Privacy Policy

1. Who we are

TaxKit is operated by K2026428132 (South Africa), a private company registered in South Africa (registration number 2026/428132/07), of 24 Willow Road, Northcliff, Johannesburg, Gauteng, 2194 ("TaxKit", "we", "us"). We are the responsible party for your personal information under POPIA. Contact: hello@taxkit.co.za.

2. What we collect

We collect only what we need to run the service:

• Your WhatsApp number — this is your account identity.
• Your name as shown on WhatsApp, and an email address if you add one (e.g. to send a report to your accountant).
• The content you capture — receipt photos, the data we read from them (vendor, amount, date, category), mileage entries, and any tax questions you ask.
• Bank statements you upload on the dashboard, and the transactions parsed from them.
• Subscription & payment status — whether you're on the free or paid plan and when it renews. Card details are handled entirely by our payment provider (PayFast); we never see or store them.
• Technical data needed to operate — session cookies for sign-in, message IDs for reliability, and basic logs. Our public website also uses Google Analytics cookies to measure visits (see section 6).

3. How we use it

To:

• capture, categorise and store your expense and mileage records;
• answer your tax questions and produce your year-to-date totals;
• generate the PDF/CSV exports you send to your accountant;
• manage your account, subscription and sign-in;
• keep the service secure, reliable and working.

We do not sell your personal information to anyone.

4. Lawful basis

We process your information to perform our contract with you (providing the service you asked for), to meet legal obligations, and for our legitimate interests in running and securing TaxKit — always balanced against your privacy. Where we rely on consent (for example, you choosing to send a report to your accountant), you can withdraw it at any time.

5. AI processing

To read your receipts and answer questions, the relevant content (a receipt image, your message, or your question) is sent to our AI provider, Anthropic, which returns the extracted data or answer. This is automated processing used to save you time; it can occasionally be wrong, which is why you can review and correct every entry on the dashboard. We don't use your data to train third-party AI models.

6. Who we share with

We share personal information only with the service providers ("operators") that make TaxKit work, under agreements that require them to protect it and use it only on our instructions:

• Meta Platforms — the WhatsApp Business Platform, to send and receive your messages.
• Anthropic — AI processing of receipts, messages and questions (see section 5).
• Cloudflare — hosting, our database, and storage of your receipt images.
• PayFast — payment processing (a South African provider; they handle your card data under PCI-DSS).
• Loops — sending the transactional email when you choose to send a report to your accountant.
• Google Analytics — anonymous, aggregated usage analytics on our website (which pages are visited, where visitors come from) so we can improve it. This runs on the marketing site only, not inside your dashboard.

We may also disclose information where required by law (e.g. a valid SARS or court request).

7. Cross-border transfers

Some of our providers (Meta, Anthropic, Cloudflare, Loops, Google) process data outside South Africa. Where this happens, we rely on the conditions POPIA allows for cross-border transfers — including that the recipient is bound by laws or agreements providing an adequate level of protection, or that the transfer is necessary to perform our contract with you.

8. Security

We take reasonable technical and organisational measures to protect your information: encrypted connections, access controls, sign-in by one-time magic link (no passwords to leak), and limiting access to what's necessary. WhatsApp messages are end-to-end encrypted in transit by WhatsApp. No system is perfectly secure, but we work to keep your data safe and will notify you and the Information Regulator if a breach affects your information, as POPIA requires.

9. How long we keep it

We keep your records while your account is active, and for as long as needed to provide the service. Because tax records support SARS filings, retaining them is useful for the periods SARS expects taxpayers to keep supporting documents (generally five years). You can ask us to delete your data at any time (see section 10); we'll do so unless we're legally required to keep it.

10. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• correct or update information that's wrong or incomplete;
• ask us to delete your information;
• object to certain processing;
• withdraw consent where we relied on it;
• complain to the Information Regulator (see section 13).

To exercise any of these, email hello@taxkit.co.za from the number/email on your account. Much of your data is also directly viewable and editable on the dashboard.

11. Children

TaxKit is for adults running their own income or business. It is not intended for anyone under 18, and we don't knowingly collect information from children.

12. Changes

We may update this policy from time to time. We'll change the "last updated" date above and, for material changes, let you know on WhatsApp or the dashboard.

13. Contact & complaints

Privacy questions or requests: hello@taxkit.co.za.

If you're not satisfied, you can lodge a complaint with the regulator:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

Responsible party: K2026428132 (South Africa) · Registration number 2026/428132/07 · 24 Willow Road, Northcliff, Johannesburg, Gauteng, 2194, South Africa.