Privacy notice

Who we are

BeanworX is accounting and payroll software run by BeanworX. Questions about this notice go to privacy@beanworx.com.

Two different roles

For your own account — your name, email address, sign-in and what you pay us — we decide what is collected and why. POPIA calls us the responsible party.

For the books you keep in BeanworX — customers, suppliers, invoices, bank statements, employees and their pay — the business whose books they are decides what goes in and why. That business is the responsible party, and we are its operator: we process that information only to provide BeanworX to it, keep it confidential, and protect it as described below.

What we keep

• Your account: name, email address, password (stored only as a one-way hash), two-factor settings, and which books you can open.
• The books: whatever a business records — contacts, quotes, invoices, bills, bank lines, journals, job cards and time.
• Payroll: employees' names, ID or passport numbers, tax numbers, bank details, pay, leave and the returns made from them.
• Documents: receipts, invoices and statements uploaded, photographed or emailed in.
• Use of the service: sign-in times, the address you connected from, and an audit trail of changes to the books — so every change can be traced to a person.

We do not sell personal information, and we do not use the books to advertise to anyone.

Who else processes it

We use a small number of services to run BeanworX. Each only receives what it needs for its job.

• DigitalOcean — hosts the servers and database.
• Anthropic — reads documents and statements you upload and answers questions you ask about the books. What is sent is not used to train their models.
• Stripe — takes subscription payments. We never see or store your card number.
• Postmark — delivers the emails BeanworX sends and receives documents emailed in.
• Only if a business connects them: Google (sending mail from its own address), Facebook and LinkedIn (publishing its posts), and Stitch or BeanCruncher (bringing in bank statements).

Some of these providers store or process information outside South Africa, including in the United States and Europe. We use them only where the law of that country, or our agreement with the provider, gives protection substantially similar to POPIA, as section 72 of the Act requires.

How it is protected

• Every business's books are separated inside the database itself, so one business's records cannot be read while working in another's.
• Traffic is encrypted in transit, and payment-provider keys and similar secrets are encrypted at rest.
• A business can limit each person to what their role needs, and every change to the books is recorded against the person who made it.
• The database is backed up every night.
• Nothing the AI suggests reaches the books until a person approves it.

If personal information is ever accessed by someone who should not have it, we will tell the affected business and the Information Regulator as POPIA requires.

How long we keep it

A business's books stay for as long as it uses BeanworX. South African law expects accounting and tax records to be kept for at least five years, so leaving BeanworX never silently destroys them: a business can download everything first, and we delete its books when it asks us to. Our own billing records are kept for as long as tax law requires.

Your rights under POPIA

You may ask us, free of charge:

• whether we hold personal information about you, and for a copy of it;
• to correct or delete information that is wrong, out of date or kept without reason;
• to stop or limit processing you object to.

Where the information sits in a business's books, we pass your request to that business, because it decides what is kept — and we help it respond. Write to privacy@beanworx.com. We answer within 30 days.

If you are unhappy with how we have handled your information, you can complain to the Information Regulator of South Africa at inforeg.org.za.

Cookies

BeanworX uses only the cookies it needs to keep you signed in and to protect forms from forgery. There are no advertising or tracking cookies.

Changes to this notice

When this notice changes in a way that matters, we will tell account holders by email before the change takes effect.