Privacy Policy

ProFuturePlan (Pty) Ltd is the responsible party for the personal information processed through Profyn. Our Information Officer can be reached at privacy@profutureplan.com, South Africa.

• Account information: your name, email address and the account identifier created when you sign up, including details supplied by Google if you sign in with Google.
• Business records you enter or upload: invoices, receipts, expenses, payments, payroll entries, inventory items and the documents attached to them.
• Team information: the business you belong to and your role (owner, administrator, manager, employee, bookkeeper or accountant).
• Activity records: an append-only audit trail of actions taken in your business, so financial history is never silently changed or deleted.
• Technical information: basic security and error logs needed to keep the service running.

Payroll documents may contain other people's personal information. Where you upload information about employees or suppliers, you are the responsible party for that information and Profyn acts as your operator.

• To perform our contract with you — providing the accounts, records and features you sign up for.
• To pursue our legitimate interests — securing the service, preventing fraud and fixing faults.
• To comply with law — keeping financial and audit records where legislation requires it.
• With your consent — optional features such as AI extraction of an uploaded document, which you start yourself.

We do not sell your personal information and we do not use it for advertising.

When you use Scan or Quick Capture, the document you choose is sent to our AI provider purely to read the fields on it (supplier, dates, amounts, VAT and line items) and return them for your review. The extracted values are shown to you before anything is saved. We do not use your documents to train AI models.

• People in your business: other members see records according to their role.
• Accountants you choose: only through a share link you create. Links expire, can be revoked at any time, and every downloaded file is watermarked “Prepared for Accountant Review”.
• Our operators: our hosting, database, storage and AI providers, who process information on our instructions under confidentiality obligations.
• PayFast (subscription billing and payments): PayFast is a data recipient for payment processing for paid subscription orders. When you start a paid subscription, PayFast collects and processes the personal information needed for checkout and billing, including your name, email address, billing country/address, payment method details, transaction identifiers and payment records. PayFast uses this information to take payment, manage recurring charges and prevent fraud. PayFast acts as an independent responsible party for that payment data — see the PayFast Privacy Policy. We do not receive or store your full card details.
• Authorities: where we are legally required to disclose information.

Our hosting, AI and payment providers, including PayFast for subscription billing, may process information on servers outside South Africa. In line with section 72 of POPIA, we only use providers that are bound by contractual obligations offering a comparable level of protection to POPIA.

• Information is encrypted in transit and at rest by our hosting provider.
• Every table enforces row-level access rules, so you can only reach records belonging to your own business.
• Uploaded documents live in a private storage area and are only ever opened through short-lived, signed links.
• Sensitive changes, such as payroll edits, are restricted to owners and administrators.
• Sign-in is handled by a dedicated authentication provider; we never store your password.
• An append-only audit trail records who did what and when.

We keep your business records for as long as your account is active, and afterwards only for as long as needed to meet South African financial record-keeping obligations (generally five years) or to resolve disputes. Audit-trail entries are retained for the life of the business record they describe.

• Ask what personal information we hold about you and request a copy.
• Ask us to correct or delete information that is inaccurate, irrelevant or out of date.
• Object to processing based on legitimate interests.
• Withdraw consent for optional processing at any time.
• Lodge a complaint with the Information Regulator.

To exercise any of these rights, submit a privacy request or email privacy@profutureplan.com. We respond within 30 days.

We use only the storage strictly necessary to keep you signed in and to remember whether you have switched on Explore Demo mode. We do not run advertising or third-party tracking cookies.

If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected users as soon as reasonably possible, as required by section 22 of POPIA. Report a suspected security problem to security@profutureplan.com.

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg — inforegulator.org.za.

We will update this page when our practices change and revise the date at the top. Major changes will also be communicated in the app.