Privacy Policy

What we collect

• Account details — name and email address when you sign up.
• Business details — company name, registration number, VAT number, SARS tax reference number, address, phone number, industry, and logo, if you choose to enter them in Settings.
• Financial data you upload — bank statement PDFs, and the transaction data (dates, descriptions, amounts) extracted from them; receipts, invoices, and other documents you attach to transactions.
• Usage data— we use Google Analytics to understand how the site is used (pages visited, general location, device type). See Google's own privacy policy for how they handle this data.
• Payment information — subscription payments are processed entirely by PayFast. We never see or store your card details — PayFast sends us only a payment confirmation and a token used to bill your subscription going forward.

How we use it

We use your information only to:

• Provide the service — extract and categorize transactions, generate reports, and store your records.
• Process your subscription payments via PayFast and manage billing.
• Respond to support requests you send us.
• Improve the product, using aggregated, non-identifying usage patterns.

Transaction categorization is done using keyword rules you configure, not by feeding your financial data to a third-party AI model. The one place we use AI is to generate general-interest articles for our public blog — that process never has access to your account data.

Who we share it with

We don't sell your information. We share it only with the service providers that run the platform, each bound to protect it:

• Supabase — our database, authentication, and file storage provider.
• Vercel — hosts the application.
• PayFast — processes subscription payments.
• Google Analytics — site usage analytics.

If you invite an accountant to manage your books, or accept an invitation from one, we share your business and financial data with them to the extent needed for them to do that work — and only for as long as that relationship is active. You control what an accountant you've invited can see or edit on a page-by-page basis.

How long we keep it

We keep your information for as long as your account is active, and for a reasonable period after cancellation in case you resubscribe or need a copy of your records, unless you ask us to delete it sooner (subject to any legal obligation to retain financial records for a minimum period).

Your rights

Under POPIA, you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct information that's inaccurate or out of date.
• Delete your account and associated data.
• Explain how a particular piece of information about you is being used.

To exercise any of these, email us at support@onepractice.co.za. You can also lodge a complaint with the Information Regulator of South Africa if you believe we've mishandled your information.

Information Officer

Our Information Officer for POPIA purposes can be reached at support@onepractice.co.za.

Changes to this policy

If we make material changes to how we handle your information, we'll update this page and change the "last updated" date above.

Contact us

Questions about this policy or your data? Email support@onepractice.co.za.