Privacy Policy

We may collect the following types of personal information when you use OxyAccounting:

• Account information: name, email address, phone number and business details
• Payment information: credit card or banking details processed securely via PayFast
• Usage data: login times, pages accessed and interaction with the platform
• Assistant conversations: the questions you type into Roxy, the in-app assistant, and its replies (see section 7)
• Cookies and tracking information: for analytics, performance and site functionality

We use personal information for the following purposes:

• To provide, operate and maintain the OxyAccounting platform
• To process payments and send invoices or receipts
• To improve our services and customise your experience
• To send service, billing and support messages about your account
• To contact you about other services we offer, only if you have asked us to (see section 3)
• To comply with legal obligations, including POPIA and tax regulations

Section 11 of POPIA requires a lawful reason for each of these. We run your account, bill you and support you because that is what our agreement with you requires. We keep billing and tax records because the law requires it. We protect the platform against fraud and misuse, and improve it, because we have a legitimate interest in doing so that does not override your rights. We contact you about other services only with your consent (section 3).

OxyAccounting also designs websites and brands for businesses that are starting out. We will only contact you about this if you ask us to. Inside the application, a business with no website is shown a short note offering it, with a button to say yes. Nothing happens unless you press that button, and agreeing is never a condition of using OxyAccounting.

If you say yes, we use your name, email address, phone number and business name to contact you by email or phone about a website and brand for your business, and for nothing else. For this we are the responsible party under POPIA. We keep a record of when you agreed, the exact words you agreed to and where in the application you did so, because the Act requires us to be able to show your consent. The only thing we look at to decide whether to show the note is whether the website field in your company settings is empty. Your accounting records are never used for this.

You can withdraw at any time, and it takes effect straight away:

• Switch it off under My profile in the application
• Use the unsubscribe link at the foot of any email we send you about it
• Tell us by reply, on the phone or at hello@oxyaccounting.co.za

Once you withdraw we will not contact you about it again, and the application will not offer it to you again. Saying no or withdrawing has no effect on your account or your subscription. Your details are not passed to anyone else for this purpose.

OxyAccounting is committed to compliance with the Protection of Personal Information Act (POPIA). Our role depends on whose information it is:

• Information about you as our customer or as a visitor to this website, such as your account, billing, usage and your conversations with Roxy: we are the responsible party. We decide how it is used, and this policy is our account of that
• Records your business captures in OxyAccounting about your own customers, suppliers and employees: you are the responsible party and we are your operator. We process that information only on your instructions, to provide the service (see section 10)

In both roles we ensure that:

• Personal information is collected lawfully and for a specific purpose
• Users are informed about the collection and use of their data
• Information is stored securely and only accessible to authorised personnel
• Users can request access, correction or deletion of their personal information
• Personal information is not shared or sold to third parties without consent, except where legally required

OxyAccounting is a service for businesses and is not intended for anyone under the age of 18. We do not knowingly collect personal information about children as our own customers.

We may share personal information with:

• PayFast (Network9 (Pty) Ltd), our South African payment processor, to take subscription payments
• Resend, our email delivery provider, to send the emails you and your customers receive from the platform
• Anthropic, to power Roxy, the in-app assistant, and receipt scanning (see section 7)
• Legal authorities when required by law

Each of these providers is bound to process the information only as instructed by us, to keep it confidential, and to apply appropriate security measures. We do not sell personal information. Nothing from inside the application is shared for advertising. The marketing website carries analytics and advertising tools, which are named in section 8.

OxyAccounting runs on servers in the United Kingdom, so the information you keep in the application is stored and processed there. Section 72 of POPIA allows personal information to leave South Africa where the recipient is bound by law that gives it protection substantially similar to POPIA's. The UK's data protection law, the UK GDPR and the Data Protection Act 2018, does that.

We are moving the platform to a data centre in South Africa. When the move is complete we will update this section and tell you in the application.

Two features of OxyAccounting use a large language model operated by Anthropic, PBC in the United States: Roxy, the in-app assistant, and receipt scanning. Section 72 of POPIA requires us to tell you when personal information is processed outside the Republic, so this section sets out what each of these features sends.

Roxy answers questions about how to use the software.

What is sent to Anthropic when you use Roxy:

• The messages you type into the chat, and Roxy's replies in that conversation
• The name of the page you are on when you ask (for example "invoices")
• Your subscription plan name and the list of features enabled on your account

What is not sent:

• Roxy has no access to your records. It cannot read your invoices, customers, suppliers, expenses, bank transactions, ledger or payroll, and it is not able to query the database
• No customer, employee or transaction data is sent unless you type it into the chat yourself
• Your name, email address and company details are not sent

Because the chat box is free text, please do not paste personal information about your customers or employees into it. You do not need to: Roxy answers questions about how the software works, not about your data. Anthropic is contractually restricted to processing the request in order to return an answer, and does not use it to train its models.

If you would prefer not to use an assistant that processes outside South Africa, simply do not use Roxy. Every part of the platform works without it, and Roxy sends nothing to Anthropic unless you open the chat and send a message.

