Privacy Policy (POPIA)

1. Roles under POPIA

Your practice is the responsible party for the personal information in the bank statements you upload. Grey Matter Consulting (Pty) Ltd is your operator: we process those documents only to perform the conversion you asked for, under your instructions, with confidentiality and security safeguards, and we will notify you without delay if we ever have reason to believe statement data was accessed unlawfully.

2. Statements are processed and deleted, not stored

Uploaded statement PDFs are converted in memory and never written to disk or database. The converted CSV is returned to your browser and is not kept either. Once your conversion finishes, the document is gone from our systems. Some documents are read by an AI model through Anthropic's API during the conversion: small image fragments where a statement prints its description text as pictures, every page of a scanned statement, and scanned or photographed supplier invoices. They are processed in memory and are not used to train models.

There is one exception, and it only applies to a statement that will not convert. That PDF is emailed to our support mailbox so we can see why, either automatically at that moment or, for a practice that has automatic sending switched off, when you press the button and confirm it. A statement that converts is never sent. We keep a file sent to us this way to fix the problem and to check that later changes do not break the fix; ask us at hello@presies.co.za and we will delete it within 30 days, from the mailbox and from our computers, and ask us if you want automatic sending switched off for your practice. Your History screen shows which files were sent and when. Everything above about ordinary conversions is unchanged: those still write nothing anywhere.

3. What we do keep

• Conversion history (metadata only): the file name you uploaded, the bank, row/page counts, credits used, who converted it and when, any warning shown and, for a document that was refused, the reason, with any figures from the document removed. No transactions, no balances, no account numbers.
• Duplicate protection: a one-way cryptographic fingerprint of each converted statement's identity, so a statement already converted anywhere in your practice triggers a warning. The fingerprint cannot be reversed into an account number or anything else.
• Your team's accounts: names, email addresses, roles and sign-in times.
• Billing records: payment references and amounts. Card details are handled entirely by Paystack; we never see them.

Note: the uploaded file's NAME is kept in your history for your own audit trail - if your file names contain client names, that is visible to your own team and to us as your operator.

4. Where processing happens

Presies runs on Vercel (processing) and Supabase (account and metadata storage), with email via Resend and documents read by Anthropic as described in section 2 - reputable providers with industry-standard security, which may process data outside South Africa. A statement sent to us because it would not convert arrives in our own support mailbox. We rely on section 72 of POPIA for these transfers: the recipients are bound by agreements upholding protection comparable to POPIA.

5. Security

All traffic is encrypted in transit. Database access is locked to server-side service credentials with row-level security enabled; browsers have no direct database access. Changes to accounts are logged.

6. Retention and your rights

Conversion metadata and account records are kept while your workspace is active, so your practice keeps its audit trail. When your workspace closes you may ask us to delete them. You may request access to, correction of, or deletion of personal information we hold by emailing hello@presies.co.za. If you are not satisfied, you may complain to the Information Regulator (South Africa) - inforeg.org.za.