MyExpense (Pty) Ltd ("we", "us") is committed to protecting your personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, and the control you have over it.
01 What we collect
We only collect what we need to run the service:
- Account details such as your name, email address and mobile number.
- Financial data you enter including receipts, expense amounts, income, mileage and category selections.
- Tax profile information such as your taxpayer type and tax year, used to apply the correct SARS rules.
- Device and usage data such as app version and crash logs, collected on an anonymised basis and never linked back to your identity, used only to keep the app reliable.
02 How we use it
Your information is used solely to deliver MyExpense:
- To scan, categorise and store your expenses against the correct ITR12 codes: receipt images are processed by an AI-assisted OCR service to extract the vendor, amount and date automatically.
- To calculate your estimated tax savings and generate eFiling-ready reports.
- To send you service notifications you have opted into, such as filing reminders.
- To improve reliability and fix issues through anonymised diagnostics.
We never use your financial data for advertising, and we never sell it. Full stop.
03 Legal basis
Under section 11 of POPIA, we process each category of your personal information on a specific lawful basis:
05 Storage & security
Your data is encrypted in transit and at rest. Access is restricted to authorised personnel on a need-to-know basis, and we apply industry-standard safeguards against unauthorised access, loss or misuse.
Our infrastructure is hosted by Supabase in Ireland, European Union. Because this means your information leaves South Africa, we rely on the safeguards required by section 72 of POPIA: the EU's General Data Protection Regulation (GDPR) is recognised internationally as substantially comparable to POPIA, and our agreements with Supabase impose data-protection obligations on them equivalent to those we owe you directly.
In accordance with section 22 of POPIA, if we become aware of a security compromise that has affected or may affect your personal information, we will notify the Information Regulator and you as soon as reasonably possible.
06 Your POPIA rights
Under POPIA you have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of your information, subject to legal retention requirements.
- Object to processing or withdraw consent at any time.
- Lodge a complaint with the Information Regulator of South Africa (see below).
To exercise any of these, email privacy@myexpense.co.za. We will respond within 30 days.
07 Data retention
We keep your information for as long as your account is active, plus 5 years thereafter to comply with the record-keeping requirements of the Tax Administration Act, 2011. When no longer required, it is securely deleted or anonymised.
08 Information Regulator
If you are unhappy with how we have handled your personal information or a request you have made, you may lodge a complaint with the Information Regulator of South Africa: inforegulator.org.za · enquiries@inforegulator.org.za · +27 (0)12 406 4818.
09 Contact us
Questions about this policy or your data can be sent to our Information Officer (registration with the Information Regulator is in progress) at privacy@myexpense.co.za, or by post to MyExpense (Pty) Ltd, Reg. No. 2026/140774/07, 13 The Bend, Pinelands, 7405, Cape Town, South Africa.