Reconciled ("we", "us", "our") is the responsible party for the personal information described in this notice. We process personal information in line with the Protection of Personal Information Act, No. 4 of 2013 (POPIA).
1. Who we are
Responsible party: Fun Things SA (Pty) Ltd t/a Reconciled (Reg. No. 2019/405735/07)
Address: 33 Ballyclare Drive, Bryanston, Johannesburg, Gauteng, 2191, South Africa
Information Officer: Wynand Holtzhausen — hello@reconciled.co.za
2. What information we collect
We collect two distinct categories of personal information:
About our users (accountants and firm staff)
- Name, email address, phone number
- Password hash, two-factor authentication secrets
- Activity logs (actions taken inside the application)
- Billing details processed by our payment processor
About your clients (the natural and juristic persons your firm represents)
- Names, contact details, identity numbers, tax reference numbers
- Director and shareholder information for juristic clients
- Bank account numbers and bank statements you upload for processing
- Compliance filings, deadlines, and supporting documents
For client information your firm uploads, your firm is the responsible party and Reconciled is an operator within the meaning of POPIA. We process this data only on your firm's documented instructions.
3. Why we process this information (purpose)
- To provide accounting practice management features (compliance tracking, time entries, calendar)
- To extract transactions from documents you upload, using AI processing
- To produce exports compatible with Sage, Pastel, Xero, and QuickBooks
- To bill your firm for usage
- To investigate security incidents and prevent fraud
- To comply with legal obligations (e.g. tax, anti-money-laundering)
4. Lawful basis
We rely on the following lawful bases under POPIA s.11:
- Performance of a contract — the subscription you signed up for
- Consent — for AI processing of uploaded documents and for analytics cookies
- Legitimate interests — fraud prevention, system security, product improvement
- Legal obligation — tax, audit, and regulatory record retention
5. Cross-border transfer
Documents you upload (including bank statements) are transmitted to Anthropic, PBC in the United States to perform AI extraction. Anthropic is bound by a Data Processing Addendum that imposes confidentiality and security obligations equivalent to those required by POPIA s.72. Documents are not used by Anthropic to train models.
See our sub-processor list for all third parties that may process your data.
6. How long we keep it
- Account data: while your subscription is active, plus 12 months
- Documents and extractions: as set in your firm's retention policy (default: 7 years to align with SARS retention rules)
- Activity logs: 7 years
- Token usage records: 24 months
- Backups: 30 days rolling
7. Your rights as a data subject
Under POPIA you have the right to:
- Be told what personal information we hold about you
- Request a copy of that information (right of access)
- Request correction or deletion
- Object to processing or withdraw consent
- Lodge a complaint with the Information Regulator
To exercise any of these rights, email hello@reconciled.co.za. We will respond within 30 days.
8. Information Regulator
If you believe we have not handled your personal information lawfully, you may complain to the Information Regulator (South Africa):
inforegulator.org.za — enquiries@inforegulator.org.za
9. Cookies and analytics
Our website uses Google Tag Manager to understand which pages help potential customers. We do not load any analytics cookies until you accept the consent banner. You can withdraw consent at any time by clearing the rc_cookie_consent_v1 entry from your browser's local storage.
10. Changes to this notice
When we make material changes we will notify firm administrators by email. Your continued use after notification constitutes acceptance of the updated notice.