privacy & consent · version v1
Your statement is not our product.
Last updated 22 July 2026 · consent version v1
Lek reads a bank statement you choose to upload, finds the debit orders and fees billing you on repeat, and helps you cancel the ones you do not want. This page explains exactly what that involves for your information, and your rights under South Africa's Protection of Personal Information Act (POPIA).
The short version. Your statement PDF is deleted the moment it is processed, and within 72 hours at the outside. There is no bank login. Account numbers are stored as a last-4 mask only. One tap deletes everything. We never sell your information.
What we collect
- The statement PDF you upload. The most sensitive thing we touch, and the shortest-lived. It is held only long enough to read, then deleted (see retention below).
- The transactions we extract from it — dates, amounts, descriptions, and the recurring payees we detect. This is your financial data and it is protected so that only you can read it.
- Fingerprints — a one-way hash of the file, your bank's name, a last-4 account mask, and the statement period. These identify no transaction content.
- Your email address, to sign you in and, if you joined the waitlist, to tell you when your audit is ready.
We do not ask for or store your bank login, your full account number, or your card number. Lek only ever sees what you choose to upload.
How we use it
- To produce your audit: verify each transaction against your running balance, detect recurring commitments, and surface findings.
- To act on your instruction — for example, to draft a cancellation or a DebiCheck dispute. Nothing is sent without your approval.
- To sign you in and, with your consent, to notify you about your audit.
We do not sell your personal information, and we do not share it with third parties except the infrastructure providers that run the service on our behalf (our database and file storage), under contract and within the same region.
How long we keep it
- Statement PDFs: deleted immediately on successful processing; 72 hours maximum as a safety net for failures.
- Your audit and transactions: kept so you can return to them, until you delete them.
- Fingerprints: retained to recognise a re-uploaded statement; they contain no transaction content.
Your rights under POPIA
You may, at any time:
- Delete everything. Settings → Delete my data removes your profile and every derived transaction and finding, immediately and permanently. Statement PDFs are already gone by then.
- Access the information we hold about you, and ask us to correct it.
- Withdraw consent and object to processing — which, for a single-upload audit, means deleting your data as above.
- Complain to the Information Regulator of South Africa if you believe your information has been mishandled.
Consent
When you sign up you agree to this policy at the version shown above. We record which version you consented to, so that if this copy changes we can tell what you agreed to and when. Material changes are reflected in a new version and, where appropriate, we will ask you to consent again.
Contact
Questions, access requests, or anything about your information: privacy@getlek.co.za. We aim to respond within a few working days.