For law firms using SOOT, the firm is the responsible party for the personal information it keeps in SOOT (its clients, matters, documents, staff and HR records). Lodestar is the firm's operator: we process that information only on the firm's instructions, to run SOOT for it, under a written agreement (POPIA sections 20 and 21). Questions about information a firm keeps about you go to that firm first.

For this website, bookings and SOOT accounts, Lodestar is the responsible party: the details you give when you book a demo, free week or training, and the details of the people who sign in to SOOT.

• Bookings: your name, firm, email, phone and message, to arrange and confirm the booking and contact you about it.
• Sign-in: your email, password (stored only as a one-way hash by our sign-in provider), authenticator app set-up, and sign-in times and devices, to keep your account secure.
• Firm accounts: the firm's name, its seats and roles, and billing details, to provide and charge for SOOT. The owner of SOOT sees a firm's shape (seats, roles, account) but never its matters, clients, documents or money.
• Client portal, signing and form links: when someone opens a link a firm sends, SOOT records when it was opened and, for signatures and forms, the name typed, IP address, browser and time, as the firm's evidence of what was signed or submitted.

We don't sell personal information, don't use it for advertising and don't send marketing without your consent.

SOOT runs on Vercel (servers in Dublin, Ireland) and Supabase (database and files in the European Union). Information is therefore kept outside South Africa, in countries bound by the EU General Data Protection Regulation, which gives protection at least equal to POPIA (section 72). Email a firm connects (Microsoft 365 or Gmail) stays with that provider; SOOT reads it only for that firm.

Law firms keep special personal information (for example health, criminal matters, religion or family details) and information about children (for example in family law, adoption or injury claims) because legal work needs it. POPIA allows this where it is needed to establish, exercise or defend a right in law (sections 27 and 35). Each firm decides what it records and is responsible for it; SOOT limits who can see it (sections a person can't view are hidden, matters can be restricted, people can be blocked from a matter) and keeps a log of every change. SOOT itself doesn't collect information from children.

• Supabase (database, files and sign-in, European Union) and Vercel (application servers, Dublin): hosting.
• Resend (Ireland, European Union): sends SOOT's sign-in emails (invitations and password links) from no-reply@lawsoot.co.za. It sees the email address and the message, nothing else.
• Microsoft 365 or Google: only when a firm member connects their own mailbox or calendar; SOOT reads and sends through it for them.
• Google Fonts and jsDelivr: fonts for documents and the text-reading files for scanned pages are downloaded from them. Your IP address is seen by them; no other personal information is sent. Scanned pages are read on your own device.
• No advertising, tracking or analytics tools.

• An authenticator app is required on every sign-in; five wrong passwords lock an account for 15 minutes.
• Each firm is kept apart by rules inside the database, checked on every request; files are private and open only through SOOT.
• Everything travels encrypted (HTTPS/TLS) and is stored encrypted on disk (AES-256) by our hosting provider; mailbox connections are encrypted again by SOOT.
• Changes to matters, people, HR and settings are logged and can't be edited.

A firm's information is kept for as long as the firm uses SOOT. When a firm leaves, we give it its information on request and then delete it from SOOT within 90 days, unless the law requires us to keep something longer (for example our own invoices, kept for five years for SARS). Booking requests are kept only as long as we need them to follow up the booking. Law firms have their own legal duties to keep records (for example under the Legal Practice Act and FICA); those are the firm's decisions as responsible party.

You may ask what personal information we hold about you, ask us to correct or delete it, object to how we use it, and complain to the Information Regulator (inforeg.org.za, POPIAComplaints@inforegulator.org.za). For information a law firm keeps about you in SOOT, ask that firm; we will help it answer.

If we have reason to believe someone got unauthorised access to personal information, we tell the affected firm (and, where we are the responsible party, the Information Regulator and the people affected) as soon as reasonably possible, as section 22 requires, with what happened and what to do.

Leandra Pretorius, Lodestar. leandra@lawsoot.co.za