Reconciled ("we", "us", "our") is the responsible party for the personal information described in this notice. We process personal information in line with the Protection of Personal Information Act, No. 4 of 2013 (POPIA).
1. Who we are
Responsible party: Fun Things SA (Pty) Ltd t/a Reconciled (Reg. No. 2019/405735/07)
Address: 33 Ballyclare Drive, Bryanston, Johannesburg, Gauteng, 2191, South Africa
Information Officer: Wynand Holtzhausen — hello@reconciled.co.za
2. What information we collect
We collect two distinct categories of personal information:
About our users (accountants and firm staff)
- Name, email address, phone number
- Password hash, two-factor authentication secrets
- Activity logs (actions taken inside the application)
- Billing details processed by our payment processor
About your clients (the natural and juristic persons your firm represents)
- Names, contact details, identity numbers, tax reference numbers
- Director and shareholder information for juristic clients
- Bank account numbers and bank statements you upload for processing
- Compliance filings, deadlines, and supporting documents
For client information your firm uploads, your firm is the responsible party and Reconciled is an operator within the meaning of POPIA. We process this data only on your firm's documented instructions.
3. Why we process this information (purpose)
- To provide accounting practice management features (compliance tracking, time entries, calendar)
- To extract transactions from documents you upload, using AI processing
- To produce exports compatible with Sage, Pastel, Xero, and QuickBooks
- To bill your firm for usage
- To investigate security incidents and prevent fraud
- To comply with legal obligations (e.g. tax, anti-money-laundering)
4. Lawful basis
We rely on the following lawful bases under POPIA s.11:
- Performance of a contract — the subscription you signed up for
- Consent — for AI processing of uploaded documents and for analytics cookies
- Legitimate interests — fraud prevention, system security, product improvement
- Legal obligation — tax, audit, and regulatory record retention
5. Cross-border transfer
Documents you upload (including bank statements) are transmitted to Anthropic, PBC in the United States to perform AI extraction. Anthropic is bound by a Data Processing Addendum that imposes confidentiality and security obligations equivalent to those required by POPIA s.72. Documents are not used by Anthropic to train models.
See our sub-processor list for all third parties that may process your data.
6. Mailbox integration data
When you connect a mailbox to Reconciled (via IMAP/SMTP, Microsoft 365, or Google Workspace), we access your mailbox on your behalf to provide the email features you opt in to. This section is the formal disclosure of what we access, how we store it, and how you stay in control of it.
What we access
- Message metadata: subject, sender, recipients, timestamps, folder labels
- Message bodies (plain text and HTML)
- Attachments
- Your profile name and email address (so we know who connected the mailbox)
Permissions we request
- Microsoft 365 (OAuth):
Mail.Read,Mail.Send,Mail.ReadWrite,User.Read,offline_access - Google Workspace / Gmail (OAuth):
gmail.readonly,gmail.send,gmail.modify,userinfo.email,userinfo.profile - IMAP/SMTP: the username and password (or app password) you supply, encrypted at rest. Used to log in to your mail provider.
Why we need it
- To show your inbox and conversations inside Reconciled
- To send email on your behalf (invoices, replies, follow-ups, internal notes)
- To automatically link client emails to client records and compliance tasks
- To mark messages read or unread as you triage in our interface
How we store it
- Synced messages are stored in our database in the Republic of South Africa
- OAuth access tokens, refresh tokens, and IMAP/SMTP passwords are encrypted at rest using AES-256 with keys held only by Reconciled
- Email attachments are stored on our managed object storage (see sub-processors)
What we do not do
- We do not read your mail for advertising or marketing purposes
- We do not sell or share your email contents with any third party
- We do not send your email contents to AI sub-processors for model training or general processing. The only AI sub-processor (Anthropic) receives data only when you explicitly invoke a document-extraction action, and never has standing access to your inbox.
Retention & your right to disconnect
- You can disconnect a mailbox at any time from Settings → Email. Disconnecting revokes our access immediately.
- Upon disconnect (or account closure), all synced messages, attachments, and stored tokens for that mailbox are permanently deleted within 30 days.
- You can also request immediate deletion of all synced email data at any time by emailing hello@reconciled.co.za.
- You may revoke our access directly from your provider's account dashboard (Microsoft account "App permissions" / Google account "Third-party apps with account access") — doing so will cause sync to fail; we recommend disconnecting from inside Reconciled as well so we delete the stored data.
Use of these mailbox permissions complies with the Microsoft APIs Terms of Use and the Google API Services User Data Policy, including the Limited Use requirements.
7. How long we keep it
- Account data: while your subscription is active, plus 12 months
- Documents and extractions: as set in your firm's retention policy (default: 7 years to align with SARS retention rules)
- Activity logs: 7 years
- Token usage records: 24 months
- Synced email messages and attachments: while the mailbox is connected; deleted within 30 days of disconnect or account closure
- Backups: 30 days rolling
8. Your rights as a data subject
Under POPIA you have the right to:
- Be told what personal information we hold about you
- Request a copy of that information (right of access)
- Request correction or deletion
- Object to processing or withdraw consent
- Lodge a complaint with the Information Regulator
To exercise any of these rights, email hello@reconciled.co.za. We will respond within 30 days.
9. Information Regulator
If you believe we have not handled your personal information lawfully, you may complain to the Information Regulator (South Africa):
inforegulator.org.za — enquiries@inforegulator.org.za
10. Cookies and analytics
Our website uses Google Tag Manager to understand which pages help potential customers. We do not load any analytics cookies until you accept the consent banner. You can withdraw consent at any time by clearing the rc_cookie_consent_v1 entry from your browser's local storage.
11. Changes to this notice
When we make material changes we will notify firm administrators by email. Your continued use after notification constitutes acceptance of the updated notice.