Privacy Policy

The data controller (the responsible party under the Protection of Personal Information Act 4 of 2013) for personal data processed through Anchor is:

Slippie Software (Pty) Ltd
Registration number: 2026/639089/07
Registered address: 29 Hermon Street, Riebeek Kasteel, Western Cape, 7307, South Africa
Email: [email protected]
Tel: 084-288-9240

Anchor is free hosted accounting for South African small businesses, operated by Slippie Software (Pty) Ltd. In this policy, “Anchor”, “we”, “us” and “our” mean Slippie Software (Pty) Ltd.

For data protection enquiries, contact us at [email protected].

We collect the following categories of personal data:

• Account data ·name, email address, and authentication credentials when you create an account.
• Usage data ·pages visited, features used, session duration, device type, browser, and IP address.
• Payment data ·processed securely by Stripe. We store only the last four digits of your card, billing address, and transaction history. We never have access to your full card number.
• Done-for-you service payments ·when you pay for a service such as bookkeeping, payroll or a tax return, your name, email and payment details are processed by Paystack or by Stitch, depending on which provider the seller has switched on. Anchor stores the payment reference, the amount and the payment status. Anchor does not store your full card number or bank account. This sentence is a placeholder the owner must replace. It is not approved legal advice.
• Communication data ·messages you send us via email or in-app support, including messages sent through the in-app chat widget. We process those messages to perform our contract with you (UK GDPR Art 6(1)(b) / POPIA s11(1)(b)).
• Screen sharing ·if you choose to share your screen with Anchor support, our support staff see your Anchor pages live while you share, with form fields and sensitive details hidden. Nothing is recorded or stored, and you can stop at any time. We process this with your consent, given each time you share (UK GDPR Art 6(1)(a) / POPIA s11(1)(a)).
• Professional directory ·if a bookkeeper or accountant agrees to appear on /accountants, we publish only the fields they consented to (name, practice, location, and optionally public email, phone, website, and bio). Listing is opt-in and can be unpublished at any time.
• Cookies & similar technologies ·see Section 10 for details.

We process your personal data for the following purposes:

• Service delivery ·providing, maintaining, and improving the Anchor platform.
• Payments ·processing subscriptions and invoices via Stripe, and done-for-you service payments via Paystack or Stitch. That wording is a placeholder the owner must replace. It is not approved legal advice.
• Communication ·responding to support requests, sending service updates, and notifying you of material changes.
• Improvement ·understanding how the service is used to improve features and user experience.
• Security ·detecting, preventing, and responding to fraud, abuse, and security incidents.
• Legal compliance ·meeting our obligations under applicable law, including tax and accounting requirements.

We rely on the following lawful bases under the UK GDPR for processing your data:

• Contract (Art 6(1)(b)) ·processing necessary to perform our contract with you, including providing the service, managing your account, and sending security emails (sign-in alerts, password reset, and password-changed confirmations).
• Legitimate interests (Art 6(1)(f)) ·improving our service, ensuring security, and preventing fraud, balanced against your rights and freedoms.
• Consent (Art 6(1)(a)) ·where you opt in to optional features such as marketing emails. Product-update messages include an unsubscribe link. You can also turn off Product emails in your profile, or withdraw consent at any time. Security emails (sign-in alerts, password reset, and password-changed confirmations) are sent regardless of that Product emails setting.
• Legal obligation (Art 6(1)(c)) ·where we are required to process data by law, such as tax reporting.

We share personal data only with the following categories of recipients:

• Hosting providers ·infrastructure and cloud services that store and process data on our behalf.
• Stripe ·payment processing. Stripe acts as an independent controller for payment data.
• Paystack ·payment processing for a done-for-you service when Paystack is the provider. Paystack receives your name, email and payment details. Anchor keeps the reference and the amount. This wording is a placeholder the owner must replace. It is not approved legal advice.
• Stitch ·payment processing for a done-for-you service when Stitch is the provider. Stitch receives your name, email and payment details. Anchor keeps the reference and the amount. This wording is a placeholder the owner must replace. It is not approved legal advice.
• Analytics providers ·to understand usage patterns and improve the service.
• Anthropic (Claude) ·only when you use the optional Match my design feature for document templates, and only after you tick its consent box. The pictures of a document you upload are sent to Anthropic to read the layout. Anchor does not keep the pictures after the request, and the template it makes never copies customer names, addresses or amounts from them. Anchor records only how much each request cost. Anthropic acts as a sub-processor and may process the request outside South Africa, including in the United States.

We do not sell your personal data to third parties, and we never will.

Some of our service providers may process data outside the United Kingdom. The in-app helpdesk runs on our own server, on the same South African host as the app, and is not an international transfer. If we ever fail over to Chatwoot Cloud, that host would be a recipient and an international transfer; we would update this policy first. Pictures you send with the optional Match my design feature are processed by Anthropic, including in the United States. Where other transfers occur, we ensure appropriate safeguards are in place, including:

• Transfers to countries with UK adequacy regulations (including the EEA).
• Standard Contractual Clauses (SCCs) and/or the International Data Transfer Agreement (IDTA) approved by the ICO.

We retain personal data only as long as necessary:

• Account data ·retained while your account is active, plus 30 days after deletion to allow recovery.
• Usage data ·retained for up to 26 months, then anonymised or deleted.
• Payment records ·retained for 7 years to comply with UK tax and accounting obligations.
• Support conversations ·in-app chat messages are retained in our own helpdesk while we operate it. Contact [email protected] to request deletion of a support conversation.

Under the UK GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If we need to extend this period, we will notify you with reasons.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first at [email protected] so we can try to resolve your concern directly.

We use the following types of cookies:

• Strictly necessary cookies ·essential for the service to function (e.g. session authentication). These do not require consent.
• Functional cookies ·remember your preferences such as theme and language settings. The in-app chat widget also sets first-party cookies on this site (cw_conversation to continue a chat, and cw_user_* keyed by the widget website token after you are identified) plus storage in the chat iframe on chat.anchorapp.co.za. These are needed to resume a conversation; blocking them in the browser may start a new chat each visit. There is no separate cookie-consent banner for them.
• Analytics cookies ·help us understand how the service is used. Under PECR and the Data Use and Access Act 2025 analytics exemption, certain first-party analytics cookies may be set without prior consent where they are used solely for statistical purposes.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect service functionality.

This privacy policy applies exclusively to the hosted service at Anchor.

Anchor is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will promptly delete it.

We implement appropriate technical and organisational measures to protect your personal data, including:

• TLS encryption for all data in transit.
• Encryption at rest for stored data.
• Access controls ensuring only authorised personnel can access personal data.
• Regular security reviews and monitoring.

No system is 100% secure. If you discover a security vulnerability, please report it to [email protected].

We may update this privacy policy from time to time. For material changes, we will notify you by email at least 30 days before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

We encourage you to review this page periodically for the latest information on our data practices.