Privacy Policy

How we handle personal information.

Effective 19 October 2026. Version 6.

Power Practice is practice management software for South African attorneys. This policy explains what personal information POWER PRACTICE (Pty) Ltd collects, why and what rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

POWER PRACTICE (Pty) Ltd is a private company incorporated in South Africa. For the purposes of POPIA we are the responsible party for the information described in section 3 and an operator for the information described in section 4.

Our Information Officer can be reached at [email protected].

2. Two kinds of information

The software holds two distinct sets of personal information and our role differs for each.

• Account information about the firm and the people who sign up and use the software. We decide how this is used, so we are the responsible party.
• Practice data: everything a firm records about its own clients, matters, opposing parties, estates, transfers, invoices and trust accounts. The firm decides how this is used. The firm is the responsible party and we process it only on the firm's instructions, as an operator under sections 20 and 21 of POPIA.

3. Account information we collect

The lawful basis is the performance of the contract with the firm, our legitimate interest in running a secure service and, for marketing email, your consent, which you can withdraw at any time.

4. Practice data

We do not read, sell, or use practice data for any purpose of our own. Specifically:

• We process it only to provide the software to the firm, to keep it backed up and to give support when the firm asks for it.
• We do not use it to train machine learning models and we do not permit our suppliers to.
• Our staff access it only with the firm's permission, or where the law requires. Every such access is logged.
• When the firm's subscription ends, an administrator can download its data and we delete it after the retention period in section 8.

Firms remain responsible for their own POPIA obligations towards their clients, including obtaining any consent the law requires and responding to their clients' requests. The software includes tools for this, such as the processing register and the data subject request log.

5. Where the information is kept

The software and its database are hosted on Google Cloud in the Johannesburg region, in South Africa. Backups are kept in the same region.

Some suppliers listed in section 6 operate outside South Africa. Where information leaves the country we rely on section 72 of POPIA: the recipient is bound by its data processing terms, which provide protection substantially similar to POPIA's. Telegram notices, which a client chooses in the client portal, are the one exception: they go outside South Africa because the client agreed to it before connecting (section 6).

6. Suppliers who process information for us

We use a small number of suppliers. Each handles personal information for us under its own published data processing terms, which allow it to use the information only to provide its service to us and require it to keep the information secure:

• Google Cloud: hosting, database and backups (South Africa).
• Anthropic and Google: the language models behind the features in section 7. Either may answer a request and both run outside South Africa.
• Cloudflare: network security, content delivery and email routing for our own domain.
• Google Firebase Cloud Messaging: delivering notifications to the Power Practice app (section 12).
• A transactional email provider: sending account and system email such as password resets.

PayFast takes subscription and invoice payments as a payment provider in its own right, under its own terms. It holds card details under its own PCI DSS certification; we never see a card number.

Where a firm chooses to connect its own services, for example its own email account, bank feed or calendar, information flows to that service under the firm's own agreement with it.

Telegram: a law firm's client can choose, in the client portal, to get short notices on Telegram when something new is waiting for them there. Telegram's servers are outside South Africa, so this rests on the client's own consent, which they give in the portal before connecting and can withdraw at any time by pressing Disconnect. A notice carries only the firm's name, that something is waiting (and, for an invoice or an appointment, its number or its date and time) and a link to the portal. Messages, documents and amounts stay in the portal. If the client replies on Telegram, the reply is filed in their portal conversation.

Power Advocacy, our product for advocates, can connect the advocate's Gmail and Google Calendar with their permission. It uses that access only to show and file the advocate's own mail inside the application, to send what the advocate sends from it and to write the practice's deadlines and matter events to that calendar and read back changes to them. When the advocate asks which brief a message belongs to, its sender, subject and the first part of its text may be sent to a language model to suggest one, only once the advocate has allowed it for the practice (section 7). Power Advocacy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting the account in the settings ends our access.

7. Artificial intelligence features

Some features can draft, summarise or research with the help of a language model. In Power Practice, before any text is sent to a model, the software removes identifying details such as names, identity numbers, addresses, telephone numbers and account numbers and restores them only in the result shown to the user. The models are provided by Anthropic and Google (section 6). No practice data is used to train any model.

In Power Advocacy, nothing from a brief is sent to a model until the advocate allows it, for the practice or for that brief, and each time it is recorded against the brief. Identity, bank account and card numbers are removed first and restored only on the advocate's computer; names and the facts of the brief are sent as written, because a draft cannot be written without them. The text passes through Power Advocacy's own service to the model provider (Google, through Vertex AI, or Anthropic). Our service keeps none of the text, only how much was used, and neither provider uses it to train a model. Research sends only the question the advocate types.

8. How long we keep information

• Account information: for the life of the account and five years after it closes, which is the period the Companies Act and the Tax Administration Act require us to keep financial records.
• Practice data: for the life of the firm's subscription and 90 days after it ends, during which the firm can export it. It is then deleted, subject to any legal hold. Firms should note their own obligations, for example the five year FICA record keeping period and the Legal Practice Council's rules on accounting records and export before the period runs out.
• Audit logs: five years, since they exist to evidence compliance.

9. Security

Information is encrypted in transit and at rest. Access is controlled by role, every sign-in and every change to a record is logged, sensitive records carry additional access alerts and trust and business accounting are kept apart. We test our own security and correct what we find. If a breach affects you, we will notify you and the Information Regulator as section 22 of POPIA requires.

10. Cookies

The software uses only the cookies necessary to keep you signed in securely. This website uses no advertising or tracking cookies.

11. Your rights

Under POPIA you may, free of charge unless the law permits a fee:

• Ask whether we hold personal information about you and for a copy of it.
• Ask us to correct or delete information that is inaccurate, out of date or no longer needed.
• Object to processing based on our legitimate interests, or to direct marketing.
• Withdraw any consent you have given.
• Complain to the Information Regulator.

Write to [email protected]. We answer within 30 days. If your request concerns practice data held by a firm that uses Power Practice, we will refer it to that firm, which is the responsible party for it.

The Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. inforegulator.org.za.

12. The Power Practice app

Clients of firms that use Power Practice can use the Power Practice app on Android and iPhone. The app is the firm's client portal. The firm creates the client's login and invites the client by email; nobody can sign up in the app.

The app handles the same information as the client portal: the client's name, email address and phone number, the client's matters, messages to and from the firm, documents and photos the client sends, identity documents the firm needs under FICA and the firm's invoices and payments. Card payments open PayFast's own page in the phone's browser, so card details never pass through the app.

If the client turns on notifications, the app registers the phone with Google Firebase Cloud Messaging so the firm's messages can reach it. The app has no advertising, no analytics and no tracking, and no information from it is sold or shared for marketing.

13. Deleting your information

A client of a firm can ask for their information to be deleted:

• In the app or the client portal, open the menu and choose Your privacy rights.
• Choose Delete my information and confirm.

Or write to [email protected] from the email address you sign in with and we will pass the request to your firm.

The firm is the responsible party for its clients' information and answers the request within 30 days. Your login, contact details, messages, documents and photos are then deleted, except what the law requires the firm to keep: FICA records for five years after the matter or business relationship ends and the firm's accounting and trust records for the period the Legal Practice Council's rules require. What is kept is used only for that purpose and deleted when the period ends.

14. Children

The software is for law firms and is not offered to anyone under 18. Practice data may include information about children, for example in family law or estate matters. The firm is responsible for the lawful basis of that processing.

15. Changes to this policy

We will notify account holders by email of any material change at least 30 days before it takes effect and keep earlier versions available on request.