1. Who we are
GoAI Accounting ("GoAI", "we", "us") is online accounting software for South African businesses, available at goaiaccounting.co.za. It's used to keep books, reconcile bank statements, prepare VAT and income tax figures and produce financial statements.
This policy explains what we do with personal information. "Personal information" has the meaning given in POPIA: any information about an identifiable, living person or an existing company, such as a name, email address, ID or tax number, or bank details.
2. Your books: who is responsible
There are two kinds of information in GoAI, and POPIA treats them differently:
- Your login and use of GoAI. For the information about you as a user (your name, email address, password and how you use the service), GoAI is the responsible party.
- The books you keep in GoAI. The records you or your team put into GoAI (customers, suppliers, invoices, bank statements, slips, directors and so on) belong to your business. For that information your business is the responsible party, and GoAI acts as your operator (section 21 of POPIA): we process it only to provide the service to you, on your instructions, keep it confidential and secure, and don't use it for anything else.
If your books contain personal information about other people (for example your customers' contact details), you're responsible for having a lawful reason to keep it and for telling those people how it's used.
3. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Your login | Name, email address, password (stored only as a one-way scrambled hash, never readable), 2-step sign-in key, which companies you can see and your role | You, or the person who invited you |
| Sign-in and security records | Failed sign-in attempts, when you signed in, and a log of changes made in each company (who changed what, when) | Created as you use GoAI |
| Your books | Company details, tax and registration numbers, customers and suppliers (names, emails, phone numbers, addresses), invoices, bills, bank statements and transactions, card numbers as printed on statements (only the masked form, e.g. 485442*2317), slips and receipts, attachments, directors and shareholders | You and your team, and the files you upload |
| Support and privacy requests | Your name, email address, company and message | The forms on our Support and Delete Account pages |
| Technical information | Your device's internet (IP) address, browser type and the pages requested, kept in the records of our hosting and network providers | Your browser |
We don't ask for special personal information (such as health, religion or biometric information) and you shouldn't upload it. We don't collect your banking passwords: bank statements are uploaded by you as files.
4. Why we use it
We use personal information only for these purposes, and only as much as we need (POPIA sections 10 to 13):
- To provide GoAI to you: signing you in, storing and processing your books, producing reports, and the features you choose to use. This is necessary to perform our agreement with you.
- To keep GoAI and your books secure: 2-step sign-in, logging sign-ins and changes, detecting misuse and fixing problems. This protects your legitimate interests and ours.
- To answer you: support, privacy and deletion requests.
- To meet legal obligations: for example if a court or regulator lawfully requires information.
We don't sell personal information, and we don't use your books to profile you or for advertising.
5. AI features
Some features use artificial intelligence: the GoAI assistant, reading slips and receipts, and reading PDF bank statements. When you use one of them, the content needed for that task (for example the slip image, the statement page, or your question and the figures it relates to) is sent to our AI provider, Anthropic, to produce the result, and the result is returned to GoAI. Anthropic processes it on our behalf under its commercial terms, which don't allow it to train its models on that content. You don't have to use these features: everything can also be entered by hand.
AI results can be wrong. Always check what's filled in before you save it.
6. Who we share it with
We share personal information only with service providers we need to run GoAI, who act as our operators and must keep it confidential and secure:
| Provider | What they do | Where |
|---|---|---|
| Render | Hosts the GoAI application, its database and stored files | Frankfurt, Germany |
| Cloudflare | Network security and delivery: protects the website from attacks and passes traffic to GoAI | Global network |
| Anthropic | AI features (only when you use them) | United States |
Other people can see your books only if you (or your company's owner) give them a login. We may also disclose information if the law requires it, or to protect someone's safety or our rights, and only as far as necessary.
7. Where it's stored (outside South Africa)
GoAI is hosted in Frankfurt, Germany, and AI requests are processed in the United States. Under section 72 of POPIA we only send personal information outside South Africa to providers who are bound by law or by written agreements to protect it to a standard similar to POPIA (Germany falls under the EU's General Data Protection Regulation), or where the transfer is needed to provide the service you've asked for.
8. How we protect it
We take reasonable technical and organisational measures to keep personal information safe (section 19 of POPIA), including:
- encrypted connections (HTTPS) between your browser and GoAI;
- passwords stored only as one-way hashes, and 2-step sign-in with an authenticator app for every login;
- sign-ins locked after repeated wrong attempts, and sessions that expire;
- roles, including read-only access, so people see and change only what they should;
- each company's books kept separate, a record of changes, and daily backups;
- access to the systems limited to the people who run GoAI.
No system is completely secure. If we have reason to believe your personal information has been accessed or acquired without authority, we'll tell you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires, and say what you can do to protect yourself.
You can help by keeping your password and authenticator app to yourself and removing logins that are no longer needed.
9. How long we keep it
- Your books stay in GoAI for as long as your company uses it. You can download a full backup at any time.
- When you ask us to delete a company or your login, we delete it from the live system within 30 days of confirming the request; copies in our backups are overwritten within a further 30 days.
- Support and privacy requests are kept for as long as needed to deal with them, and up to two years after that in case questions come up later.
- We may keep information for longer only where the law requires it.
South African law (for example the Companies Act and the Tax Administration Act) generally requires businesses to keep their accounting records for at least five years. That obligation is your business's: download a backup before asking us to delete your books.
10. Your rights
Under POPIA you may:
- ask whether we hold personal information about you, and for a copy of it (sections 23 and 24 of POPIA, and the Promotion of Access to Information Act);
- ask us to correct information that's inaccurate, out of date or incomplete, or to delete it if we're no longer allowed to keep it;
- object to us processing your information, and withdraw any consent you've given;
- not be subject to decisions based solely on automated processing that significantly affect you (GoAI doesn't make such decisions);
- lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za.
Many changes you can make yourself: your name and password under Your login, and your books in GoAI. For anything else, use the privacy request form. We may need to confirm who you are before acting on a request, and we'll reply within a reasonable time (POPIA allows 30 days for most requests). If the information is in a company's books, we'll involve that company, since it's the responsible party.
11. Cookies and your browser
GoAI uses one essential cookie, which keeps you signed in. It isn't used for tracking or advertising, and GoAI uses no advertising or analytics cookies. Your browser may also remember a few display choices on your device (such as the menu layout), which never leave your device.
12. Emails and marketing
We send emails only when they're needed for the service, such as sign-in invitations or replies to your requests. We won't send you direct marketing without your consent (section 69 of POPIA), and you can opt out of any marketing at any time.
13. Children
GoAI is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's information as users.
14. Changes and contact
We may update this policy when GoAI or the law changes. We'll show the date of the latest version at the top, and tell you in GoAI about any significant changes.
Questions or requests about your personal information: contact us through the Support page.