The short version
- We collect what we need to run your books: your account details, the documents you upload and the figures read from them, and your billing status.
- We never see or store your card details. Paystack handles payments.
- We don't sell your information, and we don't use it for advertising.
- Aukly's own systems don't store IP addresses. Our hosting providers keep standard connection logs for security. The website uses no tracking or advertising cookies.
- You can delete your account yourself at any time. After 14 days, everything is erased automatically.
- You can ask to see, correct or delete your information at any time by emailing our Information Officer at privacy@aukly.co.za.
1. Who we are
Aukly is an online bookkeeping service operated by Rusbee Labs (Pty) Ltd, a private company registered in South Africa (registration number 2026/766953/07). In POPIA terms, Rusbee Labs (Pty) Ltd is the responsible party for the personal information described in this policy. "Aukly", "we", "us" and "our" mean Rusbee Labs (Pty) Ltd.
- Information Officer
- Boyd Dolamo (Director and Information Officer)
- Deputy Information Officer
- Andrew Kgapola
- privacy@aukly.co.za
- Telephone
- 076 104 8818
- Address
- Available on request by email
- Website
- https://aukly.co.za
This policy applies to the Aukly website (aukly.co.za), the Aukly app and anyone who contacts us, whether you are a customer, a visitor or someone whose details appear in a document a customer uploads.
Aukly is currently operated by Rusbee Labs (Pty) Ltd while a separate company is registered to run it. When it moves, that company will become the responsible party for your information and will continue to handle it under this policy. We will email you at least 30 days before the move with the new company's details.
2. Our role with your information
We handle personal information in two different capacities:
- As responsible party. For your account, billing, support and communications with us, we decide why and how your information is processed.
- As operator for our customers. The receipts, invoices and bank statements you upload often contain information about other people, such as the name of someone you paid or who paid you. We process that information only on your instructions and only to provide Aukly to you. For that information you are the responsible party, and our Terms of Service form the written agreement between us that POPIA (section 21) requires. You confirm that you are entitled to upload it.
3. What we collect
We collect information directly from you when you use Aukly, from the documents you upload, and from Paystack when you pay.
| Type | What it includes |
|---|---|
| Account details | Your name, email address and password. The password is stored only as a one-way fingerprint, so no one, including us, can read it back. We also record whether your email is verified, whether the account is active, when you last signed in, and whether you were last using Personal or Business mode. |
| Business profile | If you use Business mode: your business name and type of business. |
| Documents and financial data | The files you upload (PDF, JPG, PNG, TIFF, Excel or CSV) and their file names. We also store a fingerprint of each file so you aren't charged twice for the same file. From each file we store the information read from it: merchants, dates, amounts, balances, VAT, reference numbers and transaction descriptions. We keep the categories the AI suggests, your approvals and corrections (with any reason you give), the rules Aukly learns from your corrections, and the bookkeeping transactions that result. |
| Billing details | Your plan, billing period, pages used, and for each payment its reference, amount, currency, status and date. We also keep the customer and subscription references Paystack gives us. We never receive or store card numbers, CVV codes or bank login details. |
| Communications | Messages you send us through the contact form or by email (name, email address, subject and message). For the emails we send you, we keep the recipient, subject, time and delivery status. The content of each email is deleted once it has been sent. |
| Security records | Sign-in sessions, stored only as fingerprints of the session tokens. Security events, for example when a session was ended because a copied sign-in cookie was detected. A record of every time our staff open the back office or look up an account. |
| IP addresses and connection data | Aukly's own software uses your internet (IP) address only for a moment, in memory, to limit repeated sign-in attempts and other abuse. It doesn't write IP addresses to its logs or database. Like almost every website, the companies that host Aukly keep standard connection logs: your IP address, the date and time, the page or address requested and your browser type. Our website host (Domains.co.za) keeps these for the aukly.co.za pages, and our server host (Render) can keep them for requests to the Aukly service. They are used for security and fixing faults. We don't use them to profile you, and we don't copy them into Aukly's own systems. |
We don't ask for special personal information (such as health, religion or biometric data), nor for information about children. Bank statements can reveal sensitive details, for example a medical aid payment or a donation. We treat everything in your documents as confidential and use it only to provide Aukly to you.
4. Why we use it
POPIA (section 11) allows processing only for a lawful reason. These are ours:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, reading your documents and keeping your books | Needed to perform our agreement with you |
| Taking payments, renewing plans and tracking your page allowance | Needed to perform our agreement with you |
| Sending account emails (verification, password reset, billing notices) | Needed to perform our agreement with you |
| Answering support requests and messages | Our agreement with you, or our legitimate interest in replying to you |
| Keeping the service secure, preventing fraud and abuse, and monitoring for faults | Our legitimate interest, and yours, in a secure service |
| Keeping financial and tax records of payments | A legal obligation (tax and company law) |
| Improving Aukly's suggestions for your account using your own corrections | Needed to perform our agreement with you |
We don't sell personal information, rent it out or use it for advertising. We don't use one customer's data to improve another customer's results.
5. How the AI is used
Aukly uses Microsoft Azure Document Intelligence to read the text and figures in your documents. Microsoft keeps the document and what it read for 24 hours after reading it, then deletes both automatically.
Aukly then uses a large language model, provided by Groq, to suggest a category and transaction type for each line. To do that we send the transaction lines (description, amount, date and merchant), the type of business you selected, and short examples of your own past corrections. Aukly doesn't add your name, email address or account details to these requests, but a transaction description can itself contain a name, for example the person you paid. Groq doesn't keep these requests as a rule, but may keep them for up to 30 days when it needs to investigate abuse or a fault, and then deletes them. Groq processes them under its data-processing terms with us, only to provide the service.
The AI only makes suggestions. Nothing is booked until you approve or correct it, and the AI does not make decisions about you that have legal or similar effects. You can always review and change any category.
7. Processing outside South Africa
Some of our providers process information outside South Africa, in the countries shown in the table above. POPIA (section 72) allows this in limited cases. We rely on two of them:
- Binding agreements (section 72(1)(a)). Each provider is bound by written data-processing terms with us that limit what it may do with the information and require it to keep the information confidential and secure, which together give protection substantially similar to POPIA's. Several of those countries also have their own data protection laws.
- Performing our agreement with you (section 72(1)(c)). Aukly can't store, read or categorise your documents, or send you emails, without these providers, so the transfers are necessary to provide the service you signed up for.
We don't send your information to any other country, or to any other company, for its own purposes.
8. How long we keep it
We keep personal information only for as long as we need it for the purposes above, or as long as the law requires (POPIA section 14).
| Information | How long |
|---|---|
| Account, profile, documents and books | While your account is open. When you delete your account, everything, including your uploaded files, is erased automatically once 14 days have passed (normally within a few hours after that). Until then you can email us to restore it. |
| Payment records | As long as tax and company law requires, currently up to seven years after the payment. When your account is erased, these records keep only the amount, date, plan and payment reference, without your name or email address. |
| Sign-in, verification and password-reset tokens | Deleted automatically about a day after they expire (sessions last at most 7 days, reset links 1 hour, verification links 24 hours). |
| Content of emails we send | Deleted once the email is sent, or about a day later if it can't be delivered. A record of who it went to, its subject and when is deleted automatically after 12 months, or when your account is erased if that is sooner. |
| Contact form messages | Your message is delivered to our support mailbox. We keep the conversation for as long as we need it to help you, and delete it within 12 months after it ends. Aukly's own record that it was sent (your email address and subject) is deleted automatically after 12 months. |
| Back-office audit records | Deleted automatically after 24 months. |
| Connection logs kept by our hosting providers | Kept by those providers only for as long as they need them for security and fixing faults, under their own retention settings. |
| Backups | Deleted information can remain in backups until those backups are replaced in the normal cycle. |
Your own records: SARS generally requires you to keep your financial records for five years. Aukly is a tool, not your record-keeper, so please export your books (CSV or Excel) before closing your account.
9. How we protect it
We take the security safeguards required by POPIA (section 19) seriously. Every connection between your browser and Aukly is encrypted with HTTPS (TLS). Each customer's data is kept apart from every other customer's by two independent checks. Passwords are stored only as one-way fingerprints. Opening Aukly's back office requires two-step verification, and every use of it is logged. Card payments are handled by Paystack, which is PCI-DSS Level 1 certified. No system is completely secure, but we review and improve these measures as Aukly changes. Our Data & Security page describes these measures in detail.
10. Your rights
Under POPIA you have the right to:
- Be told that your information is being collected and why (this policy).
- Access it: ask whether we hold information about you and request a copy (section 23).
- Correct or delete it if it is wrong, out of date, incomplete or held unlawfully (section 24).
- Object to processing based on our legitimate interests (section 11(3)).
- Refuse direct marketing at any time (section 69).
- Not be subject to automated decisions with legal or similar effects that are made without human involvement (section 71).
- Complain to the Information Regulator (section 74).
How to make a request
Email our Information Officer at privacy@aukly.co.za from the email address on your account. You may use the forms prescribed in the POPIA Regulations (Form 1 for objections, Form 2 for correction or deletion), but you don't have to.
- We will confirm your identity before acting, so we never hand your information to someone else.
- We will respond within 30 days and tell you if we need longer and why.
- Correction, deletion and objection requests are free. For a copy of your records, the fees set under the Promotion of Access to Information Act (PAIA) may apply; they are listed in our PAIA Manual. We will tell you before charging anything.
- You can export your books yourself at any time from the Aukly workspace (CSV or Excel).
- You can delete your account yourself under Account & privacy in the account menu. Deleting it cancels any plan and signs you out everywhere straight away, and everything is erased automatically after 14 days (see section 8).
Some information we must keep even after a deletion request, for example payment records required by tax law. If that applies, we will tell you what we kept and why.
12. Emails and marketing
We send emails you need to use Aukly: account verification, password resets and billing notices. We will only send marketing emails if you have agreed to receive them (POPIA section 69). Every marketing email will include a way to unsubscribe, and unsubscribing is free.
13. Children
Aukly is meant for adults and businesses. You must be 18 or older to create an account, and we don't knowingly collect information about children as customers.
14. If something goes wrong
If we have reason to believe your personal information has been accessed or acquired by someone without authority, we will notify the Information Regulator and you as soon as reasonably possible (POPIA section 22). The notice will say what happened, what information was involved, what we are doing about it and what you can do to protect yourself.
15. Changes to this policy
We will update this policy when Aukly or the law changes. The date at the top shows when it last changed. If a change materially affects how we use your information, we will email you before it takes effect.
16. Contact and complaints
For any privacy question or request, contact our Information Officer, Boyd Dolamo, at privacy@aukly.co.za.
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):
- Complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- enquiries@inforegulator.org.za
- Telephone
- 010 023 5200
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Website
- https://inforegulator.org.za