Privacy Policy

1. Introduction

Bhasa Financial Solutions (Pty) Ltd, Registration Number 2025/904172/07 (operator of "Stmtly"), is committed to protecting your privacy and personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable South African data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Stmtly (the "Service").

2. Information We Collect

We collect the following types of information necessary for the provision and improvement of our Service:

• Personal Information: We collect your name, email address, and phone number when you register for an account. This information is used for account personalization, secure login, essential service communications, password recovery, and optional two-factor authentication.
• Bank Statements: We collect PDF files of your bank statements that you upload for conversion. These files contain financial transaction data and personal identifiers. Crucially, these files are processed using artificial intelligence and are deleted from our servers immediately after conversion. We do not store your raw bank statement data permanently.
• Usage Data: We collect information about how you access and use our Service, such as IP addresses, browser types, pages visited, and conversion events. This data is primarily used in an aggregated and anonymized form to monitor the performance of our Service, identify technical issues, and improve user experience.
• Payment Information: All payment transactions are processed securely through our third-party payment processor, Paystack. We do not directly store your credit card details or other sensitive payment information on our servers. Paystack processes this information in compliance with industry security standards.

3. How We Use Your Information

We use your information for the following specific purposes:

• To Provide and Maintain Our Service: This includes managing your account, processing your bank statement conversions, and delivering the converted CSV and OFX files.
• To Manage Your Account and Subscriptions: This involves handling billing, renewals, and providing access to your subscription features.
• To Send You Service Updates and Support Messages: We use your contact information to communicate important service announcements, security alerts, and respond to your support inquiries.
• To Improve Our Service and Develop New Features: We analyze anonymized usage data to understand user behavior, troubleshoot problems, and enhance the functionality and accuracy of our conversion algorithms.

4. Data Security

We implement robust technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to, data encryption (at rest and in transit), access controls, and regular security audits. We adhere to industry best practices to safeguard your data. As stated, your uploaded bank statements are deleted immediately after conversion, ensuring data minimization.

5. Data Sharing

We do not sell, rent, or trade your personal information to third parties. We may share your data only in the following circumstances:

• Service Providers: We engage trusted third-party service providers to perform functions on our behalf, such as AI processing services for bank statement conversion and payment processing (Paystack). These providers are contractually bound to protect your information and process it only in accordance with our instructions and applicable data protection laws, including POPIA. We have data processing agreements in place with all such operators.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).
• To Protect Our Rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.

6. Your Rights (Data Subject Rights)

As a data subject under POPIA, you have the following rights regarding your personal information. To exercise any of these rights, please contact our Information Officer as detailed in Section 10.

• Right to Access: You have the right to request a copy of the personal information we hold about you.
• Right to Correction: You have the right to request that we correct any inaccurate or incomplete personal information.
• Right to Deletion (Erasure): You have the right to request the deletion of your personal information, subject to certain legal obligations.
• Right to Object: You have the right to object to the processing of your personal information under certain circumstances.
• Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

7. Data Retention

We retain your personal information for as long as your account remains active or as necessary to provide you with the Service. Upon account deletion, your personal information will be securely removed, unless a longer retention period is required or permitted by law.

Bank statement files are deleted immediately after conversion.

Conversion history metadata (e.g., date of conversion, file type, number of pages, but excluding any personal identifiers or actual financial data) is retained for a period of 12 months. This metadata is used for internal analytical purposes to improve our Service and for audit trails, and is anonymized where possible.

8. Cookies

We use essential cookies to maintain your user session, authenticate your login, and provide the core functionality of our Service. These cookies are strictly necessary for the operation of our website and do not collect personal information for tracking or advertising purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We may also notify you via email or a prominent notice on our website prior to the change becoming effective.

10. Contact Us & Information Officer

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data subject rights, please contact our Information Officer: