Privacy Policy

Last updated: 22 October 2026  ·  Effective date: 22 October 2026

1. Who We Are

LetterUp is an HR and compliance platform for South African employers, operated from South Africa.

Two different roles, and it matters which applies:

• For the information of our own customers (the people who register, subscribe and log in), we are the Responsible Party under POPIA.
• For the information an employer stores about its own employees in the Business Portal, the employer is the Responsible Party and LetterUp is its Operator (POPIA s1). The employer decides what to record about its staff and why; we process it on their instruction, to provide the service. Employees should raise access, correction and deletion requests with their employer in the first instance. Section 7 explains how we support the employer in answering them.

Our designated Information Officer is responsible for ensuring LetterUp's compliance with POPIA and can be contacted using the details in Section 13.

2. What Personal Information We Collect

2.1 Our customers (Business Portal accounts)

• Account information: Business name, your name (optional), email address, password (stored as a one-way hash, so we cannot read it), and the date and time you consented to these terms.
• Business profile: Company address, signatory details, logo, brand colours, and banking details (if you choose to provide them for letterhead purposes).
• Generated documents: The employment contracts, disciplinary and HR letters and policies you generate. We keep the finished document; the form you filled in to produce it is not stored.
• Payment information: Billing is handled entirely by PayFast. We do not store card numbers or bank account details. We retain PayFast transaction IDs and subscription status.
• Usage data: Which features you use, when, and approximate API token consumption per generation.

2.2 Employee information you store about your staff

This is the largest category of personal information on the platform, and for it you are the Responsible Party and we are your Operator. You decide what to record; we hold it and make it available to the people you authorise.

• Employee records: Full name, ID or passport number, date of birth, contact details, home address, job title, department, reporting line, employment type, start and end dates, salary and pay frequency, probation dates, and employment status.
• Leave: Leave requests, approvals, reversals and balances, by leave type.
• Documents: Files you upload against an employee (identity documents, work permits, qualifications, certificates), stored in encrypted object storage, plus the contracts and HR letters generated on the platform.
• Disciplinary and performance records: Allegations, hearings, outcomes, sanctions and their validity periods, and the related correspondence.
• Electronic signatures: Where a document is signed electronically we record the signature image, the signer's name and email, the date and time, the signer's IP address and a cryptographic fingerprint of the document. This is the audit trail an ordinary electronic signature needs under the Electronic Communications and Transactions Act 25 of 2002.
• Assets, expense claims, training and requests: Company property issued to a person, expense claims and their receipts, training records and certificates, and requests raised with HR.
• Company feed: Posts, comments, reactions and staff recognition. Birthdays are shown to colleagues as a day and month only (never the year), and an employee can switch their birthday off entirely.

2.3 Special personal information

Some of the above is special personal information under POPIA s26, and is treated accordingly:

• Health information: sick and family-responsibility leave, and any medical certificate uploaded to an employee's file. This is processed under POPIA s32, which permits health information to be processed where it is necessary to comply with an obligation of employment law, and the Basic Conditions of Employment Act's sick leave provisions are exactly that. It is shown only to the people the employer authorises; the company feed shows that a colleague is away and never why.
• Information about disciplinary proceedings: visible only to the managers the employer authorises. The employee sees the letters issued to them, not the internal case record.

LetterUp does not collect race, ethnic origin, religious or philosophical belief, trade union membership, political persuasion, sexual orientation or biometric data.

2.4 Cookie and tracking information

• Session cookies: A secure, HTTP-only cookie used to keep you logged in to the Business Portal. This cookie contains no personal information, only a random token that references your server-side session.
• Consent cookie: A local storage item that records whether you have acknowledged this cookie notice.
• How you found us: If you arrive on this website through a link with campaign tags (for example one of our adverts or posts), or from another website, we note the tags, the name of that website (such as google.com, never the full address) and the first page you opened. This is kept in your browser for the visit only and is sent to LetterUp only if you sign up, when we store it with your company's account so we can tell which of our marketing works. It says nothing about you as a person, is never shared, and is deleted with the account (POPIA s11(1)(f), our legitimate interest).

We do not use advertising cookies, behavioural tracking, or third-party analytics on this website.

2.4 Website enquiries (contact form)

If you use the contact form on letterup.co.za we collect your name, email address and, if you give them, your company, phone number, headcount and message. We use this only to reply to you (POPIA s11(1)(a) for consent, and s11(1)(d) for the legitimate interest of answering an enquiry you made). It is stored on our servers in South Africa and emailed to the LetterUp team. It is never added to a marketing list.

3. Why We Collect This Information

Purpose	Lawful basis (POPIA)
Provide the document drafting service	Performance of contract / legitimate interest
Create and manage your account	Performance of contract
Process subscription payments	Performance of contract / legal obligation
Send service emails (portal invitations, sign-up codes, password resets, leave decisions, documents to sign, account notices)	Performance of contract / consent
Prevent abuse and fraud (rate limiting, security)	Legitimate interest
Improve the AI pipeline and document quality	Legitimate interest (aggregated, non-identifiable)
Comply with legal obligations	Legal obligation

4. How We Use AI to Process Your Information

Some LetterUp features use Anthropic's Claude AI. Anthropic processes this information as our sub-processor under a data processing agreement, and does not use it to train its models. For more information, see Anthropic's Privacy Policy.

• Employment contracts and HR documents: When you generate a contract, warning, notice or policy, the details on the form (for example the employee's name, job title, pay and the facts of an incident) are sent to Claude to write the document. We keep the finished document on the employee's file. How long Anthropic holds what it receives is set by its commercial terms, which do not allow it to use your information for training.
• Your own document templates: When a template has sections for the AI to write, only the details on the form are sent, never the rest of your template. When you ask for a template review, the template's text is sent so it can be checked.
• Zola, the HR assistant: The question and your company's name are sent, with the parts of your company's policies and leave rules that may answer it. When a member of staff asks about themselves, their own leave balances and leave bookings, job title, start date and manager are also sent, for that one question. A manager's question also sends who in their team is off and when (names and dates only). Pay, ID numbers, bank and tax details, disciplinary records and the reason for any leave are never sent. Questions and answers are not stored.
• Policies you add to the policy register: A policy PDF is sent once, when it is added, so that Zola can read its text. A policy holds no personal information. The text is kept with the policy.

Every other part of LetterUp (employee records, documents on an employee's file, payslips, bank and tax details, payroll exports) never passes through the AI.

5. Who We Share Your Information With

We do not sell, rent, or trade your personal information. We share data only with:

• Anthropic: AI model provider (sub-processor). Used for writing documents, reviewing templates and Zola, the HR assistant, exactly as set out in section 4.
• PayFast: Payment processor. Handles all card and EFT transactions. PayFast Privacy Policy.
• Microsoft Azure: Cloud infrastructure provider (servers and database hosted in South Africa North, Johannesburg). Microsoft Privacy Statement.
• Resend: Email delivery provider (sub-processor). The emails LetterUp sends on your behalf and ours (portal invitations, sign-up codes, password resets, leave decisions, documents to sign and account notices) are delivered through Resend. To deliver a message, Resend receives the recipient's name and email address and the content of that email, and keeps delivery records for a limited period under its own policy. LetterUp keeps a record that an email was sent (who, when, what kind), never its content. Resend Privacy Policy.
• SimplePay, only if an employer connects it: SimplePay is a payroll provider that some employers already use under their own agreement with SimplePay. It is not our sub-processor. An employer can connect its SimplePay company to LetterUp; the connection is off until the employer switches it on, and the employer can disconnect it at any time, which deletes the stored key.
  • What LetterUp sends to SimplePay: for the people the employer has matched, the dates of their approved leave, the leave type, and the hours when it is a half day. If the leave is cancelled, those days are removed again. No name, ID number or reason for the leave is sent, because SimplePay already holds its own record of each person.
  • What LetterUp reads from SimplePay: the names, employee numbers, ID numbers and email addresses of the people on that payroll, so that the employer can match each one to their LetterUp record (LetterUp keeps only the matched name); their leave days and working hours; their leave balances, only when the employer asks to compare them, to show them on screen and not to keep; and their finalised payslips, as PDF files, which are stored for the employee they belong to.
  • What LetterUp does not do: it does not read salary, bank or tax details from SimplePay, it does not read the figures on a payslip, and it does not add, change or remove anybody in SimplePay.
  The employer's SimplePay key is stored encrypted and is never shown again. SimplePay Privacy Policy.
• Your own calendar, only if you add a calendar link: Anyone with a LetterUp login can create a private calendar link in My Profile and add it to Google Calendar, Outlook or another calendar. That calendar service is yours, under its own privacy policy, and is not our sub-processor. It fetches the link to stay up to date, so it receives what the link contains: your own approved leave (the dates and the type of leave) and the South African public holidays. If your employer has allowed it, which is off until the employer switches it on, the link also shows which colleagues are off and on which dates, by name only and never the reason. The link works without signing in, so anyone you give it to sees the same: treat it like a password. You can replace it at any time, which stops the old one. It also stops working when your login is closed, when you leave the employer, or when the employer switches calendar links off. LetterUp keeps the link encrypted and does not record it in any log.
• Law enforcement or regulators: If required by law, court order, or to protect our legal rights.

