Privacy Policy

1. Who we are

This policy is published by Appventure (Pty) Ltd ("Appventure", "we", "our"), registered in South Africa. We are the responsible party in terms of the Protection of Personal Information Act, 2013 ("POPIA") for all personal information we process through the Appventure One application - except for the employment/payroll information described in section 1a below, where the business that employs you is the responsible party and we act as its operator.

1a. If you use the Employee Portal

If your employer uses Appventure One's payroll module and has given you access to the Employee Portal (to view your payslips or apply for leave), the employment data listed under "Employment" in section 2 below - your name, ID number, tax number, date of birth and salary data - is collected and processed on your employer's instruction. Under POPIA s1 / s21, your employer is the responsible party for that information, and Appventure acts as its operator: we process it only to run the payroll and portal your employer configured, under a written data-processing agreement with your employer.

If you want to access, correct or delete your employment information, or object to how it is processed, raise it with your employer first - they hold the records and make the decision. If your employer is unresponsive, or the request concerns Appventure's own handling of the Employee Portal itself, email our Information Officer at privacy@appventure.tech. This works from any device - it does not require an Appventure One admin account.

2. Information we collect

We collect only what we need to deliver the service:

• Identity: name, email, SA ID number (optional, for age-based tax rebates).
• Entity information: company name, registration number, tax number, VAT number.
• Financial: bank statements you upload, transactions, invoices, fixed-asset records.
• Employment (if you use payroll): employee names, ID numbers, tax numbers, dates of birth, salary data. Encrypted at rest.
• Documents: files you upload (payslips, IRP5s, invoices).
• Import diagnostics: when you bring your books over, we record the column headings we recognise in the files you upload, never their contents, so we can keep our importers up to date. Headings we do not recognise are kept only as a scrambled code.
• Behavioural: IP address, browser type, and audit log entries for your actions in the app.

3. Why we collect it (purpose)

We process personal information to provide the Appventure One service: parse your bank statements, classify transactions, generate management reports and tax returns, track compliance deadlines, and bill your subscription. We do not use your personal information for any other purpose without your further consent.

4. Lawful basis

We rely on the following lawful bases per POPIA s11:

• Contract - most processing is necessary to deliver the service you subscribed to.
• Law - tax and compliance records are processed pursuant to the Tax Administration Act, Companies Act, and related legislation.
• Legitimate interest - security logs (IP, user-agent) are processed to protect the platform and detect fraud.
• Consent - explicit, revocable consent is required for cross-border transfer to Anthropic (Claude API) for AI classification and AI reading of documents.

5. Who we share with

We share personal information only with the processors listed below, under written data-processing agreements:

We do not sell personal information. We do not use personal information for targeted advertising.

6. Cross-border transfers

Some of our processors are located outside South Africa. Where the destination is not deemed "adequate" by the Information Regulator, we rely on the processor's Standard Contractual Clauses (SCCs) and, for Claude API classification and document reading specifically, your explicit consent recorded at onboarding. You may revoke cross-border consent at any time in your privacy settings; classification will fall back to keyword rules and the figures in your PDFs are captured by hand instead.

7. Retention

We retain information only as long as needed:

• SARS notices, assessments, and correspondence: 5 year(s) from date of the communication. Basis: Tax Administration Act s29 (5 years).
• Bank statements + parsed bank transactions: 7 year(s) from statement date. Basis: Companies Act s24 (7 years).
• Identity + address verification data: 5 year(s) from account closure date. Basis: FICA s42 (5 years after termination) — applied conservatively.
• System audit trail: 7 year(s) from entry creation date. Basis: POPIA + Companies Act s24 — 7 years.
• Paystack charge events + subscription history: 7 year(s) from event creation date. Basis: VAT Act + Companies Act — 7 years.
• Claude API classification cache + cost ledger: 30 days from last access (entity soft-delete or ledger flush). Basis: Operational retention — minimise per POPIA Condition 5.
• User-uploaded documents (payslips, IRP5s, invoices): 7 year(s) from upload date (for supporting records). Basis: Companies Act s24 / Tax Admin Act — 7 years.
• Bring-your-books worker task rows (MigrationTask) after they finish; hard-deleted by the migration-jobs cron, not the dry-run sweep: 90 days from task finished (succeeded / failed / cancelled). Basis: Operational retention - minimise per POPIA Condition 5.
• Header-only import telemetry (column headings we recognise, hashed otherwise; never file contents); hard-deleted by the migration-jobs cron: 180 days from recorded date. Basis: Operational retention - minimise per POPIA Condition 5.
• Read-only copy of the previous system's general ledger brought in at migration (LegacyLedgerArchive + its lines); reported, never auto-deleted: 7 year(s) from date of the newest ledger line in the copy. Basis: Companies Act s24 (7 years).
• Payroll brought over as filed from the previous payroll system (PayrollHistoryImport and its certificates, months, SARS-code lines and ETI months); history only, never posted to the ledger; reported, never auto-deleted: 5 year(s) from 31 may after the tax year ends (the emp501 annual reconciliation the history supports). Basis: Tax Administration Act s29(3)(a) (5 years from the return it supports); the salaries themselves sit in the ledger, which keeps its own Companies Act s24 7-year clock.
• Your account's security log (sign-ins, sign-outs, failed passwords and two-step codes, password and two-step changes, policy acceptances), with the IP address of each: 2 year(s) from date of the event. Basis: POPIA s14 (Condition 3, kept no longer than its purpose): long enough to look into an account takeover found at the next annual filing, then deleted.

8. Your rights (POPIA Condition 8)

• Access - request a copy of all personal information we hold about you.
• Correction - request correction of inaccurate information.
• Deletion - request deletion of your personal information (subject to legal retention requirements for tax and financial records).
• Objection to AI processing - switch off Claude API classification; the classifier falls back to keyword rules.
• Complaint - lodge a complaint with the Information Regulator (inforegulator.org.za).

If you sign in to Appventure One as a business owner or team member, exercise these rights in Settings → Privacy, or by emailing privacy@appventure.tech. We respond within 30 days per POPIA s23. If you use the Employee Portal, see section 1a above - Settings → Privacy is an admin-only page a portal sign-in cannot open.

9. Security

We apply technical and organisational measures of a standard appropriate to the risk: row-level tenant isolation, AES-256-GCM encryption of PII at rest, TLS in transit, AES-256-GCM envelope encryption on data exports, HMAC-signed audit chains, principle-of-least-privilege access for all staff, penetration testing, and an incident response runbook aligned with POPIA s22 notification obligations.

10. Information Officer

Josh van Buuren
Information Officer
privacy@appventure.tech
Appventure (Pty) Ltd, Cape Town, Western Cape, South Africa

11. Changes

We revise this policy as our processing evolves. Material changes trigger a notification email + in-app banner for at least 30 days, and may require fresh consent before you continue using the service.