Privacy Policy
Draft, under legal review. Highlighted items are still to be confirmed. This document takes effect once it is final and dated.
1. Who we are
NUMBAAS is an online accounting, payroll and business-management service provided by Numbaas (Pty) Ltd (registration number 2026/777218/07), a private company registered in South Africa. In this policy, "we", "us" and "our" mean Numbaas (Pty) Ltd.
| Item | Item |
|---|---|
| Registered and physical address | 5 Plange Avenue, Malanshof, Randburg, 2194, South Africa |
| Information Officer | William Tembo (Director) |
| Privacy email | privacy@numbaas.co.za |
| Website | numbaas.co.za |
This policy explains what personal information we process, why, how we protect it, and the rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA). Our PAIA manual, which explains how to request records we hold, is published on our website.
2. Our two roles under POPIA
We play two different roles, and your rights depend on which one applies.
| Item | We are the responsible party | We are an operator |
|---|---|---|
| Whose information | People who use NUMBAAS (account holders, invited users), people who contact us or visit our website | The information our customers record in NUMBAAS about their own customers, suppliers, employees and other people |
| Who decides why and how it is processed | We do | Our customer (the business that subscribes) does |
| Examples | Your name, email, login and security records, billing details | A customer's invoices, employee payroll records, supplier details |
| Who to contact about it | Us | The business that holds your information in NUMBAAS. We will help them respond |
When we act as an operator, we process that information only on the subscribing business's instructions, keep it confidential, and protect it with the security measures in section 9, as POPIA sections 20 and 21 require. Those obligations are set out in writing in our Terms of Service (Operator terms). If you are, for example, an employee of a business that runs its payroll in NUMBAAS and want to see or correct your information, please contact your employer. If you contact us instead, we will pass your request to them.
3. What personal information we process
As the responsible party:
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, role, the business you belong to | You, or the person who invited you |
| Security information | Hashed password (we never store it readable), two-factor settings (encrypted), sign-in times, device and IP address | You and your use of NUMBAAS |
| Billing details | Billing contact, plan, invoices, payment status, the last four digits and expiry of your card | You and our payment provider. We never see or store your full card number |
| Usage and audit records | What was changed, by whom and when (the audit trail), error and performance logs | Your use of NUMBAAS |
| Communications | Support requests, feedback, emails with us | You |
| AI use | Questions you ask the AI assistant and its answers, and how much of your allowance you used | You |
As an operator, for the businesses that subscribe (see section 2): whatever the business records, which typically includes customer and supplier contact details, invoices and payments, bank transactions, and employee records. Employee records include identity numbers, tax reference numbers, bank account details, salaries and deductions.
Some of this is special personal information under POPIA: for example, health-related leave records, trade-union membership deductions, and, where a business uses HR features for employment-equity reporting, race and disability information. Access to these is restricted to the roles the business authorises, and every view is recorded in the audit trail. We do not use any of this information for our own purposes.
4. Why we process it, and the lawful basis
We only process personal information for a specific purpose, and only as much as that purpose needs (POPIA sections 10 and 13).
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Providing NUMBAAS: creating accounts, signing you in, running the features you use | Performing our contract with you or your business |
| Keeping accounts secure: two-factor sign-in, detecting misuse, the audit trail | Our legitimate interest, and yours, in a secure service |
| Billing: subscriptions, payroll charges, invoices and tax records | Performing the contract, and our legal obligations (tax law requires us to keep invoices) |
| Support and service messages: replies, security alerts, billing notices, closure reminders | Performing the contract |
| Improving NUMBAAS: error logs and usage figures, without looking at customers' business records | Our legitimate interest |
| Complying with the law: requests from SARS, the Information Regulator or a court | Legal obligation |
| Marketing: news about NUMBAAS | Your consent, or as an existing customer, with an easy opt-out (section 12) |
We do not sell personal information, and we do not use customers' business records to advertise or to train AI models.
