Privacy Policy (POPIA)

Last updated: November 2026 · Cape Town, South Africa

1. Who We Are

KassaFlow provides South African B2B invoicing and automated WhatsApp reminder software connecting accounting ledgers (Xero and Sage Business Cloud Accounting South Africa) with local payment gateways (Paystack and Ozow). For privacy enquiries or data subject requests, contact us at support@kassaflow.co.za.

2. Roles Under POPIA (Responsible Party & Operator)

• Merchant Account Data: When a business signs up for KassaFlow, KassaFlow acts as the Responsible Party for that merchant's account profile, billing, and configuration data.
• Debtor & Invoice Data: When a merchant connects Xero or Sage SA, KassaFlow acts as an Operator under Section 20–21 of POPIA. Debtor names, phone numbers, email addresses, and invoice metadata are processed solely on behalf of, and on the documented instructions of, the merchant (the Responsible Party).

3. Data Minimization & What We Process

We collect and process only the minimum information required to operate automated invoice reminders and payment reconciliation:

• Merchant Credentials: OAuth tokens and API credentials for Xero, Sage SA, Paystack, and Ozow.
• Invoice Metadata: Invoice numbers, due dates, amounts due, currency (ZAR), payment status, and generated payment short-links.
• Debtor Contact Details: Business contact name, mobile number (for WhatsApp Utility reminders), and email address (passed to Paystack so it can send the debtor a payment receipt).
• Messaging & Payment Logs: Delivery receipts, opt-out flags, and verified gateway webhook references for auditability and reconciliation.

4. Security & Encryption at Rest

We implement appropriate technical and organisational measures to protect personal information against loss, damage, or unauthorised access:

• Accounting ledger OAuth tokens and payment gateway API credentials are encrypted at rest using strong authenticated encryption.
• All traffic between browsers, accounting APIs, payment gateways, and WhatsApp Cloud API is encrypted in transit via TLS (HTTPS).
• Webhook endpoints verify cryptographic HMAC signatures before processing events, and tenant data is logically isolated per organisation.

5. Opt-Out Rights & WhatsApp STOP Handling

Recipients of WhatsApp reminders may opt out at any time by replying STOP (or UNSUBSCRIBE / OPT OUT) to any KassaFlow WhatsApp message. Opt-out requests are processed automatically and immediately suppress further automated WhatsApp reminders for that contact.

6. Data Retention & Deletion Requests

We keep a merchant's data, including the debtor records synced from their ledger, while their account is active. Merchants may disconnect their accounting ledger or request deletion of their organisation's data at any time by emailing support@kassaflow.co.za. Debtors wishing to access, correct, or delete their personal information may contact the invoicing merchant directly or email support@kassaflow.co.za so we can coordinate with the Responsible Party.

7. Third-Party Sub-Processors

To deliver our service, KassaFlow integrates with infrastructure and service providers selected by us or configured by the merchant, including Meta (WhatsApp Cloud API), Xero, Sage Business Cloud Accounting SA, Paystack, Ozow, and Cloudflare. Each provider processes data subject to its respective security and privacy commitments.

8. Transfers Outside South Africa

Some of these providers process data outside South Africa: Meta (WhatsApp Cloud API), Xero, Paystack and Cloudflare operate international infrastructure. We only use providers bound by data protection laws or agreements that give protection substantially similar to POPIA, as section 72 of POPIA requires.

9. Information Officer & Complaints

Our Information Officer handles requests and complaints about personal information. Contact them at support@kassaflow.co.za. If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa).