Privacy Policy

We may collect the following types of personal information when you use OxyAccounting:

• Account information: name, email address, phone number and business details
• Payment information: credit card or banking details processed securely via PayFast
• Usage data: login times, pages accessed and interaction with the platform
• Assistant conversations: the questions you type into Roxy, the in-app assistant, and its replies (see section 5)
• Cookies and tracking information: for analytics, performance and site functionality

We use personal information for the following purposes:

• To provide, operate and maintain the OxyAccounting platform
• To process payments and send invoices or receipts
• To improve our services and customise your experience
• To communicate updates, offers or support-related messages
• To comply with legal obligations, including POPIA and tax regulations

OxyAccounting is fully committed to compliance with the Protection of Personal Information Act (POPIA). We act as a data operator under POPIA and process customer data only as instructed by the customer, who remains the responsible party. We ensure that:

• Personal information is collected lawfully and for a specific purpose
• Users are informed about the collection and use of their data
• Information is stored securely and only accessible to authorised personnel
• Users can request access, correction or deletion of their personal information
• Personal information is not shared or sold to third parties without consent, except where legally required

We may share personal information with:

• PayFast (Network9 (Pty) Ltd), our South African payment processor, to take subscription payments
• Resend, our email delivery provider, to send the emails you and your customers receive from the platform
• Anthropic, to power Roxy, the in-app assistant (see section 5)
• Legal authorities when required by law

Each of these providers is bound to process the information only as instructed by us, to keep it confidential, and to apply appropriate security measures. We do not sell personal information. Nothing from inside the application is shared for advertising. The marketing website carries analytics and advertising tools, which are named in section 6.

OxyAccounting includes an in-app assistant called Roxy, which answers questions about how to use the software. Roxy is powered by a large language model operated by Anthropic, PBC in the United States. Section 72 of POPIA requires us to tell you when personal information is processed outside the Republic, so this section sets out exactly what leaves and what does not.

What is sent to Anthropic when you use Roxy:

• The messages you type into the chat, and Roxy's replies in that conversation
• The name of the page you are on when you ask (for example "invoices")
• Your subscription plan name and the list of features enabled on your account

What is not sent:

• Roxy has no access to your records. It cannot read your invoices, customers, suppliers, expenses, bank transactions, ledger or payroll, and it is not able to query the database
• No customer, employee or transaction data is sent unless you type it into the chat yourself
• Your name, email address and company details are not sent

Because the chat box is free text, please do not paste personal information about your customers or employees into it. You do not need to: Roxy answers questions about how the software works, not about your data. Anthropic is contractually restricted to processing the request in order to return an answer, and does not use it to train its models.

If you would prefer not to use an assistant that processes outside South Africa, simply do not use Roxy. Every part of the platform works without it, and nothing is sent to Anthropic unless you open the chat and send a message.

Our website uses cookies and similar technologies to enhance functionality and analyse usage. You can adjust your browser settings to refuse cookies, but some features may not work properly.

On this website, and never inside the application, we note where our readers arrive from and which page they land on, along with an approximate city derived from your IP address, so we can see which parts of the site are doing their job.

This is keyed to a random identifier stored in a cookie. It is not linked to your name, your email address or any customer account.

A second cookie holds a different random identifier and lasts about a year, so that we can tell a first-time reader from somebody coming back for another look. All it records is how many times you have visited and roughly when the last visit was. Clearing your browser cookies removes it and you appear as a new reader again.

The website also loads tools belonging to other companies. Google Tag Manager and Google Analytics tell us which pages are read and how readers find us. A Meta advertising pixel tells us whether an advert we placed led to a visit, and Meta may use it to show you our adverts elsewhere. Vercel, who host the site, count page views and page speed. Each of these receives your IP address and the page you are on, and each applies its own privacy terms.

We do not record what you type and we do not capture your screen. None of the above runs inside OxyAccounting itself: once you sign in, your accounting records are never subject to any of it.

We implement reasonable technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure or destruction. These include encrypted connections, access controls that limit tenant data to that tenant's own users, an audit log of administrative access, and encryption of database backups at rest.

As a user, you have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of inaccurate or outdated information
• Object to the processing of your personal information
• Withdraw consent where applicable
• Complain to the Information Regulator if you believe we have not complied with POPIA

Requests can be sent to hello@oxyaccounting.co.za, marked for the attention of the Information Officer. We will acknowledge your request and respond within the timelines set by POPIA.

You can also export your own data at any time without asking us. In the application, go to Company Settings and open the "Your Data" tab to download a complete copy of your company's records.

One important limit: for the records your business captures in OxyAccounting about your own customers and employees, you are the responsible party and we are the operator. If one of your customers or employees asks us for access to or deletion of their information, we will refer them to you, because that information is yours to account for and it is not ours to disclose or erase on our own initiative. If you need us to act on such a request, tell us and we will.

As required by section 55 of POPIA, OxyAccounting has an Information Officer responsible for encouraging and ensuring compliance with the Act, dealing with requests made to us, and working with the Information Regulator. Under POPIA the head of a private body holds this role automatically, so ours is held by the Managing Director, whose details are on record at the CIPC.

Reach the Information Officer at hello@oxyaccounting.co.za with "Information Officer" in the subject line. If you are not satisfied with how we handle your request, you may complain to the Information Regulator of South Africa at complaints.IR@justice.gov.za.

We retain personal information for the duration of your active subscription and for a limited period thereafter to allow account reactivation or data export. Customer data is securely deleted or anonymised within ninety (90) days after account cancellation or termination, unless otherwise required by law or to protect our legitimate interests.

Free trials are treated differently, and deliberately so. An expired trial that was never converted into a subscription is not deleted on the ninety-day schedule above: we keep the account so that you can come back to the work you did, export it, or subscribe later and find everything where you left it. You can ask us at any time to permanently erase a trial account and everything in it, and we will do so. We may also delete a long-dormant expired trial ourselves, but not before giving you reasonable notice at your account email address.

Customers are responsible for ensuring compliance with all record-keeping and data retention laws applicable to their business.

OxyAccounting may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the latest revision. Continued use of the platform after any change constitutes acceptance of the updated policy.

If you have any questions or concerns regarding this Privacy Policy or your personal information, please contact us at hello@oxyaccounting.co.za.