Back to TaxFin

Privacy Policy

1. Who We Are

TaxFin is operated by FinSmart Holdings (Pty) Ltd (Reg. 2026/469983/07), Republic of South Africa. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), FinSmart Holdings (Pty) Ltd acts as the operator processing data on your instructions to provide the Platform, as described in our Terms of Use.

2. What We Collect

Category	What it includes
Account details	Name, email address, account role (individual or tax practitioner)
Receipts	Vendor, amount, date, deduction category, and an optional photo you attach
Mileage logs	Date, purpose, distance, and whether a trip is business or private
Practitioner connections	Which practitioner you're connected to (if any), and the history of documents/requests exchanged with them
Technical data	Session identifiers (for keeping you signed in) and basic request logs kept by our hosting provider for security and reliability

3. How We Use It

• To provide the core functionality of TaxFin — storing your records, computing your readiness score, and syncing requests/receipts between you and your connected tax practitioner;
• To sign you in securely, using a one-time code sent to your email address;
• To operate and secure the Platform, including detecting abuse (for example, limiting repeated failed sign-in attempts).

We do not use your data for advertising, and we do not sell it to third parties.

4. Who We Share It With

• Your tax practitioner — only if and while you're connected to one. You control this connection and can end it at any time from your Home tab.
• Cloudflare — our hosting provider. All data (database and receipt photos) is stored on Cloudflare's infrastructure.
• Resend — used to deliver sign-in codes by email.
• RN Financial Planning — only if you choose to book a consultation through the "meet a wealth advisor" link, at which point you're leaving TaxFin for their independent website and any information you share with them is governed by their own privacy practices, not ours.

We do not otherwise share your personal information with third parties, except where required by law.

5. Receipt Photos

When you attach a photo to a receipt, it is automatically resized and recompressed in your browser before upload, so only a smaller, storage-efficient version is ever sent to or stored on our servers — the original file on your device is never uploaded as-is.

6. Data Retention

We retain your data for as long as your account is active. If you'd like your account and associated data deleted, contact us using the details below and we will action this within a reasonable time, save for information we're required to retain by law.

7. Security

We use hashed session tokens, one-time sign-in codes (with a lockout after repeated failed attempts), and HTTPS encryption in transit. No system is completely secure, and while we take reasonable measures to protect your data, we cannot guarantee absolute security.

8. Your Rights Under POPIA

You have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate information;
• Request deletion of your information, subject to any legal retention requirements;
• Object to processing of your information in certain circumstances;
• Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.

To exercise any of these rights, contact us using the details below.

9. Cookies

TaxFin uses only strictly necessary session cookies to keep you signed in — one for a client account and, separately, one for a practitioner account, so both can be active in the same browser without conflict. We do not use tracking or advertising cookies.

10. International Data Transfers

Cloudflare operates a global network. While we configure our infrastructure to store data in the region closest to South Africa where possible, data may in some cases be processed on servers outside South Africa as part of Cloudflare's standard operation. Cloudflare maintains its own safeguards for cross-border data handling.

11. Children's Privacy

TaxFin is not intended for use by anyone under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time, particularly during this private testing phase. We'll update the effective date above when we do.

13. Contact

FinSmart Holdings (Pty) Ltd
Reg. 2026/469983/07 • Republic of South Africa
Email: lautonnikhel@gmail.com
Website: taxfin.app