5. The AI assistant (Baas)
NUMBAAS includes an AI assistant called Baas. Nothing is sent to an AI provider unless a person asks Baas a question or uses an AI feature.
What is sent, and when: when you ask Baas something, NUMBAAS sends your question, the recent conversation, and a summary of the business's books limited to what your role may see in NUMBAAS: for example account balances, overdue invoices (customer name, amount and due date), unreconciled bank lines, pay-group names and product stock levels, plus the name of the screen you are on. If a question needs more, Baas looks figures up on NUMBAAS screens with your own permissions (for example a business unit's profit, a VAT201 or a budget), and only those figures are sent. Pay figures are never sent for someone whose role doesn't include payroll. Employees' identity numbers, tax numbers and bank details are not included. Baas may search the web for current tax rates; the search contains the topic, not your records.
Documents you attach: if you attach a photo or PDF of an invoice, receipt or slip, it is sent so Baas can read it and prepare a supplier bill for you to confirm. Attach only the document you want captured.
Voice: if you speak to Baas, your browser's own speech service turns your speech into text (for example Google's in Chrome, or Microsoft's in Edge), under that provider's terms; NUMBAAS receives only the text. Answers read aloud use your device's own voices.
Who receives it: our AI provider, Anthropic, which processes it to produce the answer, as our operator (sub-processor). Its servers are outside South Africa (see section 8). [To confirm before publishing: the provider's current commercial terms on retention, and that API data is not used to train its models.]
Your control: the business's Owner decides who may use AI, and can switch it off for anyone at any time. Baas never posts, sends or pays anything by itself: everything it prepares is shown to a person, who confirms it, and it then goes through the business's normal approvals. AI answers can be wrong and are not professional advice.
6. Tamper-evident books and Bitcoin anchoring
NUMBAAS makes each business's books tamper-evident. Only cryptographic fingerprints ever leave NUMBAAS for this, never personal information or amounts.
- Each posted journal gets a fingerprint (a SHA-256 hash), chained to the one before it, and each month is sealed into one fingerprint.
- That month's fingerprint is sent to public OpenTimestamps servers and recorded, through them, on the public Bitcoin blockchain, so anyone can later confirm the books existed in exactly that form on that date.
- A fingerprint is a 64-character code from which nothing about the books can be worked out. Each journal's fingerprint also includes a secret random value, so even a guess at a journal's contents can't be checked against it.
- The confidential balance proof uses cryptographic commitments, which likewise reveal no amount.
A record on the Bitcoin blockchain can't be deleted by anyone. Because it contains only these fingerprints, it holds no personal information, and deleting a business's data from NUMBAAS (section 10) leaves nothing on the blockchain that relates to any person.
7. Who we share it with
We share personal information only with the service providers who help us run NUMBAAS, each bound by a written agreement to keep it confidential and secure and to use it only for the service they provide us.
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Hosting provider [to confirm: Microsoft Azure, South Africa North] | Runs our servers, database and backups | All data in NUMBAAS, encrypted | South Africa |
| Paystack | Takes subscription and payroll-charge payments | Billing contact, business name, payment details (entered directly with Paystack) | South Africa and Nigeria [to confirm] |
| Email provider [to confirm: Postmark] | Delivers invitations, password resets, reminders and statements | Recipient name and email address, and the email's content | United States [to confirm] |
| Anthropic | Answers AI questions (section 5) | The question and the summary described in section 5 | United States |
| OpenTimestamps servers | Anchor seals on Bitcoin (section 6) | Fingerprints only: no personal information | Various |
We may also disclose personal information when the law requires it (for example to SARS, the Information Regulator, or under a court order), to our professional advisers under a duty of confidentiality, or to a buyer of our business, who would be bound by this policy. When a customer connects a bank feed or another service to NUMBAAS, information moves between them on that customer's instruction.
8. Transfers outside South Africa
The NUMBAAS database and its backups are kept in South Africa. Some personal information leaves South Africa only in the cases in section 7: AI questions, the delivery of emails, and possibly payment processing.
