Privacy policy

This policy explains how Smart Ledger ("we") handles personal data on this website and in the SmartLedger application. We follow the Data Protection and Privacy Act, 2019 of Uganda and apply the same care for organisations in other countries.

1. Two kinds of data

Account and website data is about you as a user or visitor: your name, email address, phone number, username, organisation name, country and the messages you send us. We are responsible for this data.

Customer records are what your organisation enters into SmartLedger: accounting records, donors, staff and payroll, beneficiaries and documents. Your organisation controls this data and decides who can see it; we process it only to provide the service.

2. What we use data for

• To create and run your account and your organisation's workspace.
• To answer demo requests and messages, and to follow up on trials.
• To send service emails: trial and renewal reminders, receipts, password resets and invitations.
• To keep the service secure: sign-in records, lockouts after wrong passwords and audit trails.

We do not sell personal data and do not use customer records for advertising.

3. Who processes data for us

• Netlify hosts the website and stores the application data.
• Resend sends service emails, when email is switched on.
• Pesapal processes online subscription payments. We never see or store card or mobile money PINs; we receive the payment confirmation.

These providers may store data outside Uganda. We use them only for the purposes above.

4. Cookies and local storage

The website uses no advertising cookies. The application keeps your sign-in in your browser's local storage so you stay signed in. No analytics cookies are used.

5. How long we keep data

Customer records are kept while the organisation's account exists, including in read-only mode after a subscription ends. Backups are kept as follows: hourly copies for 48 hours, daily copies for a year and monthly copies for longer. Demo requests and messages are kept for as long as needed to follow them up. An organisation can ask us to delete its account and records.

6. Security

Each organisation's records are kept separate and checked on the server; passwords are stored as salted hashes; connections use HTTPS; roles and permissions are enforced by the server; and actions are recorded in an audit trail.

7. Beneficiary information

Organisations that record beneficiaries must have a lawful basis and, where needed, consent. SmartLedger lets the Administrator limit who can see beneficiary records, keeps names out of stock records and group reports, and supports anonymised exports.

8. Your rights

You may ask for access to, correction of or deletion of your personal data, or object to its use, by contacting us at smartledgeronline@gmail.com. If your data is in an organisation's records, we may refer your request to that organisation. You may also complain to the Personal Data Protection Office of Uganda.

9. Changes

We will post any changes on this page and update the date above.