Acceptable Use Policy

This policy sets out how OxyAccounting may and may not be used. It forms part of our Terms of Service, so breaking it is a breach of those terms. Where the two overlap, both apply. Where they genuinely conflict, the Terms of Service win.

OxyAccounting holds a business's books: its invoices, its expenses, its ledger, its VAT and its payroll. Misusing it rarely affects only us. It affects your customers, your employees, SARS and anyone who relies on the figures, which is why most of the rules below exist.

The policy applies to everyone who uses your account, and you are responsible for each of them following it:

• You, as the account holder and as the business whose books are kept in OxyAccounting
• Anyone you invite in, including staff and the accountant or bookkeeper you give access to, whatever their permission level
• Anything that uses an API key issued for your company

Anything any of these does is treated as something you did.

OxyAccounting is for recording what really happened in your business. You must not use it to:

• Record transactions that did not happen, or issue invoices, credit notes, quotes or payslips for supplies or work that never took place
• Back-date, alter or delete records to mislead SARS, a bank, a lender, an insurer, an auditor, an investor or anyone else who relies on them
• Claim VAT you are not entitled to, or hide VAT you owe
• Disguise where money came from, who owns it or what it was for, or otherwise help anyone launder money or finance crime

You remain responsible for everything you file or submit using figures from OxyAccounting, including your VAT201, EMP201, EMP501, IRP5 certificates and annual financial statements. Our reports and calculations are there to help you. They do not replace your own review or the advice of an accountant or tax practitioner where you need one.

• Each person uses their own login. Do not share a password or use someone else's. If a person needs access, invite them as a user
• Give each person only the access they need, and remove people promptly when they leave or their role changes
• Only set up a company in OxyAccounting that you own, run or are authorised in writing to act for
• Accountants and bookkeepers may only accept access to a client's books with that client's authority, and must stop using it when that authority ends
• One free trial per business. Do not open repeat trials for the same business under different email addresses
• If you suspect someone has got into your account without permission, tell us straight away at hello@oxyaccounting.co.za

OxyAccounting emails invoices, quotes, statements, reminders, remittance advice and payslips on your behalf. Those emails carry your business's name, and they reach people who never agreed to anything with us, so:

• Send documents only to the people they concern: the customer on the invoice, the supplier on the order, the employee on the payslip
• OxyAccounting is not a newsletter or marketing tool. Do not use it to send promotions or bulk mail. Direct marketing to anyone who has not opted in is restricted by section 69 of POPIA and section 45 of the Electronic Communications and Transactions Act
• Do not use a document to phish, to ask for payment into an account that is not yours, or to pass yourself off as another business
• Do not set reminders or recurring documents to go out so often that they amount to harassment
• When someone asks you to stop contacting them, stop

We may slow, pause or stop sending on your behalf if your sending is harming the people receiving it, other customers or our ability to deliver email for everyone. We will tell you if we do.

When you put information about your customers, suppliers and employees into OxyAccounting, you are the responsible party for it under POPIA and we process it on your behalf, as our Privacy Policy explains. That means:

• You need a lawful reason to hold each person's information and to use it the way you do, and you must tell them whatever the law requires you to tell them
• Keep sensitive details in the fields built for them. Employee identity numbers, tax numbers and banking details belong in payroll, not in an invoice note, a description or a reference field
• Do not store health, religious, political, biometric or criminal information about anyone, or information about children, unless the law requires it for payroll and you have a lawful basis
• Do not use OxyAccounting to build marketing lists, profile people or sell or share personal information outside the running of your business
• If someone asks you to see, correct or delete their information, deal with the request. If one reaches us, we will refer it to you

• Upload only records that relate to your business and its books: receipts, supplier invoices, statements and similar documents
• OxyAccounting is not general file storage or a backup service, and must not be used to keep or share unrelated material
• Do not upload anything illegal, anything you have no right to store, or anything containing malware or built to exploit the software that reads it
• Do not import or upload data at a volume or rate intended to overload the platform

Roxy, the in-app assistant, and receipt scanning are there to save you time. When you use them you must not:

• Try to make them ignore their instructions or limits, for example by prompt injection
• Try to extract their instructions, or use them to reach any other customer's information
• Paste your customers' or employees' personal information into Roxy. It answers questions about the software and does not need it
• Present an answer from Roxy as the advice of an accountant, a tax practitioner or a lawyer

A scanned receipt produces a suggestion, not an entry. Check it before you apply it.

• An API key is a password. Keep it out of websites, public code repositories and anywhere else another person could read it
• If a key is exposed, revoke it at once under Settings → Company and tell us
• Stay within the rate limits. Do not use several keys or accounts to get around a limit
• Do not use the API to copy OxyAccounting's data into a competing service or to build a product that replaces it

You must not:

• Probe, scan or test the security of OxyAccounting, or attempt to reach any other customer's data, without our written permission
• Get around logins, permissions, plan limits or rate limits
• Put an unreasonable load on the platform, or scrape or bulk-download it other than through the export and API we provide
• Resell OxyAccounting or offer it to others as your own product without our written agreement
• Copy the software, or use it to build or train a competing product

If you find a security weakness, please tell us at hello@oxyaccounting.co.za with "Security" in the subject line. Give us reasonable time to fix it before telling anyone else, and do not access or keep more information than you need to show us the problem. We will not take action against anyone who reports a weakness this way in good faith.

You may not use OxyAccounting to keep the books of, or otherwise run, a business that:

• Is unlawful in South Africa or anywhere else it operates or sells
• Provides financial services, credit, insurance or crypto asset services without the registration or licence the law requires, such as from the FSCA or the National Credit Regulator
• Runs a pyramid, Ponzi, chain letter or similar scheme, which section 43 of the Consumer Protection Act prohibits
• Offers gambling, betting or lotteries without the required licence
• Deals in firearms, ammunition or explosives without the required licence, or in controlled drugs or unlicensed medicines
• Sells counterfeit, stolen or pirated goods
• Sells personal information, stolen credentials, malware or hacking services
• Deals with any person or country subject to sanctions that apply in South Africa

If you are not sure whether your business is affected, ask us before relying on OxyAccounting for it.

Everything goes to one address, hello@oxyaccounting.co.za. A subject line helps it reach the right person:

• "Security" for a security weakness, or suspected unauthorised access to an account
• "Misuse" for an OxyAccounting customer using the platform against these rules, for example a fraudulent invoice sent to you
• "Information Officer" for a privacy concern or a request about your personal information

Tell us what you saw, where and when, and include the document or invoice number if you have it.

If we reasonably believe this policy has been broken, or is about to be, we may:

• Look into it, and ask you for information about it
• Pause a single capability while we look into it, such as sending email on your behalf, an API key, receipt scanning or an accountant's access
• Remove content that breaks the rules
• Suspend or end your access. Where the breach is serious, this may be immediate and without a refund for the unused period, to the extent the law allows
• Report the matter to the police, SARS, the Information Regulator or another authority where the law requires or allows us to

We will act in proportion to what happened. We will normally tell you what we have done and why, unless that would prejudice an investigation or the law prevents it. Suspending an account does not take your records away from you: unless the law prevents it, you will still be able to export your data.

We may update this policy as OxyAccounting changes and as new kinds of misuse appear. The current version is always on this page. If a change materially adds to what you must or must not do, we will tell you in the application or by email before it takes effect.

OxyAccounting (Pty) Ltd, registration number 2026/615785/07. Questions about this policy can be sent to hello@oxyaccounting.co.za. This policy is governed by the laws of South Africa.