Receipt scanning reads a photographed till slip or a supplier invoice so that the expense form can be filled in for you. When you attach an image or PDF to an expense, or photograph a slip while capturing one, that file is sent to Anthropic to be read. What is sent:

• The image or PDF itself, and everything printed on it. A receipt or invoice usually shows the supplier's name, address and VAT number and the amounts, and may show your name, your business's name or the last digits of a card number

What comes back is a suggested supplier, date, document number and amounts, which you check and apply yourself. Nothing is posted to your books from a scan without your say-so. The file stays stored in OxyAccounting as an attachment. As with Roxy, Anthropic is contractually restricted to processing the file in order to return the result, and does not use it to train its models.

Scanning starts automatically when a file is attached to an expense. If you would prefer a document not to be read this way, keep it outside OxyAccounting and enter the expense by hand. Documents attached to anything other than an expense are never scanned.

Our website uses cookies and similar technologies to enhance functionality and analyse usage. You can adjust your browser settings to refuse cookies, but some features may not work properly.

On this website, and never inside the application, we note where our readers arrive from and which page they land on, along with an approximate city derived from your IP address, so we can see which parts of the site are doing their job.

This is keyed to a random identifier stored in a cookie. It is not linked to your name, your email address or any customer account.

A second cookie holds a different random identifier and lasts about a year, so that we can tell a first-time reader from somebody coming back for another look. All it records is how many times you have visited and roughly when the last visit was. Clearing your browser cookies removes it and you appear as a new reader again.

The website also loads tools belonging to other companies. Google Tag Manager and Google Analytics tell us which pages are read and how readers find us. A Meta advertising pixel tells us whether an advert we placed led to a visit, and Meta may use it to show you our adverts elsewhere. Vercel, who host the site, count page views and page speed. Each of these receives your IP address and the page you are on, and each applies its own privacy terms.

We do not record what you type and we do not capture your screen. None of the above runs inside OxyAccounting itself: once you sign in, your accounting records are never subject to any of it.

We implement reasonable technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure or destruction. These include encrypted connections, access controls that limit tenant data to that tenant's own users, an audit log of administrative access, and encryption of database backups at rest.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires. We will tell you what happened, what information was involved, what we are doing about it and what you can do to protect yourself.

As a user, you have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of inaccurate or outdated information
• Object to the processing of your personal information
• Withdraw consent where applicable
• Complain to the Information Regulator if you believe we have not complied with POPIA

Requests can be sent to hello@oxyaccounting.co.za, marked for the attention of the Information Officer. We will acknowledge your request and respond within 30 days. If a request is complex we may need longer, and if so we will tell you why and when to expect an answer. We may ask you to confirm your identity before acting on a request, so that your information is never released to someone else.

A request for access to records may also be made under the Promotion of Access to Information Act (PAIA).

You can also export your own data at any time without asking us. In the application, go to Company Settings and open the "Your Data" tab to download a complete copy of your company's records.

One important limit: for the records your business captures in OxyAccounting about your own customers and employees, you are the responsible party and we are the operator. If one of your customers or employees asks us for access to or deletion of their information, we will refer them to you, because that information is yours to account for and it is not ours to disclose or erase on our own initiative. If you need us to act on such a request, tell us and we will.

As required by section 55 of POPIA, OxyAccounting has an Information Officer responsible for encouraging and ensuring compliance with the Act, dealing with requests made to us, and working with the Information Regulator. Under POPIA the head of a private body holds this role automatically, so ours is held by the Managing Director, whose details are on record at the CIPC.

Reach the Information Officer at hello@oxyaccounting.co.za with "Information Officer" in the subject line. If you are not satisfied with how we handle your request, you may complain to the Information Regulator of South Africa at complaints.IR@justice.gov.za.

We retain personal information for the duration of your active subscription and for a limited period thereafter to allow account reactivation or data export. Customer data is securely deleted from the platform or anonymised within ninety (90) days after account cancellation or termination, unless otherwise required by law or to protect our legitimate interests.

Some records we must keep for longer by law. Our invoices to you and the record of your subscription payments are kept for five years, as the Tax Administration Act requires of us.

Free trials are treated differently, and deliberately so. An expired trial that was never converted into a subscription is not deleted on the ninety-day schedule above: we keep the account so that you can come back to the work you did, export it, or subscribe later and find everything where you left it. You can ask us at any time to permanently erase a trial account and everything in it, and we will do so. We may also delete a long-dormant expired trial ourselves, but not before giving you reasonable notice at your account email address.

Customers are responsible for ensuring compliance with all record-keeping and data retention laws applicable to their business.

OxyAccounting may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the latest revision. If we make a material change, we will tell you in the application or by email before it takes effect. Where a change would affect something you consented to, we will ask for your consent again rather than assume it.

If you have any questions or concerns regarding this Privacy Policy or your personal information, please contact us at hello@oxyaccounting.co.za.