Privacy Policy

Version 1.0.0 — Draft, pending review

Draft — pending review. This page is published for review and has not yet been signed off by a legal adviser. The binding version of this document is the one you accept inside the Practacular platform. If the two differ, the in-platform version governs.

This policy covers both the Practacular platform and this website, www.practacular.com, including the free tax calculators published on it.

1. Introduction

Yield SPM (Pty) Ltd (registration number 2024/185151/07), the company behind Practacular (“we”, “us”, “our”), is the responsible party as defined in section 1 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Practacular platform or this website.

2. Information Officer

In accordance with section 55 of POPIA, our designated Information Officer is:

Name: Lindie le RouxEmail: privacy@practacular.comAddress: South Africa

You may contact the Information Officer for any queries relating to your personal information, including requests for access, correction, or deletion.

3. What We Collect

We collect and process the following categories of personal information:

•Identity information — Name, email address, phone number, SA ID number, tax reference number
•Financial records — Trial balances, profit & loss statements, balance sheets, chart of accounts (via Xero integration)
•Tax documents — Tax returns, assessments, IRP5 certificates, medical tax certificates, retirement annuity certificates
•SARS correspondence — Notices of assessment, letters of findings, audit letters, verification requests
•Company documents — CIPC registration documents, annual returns
•Usage data — Login timestamps, feature usage, device information, IP addresses

4. Cookies and Analytics on This Website

This website uses Google Analytics 4 to understand which pages are useful. It is off by default. Nothing is loaded and no analytics cookie is set until you accept via the consent banner — declining is one click, and you can change your mind at any time through “Cookie preferences” in the footer. We run no advertising, remarketing, or social tracking pixels on this site.

If you accept, Google Analytics 4 collects:

•Pages viewed, page titles, and the site or search engine that referred you
•Approximate, city-level location derived from your IP address — Google Analytics 4 does not retain the full IP address
•Device and browser type, and screen size
•Product-funnel events: which free tool was opened, whether a calculation completed, and which call-to-action was clicked

The free calculators run entirely in your browser. The income, turnover, VAT, and penalty figures you type are computed locally and are never transmitted to us or to Google. Only the non-identifying outcome of a calculation (for example, that a penalty applied) is recorded as an analytics event.

We also store a first-touch marketing record in your browser’s local storage — the campaign tags in the link you arrived on and the website that referred you. It is used to tell which channel introduced you to Practacular, contains no personal information, and is not shared with Google. Clearing your browser storage removes it.

Cookies that are strictly necessary for security and sign-in are always active and do not require consent.

5. Purpose of Processing (POPIA s13–14)

We process your personal information for the following purposes, each with a lawful basis under POPIA:

•Service delivery — To provide practice management tools to your accounting firm (legitimate interest / contract)
•Document intelligence — To classify and extract data from uploaded documents (consent / contract)
•Tax advisory — To provide AI-assisted tax analysis and planning (consent / legitimate interest)
•SARS compliance — To track deadlines and manage correspondence (legal obligation / contract)
•Financial reporting — To generate Annual Financial Statements (contract / legitimate interest)
•Communication — To send notifications about deadlines, document status, and platform updates (consent / legitimate interest)
•Security — To maintain audit trails and prevent unauthorised access (legal obligation / legitimate interest)
•Website analytics — To measure how this website performs (consent, withdrawable at any time)

6. AI Processing Disclosure

The Platform uses artificial intelligence to process your data. Specifically:

•Anthropic Claude AI — Used for tax reasoning, SARS dispute analysis, compliance monitoring, client communications, and financial statement preparation. We use current-generation Claude models matched to each task's complexity, and upgrade to newer models as Anthropic releases them.
•Google Gemini AI — Used for document OCR, classification, and data extraction. We use current-generation Gemini models, and upgrade to newer models as Google releases them.

AI processing is performed to fulfil the service purposes described in section 5. AI-generated outputs are advisory only and require professional verification.

8. Cross-Border Transfers (POPIA s72)

Certain data is transferred outside South Africa:

•Anthropic Claude API — Data is sent to Anthropic’s servers in the United States for AI processing. Safeguards: Anthropic’s data processing agreement, encryption in transit (TLS 1.3), no model training on customer data.
•Google Analytics — If you accept analytics cookies, website usage data is processed by Google outside South Africa, including in the United States, under Google’s data processing terms.
•All primary data storage — Firebase (Firestore, Storage, Authentication) is hosted in Google Cloud’s africa-south1 region (Johannesburg, South Africa).

Cross-border transfers are conducted in compliance with section 72 of POPIA, with adequate safeguards in place.

9. Data Retention

•Deleted documents — Soft-deleted with 30-day retention, then permanently purged.
•Hash chain entries — Permanently retained (ECTA compliance requirement).
•Financial records — Retained for 5 years from the relevant year of assessment, as required by the Tax Administration Act.
•Audit trail — Permanently retained for POPIA compliance (append-only).
•Account data — Deleted within 30 days of account termination, upon request.
•Website analytics — Retained by Google Analytics for the retention period configured on the property, and removable at any time by declining analytics and clearing your browser storage.

10. Your Rights (POPIA s23–25)

Under POPIA, you have the right to:

•Access — Request confirmation of what personal information we hold about you.
•Correction — Request correction of inaccurate or incomplete information.
•Deletion — Request deletion of your personal information (subject to legal retention requirements).
•Objection — Object to the processing of your personal information on reasonable grounds.
•Complaint — Lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise any of these rights, contact our Information Officer at privacy@practacular.com.

11. Security Measures

We implement the following security measures to protect your data:

•AES-256-GCM encryption for stored credentials (Xero tokens, Graph tokens)
•TLS 1.3 encryption for all data in transit
•Firestore security rules with role-based access control
•Firebase App Check to prevent unauthorised API access
•SHA-256 hash chains for document integrity verification (ECTA)
•Append-only audit trail for all data operations (POPIA)

12. Children’s Information

In accordance with section 35 of POPIA, the Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact our Information Officer immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

•Update the version number and effective date.
•Require re-acceptance through our version-bumped consent mechanism — you will be prompted to review and accept the updated policy before continuing to use the Platform.

14. Information Regulator

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator:

The Information Regulator (South Africa)Email: complaints@inforegulator.org.zaWebsite: https://inforegulator.org.za