitations, password resets, retention notices | [SES region] |
| The payment gateway | Your name, email and the amount, when you subscribe | South Africa |
| Our development staff | Only what a specific support request requires; no general access to production data, and no root database access (§10) | South Africa |
If any of these change, this policy changes with it. Section 72 of POPIA restricts sending personal information outside South Africa, so where the server and the backups physically sit is stated above rather than left vague.
5. How long we keep it
| While your subscription is live | Everything, until you delete it |
| After it lapses | One year, readable and exportable the whole time |
| Then | We email you a link to download everything. The link lives 30 days |
| After that | Everything is deleted |
| If you close your business yourself | Deleted seven days after you ask, so a mistake can be undone. Signing in during those seven days cancels it |
The one exception is a small record that a deletion happened: the business's name, the date, who asked, and how many rows went. Kept because a regulator's question about a deletion cannot be answered by data we deleted.
Your account survives your business. If you do the books for two contractors and one closes, your login and the other business are untouched.
6. Your rights
Under POPIA you may:
- See what we hold. Settings → Export everything gives you the lot as a spreadsheet, immediately, without asking us.
- Correct it. Every field in the product is editable by you.
- Have it deleted. Settings → Close this business. You do not need our permission or our help.
- Object to processing, and complain — to us first, at the Information Officer above, and then to the Information Regulator, whose complaint form and contact details are at inforegulator.org.za.
We answer requests within 30 days, and sooner where the product does not already answer them instantly.
7. How it is protected
- TLS everywhere, with HTTP Strict Transport Security.
- Passwords hashed with scrypt — memory-hard, salted, never reversible.
- Session tokens stored only as SHA-256, so a copy of our database yields no usable sessions.
- Optional two-step sign-in (an authenticator app), which we recommend for any business with staff.
- Every business's data scoped in the query, not in the interface, and tested for it on every change.
- Encrypted, off-site backups, with restores rehearsed rather than assumed.
- A Content Security Policy and the rest of the browser's defences, set in our own code so they are reviewed like everything else.
8. If something goes wrong
Section 22 of POPIA requires notification of a breach. If personal information under our control is accessed by someone who should not have it, we will notify the Information Regulator and every affected person as soon as reasonably possible, in writing, saying what happened, what it means for you, and what to do about it. Our internal runbook for this is a working document, not a marketing one, and it is rehearsed.
9. Cookies
Three, and none of them for tracking:
| Cookie | What it does | How long |
|---|---|---|
va_session | Keeps you signed in | 30 days, or until you sign out |
va_lang | Remembers English or Afrikaans before you sign in | A year |
va_recovery | Only on the data-recovery page, after you prove who you are | 30 minutes |
No analytics, no advertising, no third-party cookies. Nothing to consent to, because there is nothing here that a consent banner would be asking about.
10. Children
VoltAdmin is a business tool and is not directed at children. We do not knowingly collect the personal information of anyone under 18.
11. Changes
We will post a new "last updated" date here, and email you before anything that materially changes what we do with your information.