Effective date: 14 October 2026. Applies to FIN Accounting OS by Sthwalo Holdings (Pty) Ltd.
Sthwalo Holdings (Pty) Ltd is the responsible party for personal information processed through FIN. Privacy requests may be sent to [email protected].
We process account details, contact details, authentication and session information, company records, accounting records, invoices, customers, suppliers, assets, VAT records, payroll information where enabled, support tickets, audit logs, payment status and subscription information. We also store the source documents you upload (such as bank statements, supplier invoices and payroll documents), and, where your employer enables time and attendance with location verification, clock-in and clock-out records including GPS coordinates, device and network identifiers.
Where product usage analytics are enabled for your organisation, we also record which screens you open and which controls you use. This is stored as screen and control identifiers only — we do not record the text on the page, anything you type, or the contents of your records. It is kept for 90 days and then deleted.
We record which setup steps and product milestones you have reached and when — a company created, a financial year opened, a first report produced — so we can show you what is still outstanding and help if you get stuck. We record the fact and the time, never the contents of what you produced. We also record how your account first reached us, whether you signed up on a phone, tablet or computer, and whether our onboarding email was opened. This is kept for as long as your account exists and is deleted with it. It never affects what you are allowed to do in FIN — that is set by your plan and your role. You can stop onboarding email at any time from the link in any such message; sign-in codes, password resets and billing email continue.
We process personal information to create and secure accounts, provide accounting and reporting services, manage subscriptions and payments, support users, comply with tax/accounting obligations, prevent abuse, maintain audit trails and improve the service.
Processing is based on contract performance, user consent where required, compliance with legal obligations, legitimate service and security interests, and the protection of lawful rights. We process only information reasonably required for the service purpose.
We share personal information with service providers ("operators") only where needed to operate FIN: Amazon Web Services for cloud hosting, database and backup storage in the AWS Africa (Cape Town) region, and for delivering the email we send (such as payslips, notifications and password resets) from the same region; Cloudflare, which carries traffic between your browser and FIN to protect it from attack and therefore sees request details such as your IP address, browser and the pages you request, on its global network; Cyber Circuit, which hosts our support mailbox ([email protected]); and Paystack for subscription and add-on payments. Operators may process personal information only on our instructions and must protect it appropriately. We do not currently use analytics or advertising services, we do not sell your personal information, and we do not use it to train machine-learning models. If we appoint a new operator, we will update this policy.
Subscription and add-on payments are processed by Paystack. When you pay, you are taken to the Paystack checkout page and enter your card details there. Your card number is never sent to FIN, and we do not see, store or process it. Paystack is certified to PCI DSS Level 1, the highest level of certification in the payments industry. From Paystack we receive only what we need to activate your plan and keep our records: your name and email address, the amount and currency, a transaction reference, the payment status and, where applicable, the card type and last four digits. Paystack processes this information as our operator, on our instructions and under a data processing agreement with us, and is independently audited at least once a year. South African card processing is carried out by South African banks, but the Paystack platform itself runs in Ireland, so some payment information is processed outside South Africa. Paystack also publishes its own privacy policy at paystack.com/za/privacy.
FIN is hosted in South Africa: our application, database, backups and your uploaded documents are located in the Amazon Web Services Africa (Cape Town) region, and your accounting, payroll and banking records stay there. The email we send you (including payslips) is sent from the same AWS Africa (Cape Town) region. Three things leave South Africa: email you send to our support address is held on our mail host's server in the European Union (Germany); payment information is processed by Paystack, whose platform is located in the European Union, as described above; and request details pass through Cloudflare's global network on their way to FIN.
We retain account, payment, accounting, audit and support information for as long as needed to provide the service, meet tax/accounting/legal obligations, resolve disputes and maintain security records. Users may request deletion, subject to records that must legally or operationally be retained.
Data subjects may request access, correction, deletion, objection to processing, restriction where applicable and details of third parties who received their personal information. Complaints may be lodged with the Information Regulator (South Africa).
You do not have to ask us what we hold about you. Signed in, Account Settings → Your Data lists every place your information is held and what deleting your account does to each one. It is read from our live database each time you open it, so it cannot fall out of date. Requesting a copy of the records themselves, or their deletion, is a separate request — contact us and we will action it.
Information Regulator: complaints portal
If a security compromise is reasonably suspected, we will investigate, take containment steps and notify affected data subjects and the Information Regulator where POPIA requires notification.
This page is intended to support POPIA, PAIA, consumer and payment transparency requirements for the app. It should be reviewed by a South African legal practitioner before being treated as final legal advice.