Will Desk privacy notice
Last updated: 19 October 2026
This notice explains what personal information Will Desk handles, where it goes, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).
Who is responsible
Heferon (Pty) Ltd, registration number 2026/337285/07, is the responsible party.
- Physical address: 30 Ranksuikerbos Street, Protea Valley, Cape Town
- Email: hello@heferon.com (use "Privacy" in the subject line)
- Information officer: the head of Heferon (Pty) Ltd, who is the company's information officer under POPIA section 1. Reach the information officer at hello@heferon.com with "Privacy" in the subject line.
The short version
- Your will answers stay on your device. Heferon never receives them.
- If you pay to print, the email address you type for your receipt goes to Paystack, the payment provider. Paystack keeps a record of the payment, including that email, and Heferon can see that record in its Paystack account.
- Your card details go only to Paystack.
- Will Desk has no accounts, no advertising and no tracking cookies. It counts page visits with Vercel Web Analytics, which records the page address, the referring site, country, browser and device type. Vercel identifies a visit by a code made from the request and discards it after 24 hours. Your will answers are never part of it.
- The payment record is stored outside South Africa (see section 7).
1. Your will answers
What: everything you type while making your will: your name, ID or passport number, address, marital status, spouse's name, and the names, ID numbers and shares of the people in your will, and your witnesses' names.
Where it goes: nowhere. Will Desk builds the will inside your browser. None of these answers is sent to Heferon, Paystack or anyone else.
Where it is kept: only if you switch saving on, your answers are kept in this browser's storage on your device for up to 30 days, then deleted. With saving off, they are gone when you close the tab. If you go to Paystack to pay with saving off, your draft is held in this tab until you come back, then cleared. "Clear everything" deletes them at any time. Anyone who uses the same browser could see saved answers.
Because Heferon never receives or records these answers, Heferon cannot see, correct or recover them.
2. The email address for your receipt
What: the email address you type in the "Pay and print" step.
Purpose: Paystack requires an email address to process the payment and send your receipt.
Voluntary or required: giving it is voluntary. Without it, the payment cannot go through and printing stays locked. Drafting and previewing your will need no email.
Where it goes: Will Desk's checkout function on Heferon's hosting sends it once to Paystack to open the payment page. The function does not store it and does not write it to any log.
Who holds it afterwards: Paystack keeps the payment record (your email, the amount, the date and a random payment reference) under its own terms. Heferon can see that record in its Paystack merchant account and uses it only to answer questions about your payment, to issue refunds, and to keep financial records the law requires.
Legal basis: processing that is necessary to carry out the payment you asked for (POPIA section 11(1)(b)), and keeping financial records the law requires (section 11(1)(c)).
How long: Heferon keeps its record of your payment for five years from the date it submits its income tax return for the tax year in which you paid. The Tax Administration Act 28 of 2011 requires business records to be kept for that period. If SARS is auditing or investigating that year, the record is kept until the audit or investigation ends. After that, Heferon deletes the record from its own files. Paystack keeps its own copy under its own legal duties: Paystack states that it keeps transaction data for as long as the law requires, and that personal data is then destroyed or anonymised.
3. Your card details
You enter card details only on Paystack's secure payment page. They never reach Heferon.
4. The unlock on your device
After a confirmed payment, Will Desk keeps a short code in your browser that unlocks printing for a year. It holds a random payment reference and an expiry date, and nothing that identifies you.
5. Website hosting
Will Desk is hosted on Vercel. Like any website, each request from your browser reaches the host with your IP address. Will Desk's payment functions use the IP address for a few minutes, in memory only, to stop repeated automated requests.
For each request to those payment functions, Vercel's platform logs record the time, the page address and its search parameters (for the payment check, this is the random payment reference), the result, the browser type and the server region that handled it. Vercel can match these logs to the IP address of the request. Will Desk's own log lines carry status codes only, never your email. Vercel keeps these logs for no more than one day.
Vercel also collects log data, including IP addresses, to run its own service, under its own privacy notice at vercel.com/legal/privacy-policy.
Visit counts: Will Desk uses Vercel Web Analytics to count page visits. It records the page address (without its search parameters, so no payment reference is ever part of it), the referring site, country, browser and device type. It sets no cookies. Vercel identifies a visit by a code made from the request and discards that code after 24 hours. Your will answers are never part of it.
6. Who receives personal information
- Paystack (payment provider): the receipt email and the payment details.
- Vercel (hosting and visit counts): IP addresses and ordinary request data, the visit counts described in section 5, and the receipt email as it passes through the checkout function on its way to Paystack.
- Heferon's own sales records: for each sale, the amount, the date and the last six characters of the payment reference go to Heferon's HubSpot account and to a Telegram message to the founder. No name or email address is included.
Heferon does not sell, rent or share personal information with anyone else, and does not use it for marketing.
7. Information outside South Africa
Your receipt email and the payment record are stored and processed outside South Africa.
- Paystack states: "Your data is stored on a private AWS cloud with servers located in Ireland." Paystack also states that it may transfer personal data to other Paystack companies under its Binding Corporate Rules, or to its service providers.
- Vercel states that its "primary processing facilities are in the United States", and that it may process data anywhere Vercel or its subprocessors operate. Your email passes through Vercel's servers once, on its way to Paystack, and the request logs and visit counts described in section 5 are held by Vercel.
- HubSpot (Heferon's sales records) processes data in the United States. Telegram carries the founder's sale message. Neither receives your name or email address from Will Desk.
These transfers are necessary to carry out the payment you ask for, which POPIA section 72(1)(c) allows.
The level of protection: Vercel states that the countries where it processes information may have different data protection laws and may not offer the same level of protection as your own country, and that when it transfers information it uses standard contractual clauses or other legal mechanisms. Paystack states that transfers between Paystack companies follow its Binding Corporate Rules.
8. Security
Will Desk sends information only over encrypted connections. Payment runs on Paystack's hosted page. The checkout function passes the email to Paystack and keeps no copy.
9. Your rights
Under POPIA you have the right to:
- ask Heferon whether it holds personal information about you, and for a copy;
- ask Heferon to correct or delete personal information about you;
- object to the processing of your personal information on reasonable grounds; and
- lay a complaint with the Information Regulator.
To use any of these rights, email hello@heferon.com with "Privacy" in the subject line. Heferon only holds the payment record described in section 2; your will answers are on your own device, where you can change or delete them yourself. Paystack also takes requests about the data it holds at dpo@paystack.com.
10. The Information Regulator
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200, toll free 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
(Contact details taken from inforegulator.org.za/contact-us on 29 September 2026.)
11. Changes to this notice
If this notice changes, the date at the top changes. A change that affects information already collected is shown on the Will Desk screen before the next payment.