6. Data Retention

• Account and business data: Retained for the duration of your subscription and for 3 years after account closure, unless you exercise your right to erasure.
• Employee records and their documents: Retained for as long as you keep them. Deleting an employee removes their record and the files stored against them, including from object storage. Deleting your account removes every employee record and file belonging to it.
• Deleted files: When a file is deleted (on its own, with an employee, or with your account), it is removed from LetterUp straight away and can no longer be opened or downloaded through LetterUp. To protect against accidental deletion, our storage provider (Microsoft Azure, South Africa North) keeps a deleted file in a recoverable state for up to 7 days, after which it is permanently destroyed. During those 7 days it is not accessible to you, your staff or anyone outside LetterUp's authorised administrators.
• Generated HR documents: Retained for the duration of your account. When you delete your account, your documents are anonymised (your user association is removed) and retained for 12 months for business record purposes, then permanently deleted.
• Website enquiries: Retained for 12 months from the date of your message, or for the life of your account if you become a customer, then deleted.
• Payment records: Retained for 5 years to comply with tax and financial reporting obligations.
• Authentication tokens: Refresh tokens expire after 30 days and are automatically purged.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

How to exercise your rights

Companies using LetterUp: Under Settings → Export & close the account owner (and anyone the owner allows) can download everything the company holds as one ZIP file (spreadsheets of every record, the files you uploaded and your generated documents as PDFs), and the owner can close the account, which deletes the company and every stored file. Each export is logged.

Employees: Your employer decides what is kept about you and is the Responsible Party for it, so requests about your employment records go to your employer first. In the portal, My Profile shows your own details, leave, documents and pay, and lets you correct your contact details.

All users: Email info@letterup.co.za with the subject line "POPIA Rights Request". We will respond within 30 days. We may ask you to verify your identity before processing the request.

Complaints: If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

• Website: justice.gov.za/inforeg
• Email: inforeg@justice.gov.za
• Tel: 010 023 5207

8. Security

We implement appropriate technical and organisational measures to protect your personal information:

• All data in transit is encrypted using TLS 1.2 or higher, and the service refuses unencrypted connections.
• Passwords are hashed using bcrypt (cost factor 12), so we cannot read your password.
• Two-step sign-in (a code from an authenticator app) is available to every user and can be required by your company; LetterUp's own administrators must always use it.
• A login is locked for 15 minutes after ten wrong passwords.
• Two-step sign-in secrets and email account passwords are encrypted at rest using AES-256-GCM.
• The database and file storage are hosted in Azure South Africa North on a private network. Neither can be reached from the internet. Uploaded files are never given a public link; every download passes a permission check.
• Access tokens expire after 15 minutes, and you are signed out when you close your browser.
• Administrative access to production systems is restricted to authorised personnel, and every action taken in LetterUp's administration portal is recorded in an audit log.

No method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at info@letterup.co.za.

9. Cookies

We use only essential cookies and local storage on this website:

• lu_refresh: Secure, HTTP-only session cookie that keeps you signed in to the LetterUp portal. It is deleted when you close your browser or sign out.
• lu_cookie_notice: Local storage item on this website. Records that you have seen this notice. It stays until you clear your browser storage.
• lu_source: Session storage item on this website. Holds the campaign tags and the name of the website that brought you here, so they reach the sign-up page (see 2.4). It is deleted when you close the tab.
• lu-theme and lu-setup-later-…: Local storage items in the portal. Remember whether you chose light or dark mode, and that you chose to finish company setup later.

We do not use advertising cookies, social media tracking pixels, or third-party analytics. You can control cookies through your browser settings. Disabling the session cookie will prevent you from staying logged in to the Business Portal.

10. Cross-Border Data Transfers

Your data is stored on servers in South Africa (Azure South Africa North). When we send your document content to Anthropic for AI generation, this data is processed in the United States. Anthropic acts as our sub-processor under a data processing agreement that includes appropriate safeguards. By using LetterUp, you acknowledge this cross-border transfer.

Emails LetterUp sends are delivered by Resend, whose servers are outside South Africa, so the recipient's name, email address and the content of each email pass outside South Africa to be delivered. Resend acts as our sub-processor under its data processing terms. Your stored records, employee files and database remain in South Africa.

If you add a calendar link to a calendar service such as Google Calendar or Outlook, that service fetches the leave dates in the link, and its servers may be outside South Africa. That happens only if you choose to add the link, and stops when you remove or replace it.

11. Children

LetterUp is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has registered, please contact us at info@letterup.co.za and we will delete the account promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify active B2B subscribers by email at least 14 days before the changes take effect and update the "Last updated" date above. Your continued use of LetterUp after the effective date constitutes acceptance of the updated policy.

13. Information Officer & Contact