POPIA section 72 allows this only where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where it is necessary to perform the contract with you. We transfer personal information abroad only to providers bound by written agreements that require that level of protection, and only what each needs. [To confirm before publishing: each provider's data-processing agreement is signed and on file.]
9. How we protect it
POPIA section 19 requires reasonable technical and organisational measures. Ours include:
- Separation between businesses enforced by the database itself (row-level security), so one business can never read another's records, even through a programming error.
- Encryption in transit (HTTPS) for every connection, and two-factor secrets encrypted at rest. Passwords are stored only as one-way hashes.
- Two-factor sign-in, which a business can require for everyone.
- Role-based access with segregation of duties: people see and do only what their role allows, with confidential pay groups and approvals for payments, payroll and journals.
- A complete audit trail of who changed what and when, and tamper-evident books (section 6).
- Daily backups, with restores rehearsed and checked automatically.
- An independent security review before launch, and code that is tested automatically on every change.
If a security compromise affects your personal information, we will notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires. Where we act as an operator, we will notify the business concerned immediately, so it can meet its own obligations.
10. How long we keep it
We keep personal information only as long as its purpose or the law requires (POPIA section 14).
| Information | How long |
|---|---|
| A business's records in NUMBAAS | While its subscription is active |
| After a business asks to close its account | 30 days, during which the Owner can change their mind; staff lose access at once. Then everything is permanently deleted |
| Backups | Deleted records disappear from backups as backups age out, within [to confirm: 35] days. Backups are never used to restore a closed business |
| A record that the business existed and was closed | Kept: its name, registration number and closure dates, so we can show the deletion was done |
| Our own invoices and payment records | 5 years, as tax law requires |
| Security and audit logs about our users | [to confirm: 12 months] |
| Website enquiries (the free-trial and walkthrough forms) | Until we've followed up, then [to confirm: 12 months] after our last contact, unless you become a customer |
Each business is responsible for its own legal record-keeping (tax law, for example, generally requires records to be kept for five years). Before closing an account, export your records: NUMBAAS lets you download them at any time, including during the 30 days.
11. Your rights
Under POPIA you may:
- Ask whether we hold personal information about you, and for a copy of it (section 23). Formal requests follow our PAIA manual.
- Ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading or unlawfully held (section 24).
- Object to processing based on legitimate interests (section 11(3)), and to direct marketing at any time (section 69).
- Complain to the Information Regulator, through inforegulator.org.za.
Email privacy@numbaas.co.za to use these rights. We will confirm who you are before acting, and respond within 30 days. Where we hold your information as an operator (section 2), we will refer your request to the business concerned and help it respond. You can also update most of your own account details yourself, in NUMBAAS under Security.
12. Marketing, browser storage and children
Direct marketing. We send marketing emails only to people who have agreed to receive them, or to existing customers about similar services, and every one has an unsubscribe link (POPIA section 69). Service messages, such as security alerts, billing notices and closure reminders, are not marketing and continue while you have an account.
Browser storage and cookies. NUMBAAS stores only what it needs in your browser to keep you signed in and remember your settings. If you arrive through a partner's referral link, our website and sign-up page also remember that partner's code in your browser for 90 days, so the partner is credited if you sign up. We use no advertising or tracking cookies and no third-party analytics. The NUMBAAS app and website load their fonts and code from NUMBAAS's own servers, so no outside content network receives your IP address when you use them.
Children. NUMBAAS is a business service for people aged 18 or over. We don't knowingly collect children's personal information as a responsible party. Businesses may record information about minors they employ, as operators on their behalf (section 2).
13. Changes and contact
We will update this policy when our processing changes. For a material change, we will notify account holders by email and in NUMBAAS at least 30 days before it takes effect. The date at the top shows the latest version.
Questions or requests: privacy@numbaas.co.za, or write to the Information Officer, Numbaas (Pty) Ltd, 5 Plange Avenue, Malanshof, Randburg, 2194.
Also see: Terms · PAIA manual