Privacy Policy — FarmAcc

01

Who We Are

FarmAcc is a South African agricultural accounting software service operated by FarmAcc (Pty) Ltd ("FarmAcc", "we", "us", "our"). Our service is accessible at farmacc.co.za (marketing) and app.farmacc.co.za (application).

FarmAcc is the Responsible Party as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA"). We are responsible for deciding how and why your personal information is processed.

Information Officer

For all data protection queries, requests or complaints, contact our Information Officer:

📧 privacy@farmacc.co.za

Alternatively, contact us at support@farmacc.co.za and mark your subject line POPIA Request.

02

What Personal Information We Collect

Account & Profile Information

Full name and email address (required to create an account)
Farm name, VAT registration number and enterprise types (crops, livestock, etc.)
Farm location (province / region — optional)
Payment billing details (processed by our payment provider; we do not store full card numbers)

Financial & Farm Data

Receipt and slip images you photograph or upload
Extracted expense data from those images (vendor, amount, date, category, VAT)
Invoices you create within FarmAcc
Bank transaction data imported from CSV statements
Travel logbook entries (dates, odometer readings, destinations, business purpose)
Job card assignments and task records
Budget entries and seasonal P&L data
Worker names and task records (if you use the Worker app feature)

Technical & Usage Data

Device type, browser version and operating system (captured by our error monitoring tool)
IP address and approximate location (captured by Cloudflare for security and performance)
Error logs and crash reports (used to diagnose technical problems)
Page interaction data (used to improve the app)

We do not collect: SARS login credentials, internet banking passwords, identity document numbers, or biometric data (unless you opt in to biometric login on your device — this is handled entirely by your device's operating system and never transmitted to FarmAcc).

03

Why We Collect Your Information (Lawful Basis)

Purpose	Lawful Basis (POPIA)
Create and manage your account; provide the FarmAcc service	Performance of a contract
Process slip images through AI to extract expense data	Performance of a contract; legitimate interest
Generate VAT 201 returns, P&L reports and other tax summaries	Performance of a contract; compliance with legal obligation
Send transactional emails (account creation, password reset, receipts)	Performance of a contract
Send subscription billing notifications	Performance of a contract
Monitor application errors and performance	Legitimate interest (maintaining a reliable service)
Prevent fraud and ensure platform security	Legitimate interest; compliance with legal obligation
Send product updates or new feature announcements (with opt-out)	Legitimate interest; consent

We will never use your data for purposes incompatible with those listed above without obtaining your prior consent.

04

AI Slip Scanning — How It Works

When you photograph a receipt or slip and tap "Scan", the image is sent securely via an encrypted Cloudflare Worker to Anthropic's Claude API for analysis. The AI extracts structured data (vendor name, amount, date, VAT, category) and returns it to FarmAcc.

Important points about AI processing:

Images are sent to Anthropic's servers for processing. Anthropic is subject to our data processing agreement and does not use your data to train AI models.
FarmAcc does not store a copy of the raw image at the API level — the image is transmitted for processing and the extracted data is saved to your account.
If you choose to save the scanned slip, the extracted data (not the original image) is stored in your account on Supabase's cloud database.
You can delete any slip or its data at any time from within the app.

05

Third-Party Service Providers (Sub-Processors)

We share limited personal data with the following trusted sub-processors who help us deliver FarmAcc. Each is contractually obligated to protect your data:

Provider	Location	Purpose	Data Shared
Supabase	USA / EU	Cloud database, authentication and file storage	Account data, financial records, slip data
Anthropic	USA	AI processing of receipt images (Claude API)	Receipt images (transient — not stored by Anthropic)
Cloudflare	Global CDN	Website hosting, API proxy, DDoS protection, security	IP address, request metadata
Resend	USA	Transactional email delivery	Email address, email content
Sentry	USA	Error monitoring and crash reporting	Device/browser info, anonymised error context

Cross-border data transfers: Some of our sub-processors are located outside South Africa. As required by POPIA, we take steps to ensure that these parties provide an adequate level of data protection, including through data processing agreements and standard contractual clauses where applicable.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

06

How Long We Retain Your Data

Data Category	Retention Period
Account and profile information	For the lifetime of your account, plus 30 days after deletion request
Financial records (slips, invoices, bank transactions)	For the lifetime of your account. After closure, up to 5 years to comply with SARS record-keeping requirements.
Travel logbook entries	5 years (SARS requirement for travel deduction claims)
Error logs (Sentry)	90 days
Email delivery records	30 days
Billing records	7 years (South African tax and accounting legislation)

After the applicable retention period, data is securely deleted or anonymised.

07

Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

Right of access: Request a copy of the personal information we hold about you.
Right to correction: Request that inaccurate or incomplete information be corrected.
Right to deletion: Request that your personal information be deleted, subject to lawful retention obligations.
Right to object: Object to the processing of your personal information where we rely on legitimate interest as our lawful basis.
Right to restrict processing: Request that we limit the way we use your data in certain circumstances.
Right to data portability: Request your financial data in a machine-readable format (CSV export is available directly within the app).
Right to complain: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.

To exercise any of these rights, email us at privacy@farmacc.co.za. We will respond within 30 days. Some rights may be subject to statutory exceptions (for example, we may be required to retain financial records for tax purposes even after an account is closed).

Information Regulator of South Africa
Website: inforegulator.org.za
Email: inforeg@justice.gov.za

08

Security Measures

We implement industry-standard technical and organisational security measures to protect your personal information:

Encryption in transit: All data is transmitted using TLS 1.2 or higher (HTTPS).
Encryption at rest: Your data is encrypted at rest on Supabase's infrastructure.
Row-level security (RLS): Our database enforces strict policies so that each user can only access their own farm's data.
Authentication: Accounts are protected by secure password hashing and optional biometric login (device-level only).
API security: Our AI slip-scanning feature uses a server-side Cloudflare Worker proxy, meaning your Anthropic API key is never exposed to the browser.
HTTP security headers: Content Security Policy, HSTS, X-Frame-Options and other headers are enforced on all pages.
Monitoring: We use Sentry for real-time error monitoring and UptimeRobot for service availability.

No system can be 100% secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify affected users and the Information Regulator as required by POPIA.

09

Cookies & Local Storage

FarmAcc uses minimal cookies and browser storage:

Supabase authentication token: Stored in your browser's local storage to keep you logged in. This is strictly necessary for the app to function.
Cloudflare cookies: Used for security, bot protection and performance optimisation.
Analytics: We use Cloudflare Web Analytics, which does not set tracking cookies and does not share data with third parties.

We do not use advertising cookies or third-party tracking pixels.

10

Children's Privacy

FarmAcc is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@farmacc.co.za and we will delete it promptly.

11

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Send a notification email to registered users.
Display a notice within the FarmAcc application.

Continued use of FarmAcc after the effective date of a revised policy constitutes your acceptance of the changes.

12

Contact Us

🌾 FarmAcc Privacy & Data Enquiries

Email: privacy@farmacc.co.za

General support: support@farmacc.co.za

Website: farmacc.co.za

We aim to respond to all privacy requests within 5 business days and will always resolve them within the 30-day period required by POPIA.