Privacy notice

Roles: responsible party and operator

For your own account information (your name, email, business details and billing records) we act as the responsible party. For the business records you load — client details, employee payroll data, invoices, receipts and bank lines — you are the responsible party and we act as your operator, processing that information only on your instructions and to deliver the service. You are responsible for having a lawful basis to collect and upload that information and for informing your own data subjects.

What we collect

• Account details: email address, name, business name, registration and tax reference details, business address and business type.
• Financial records you add: invoices, quotes, expenses, receipts, clients, suppliers, projects, payroll data and bank statement lines.
• Conversations with rumii, including uploaded documents and voice recordings you choose to send.
• Technical and security logs: IP address, device and browser information, access times and audit-trail events.

Do not upload special personal information (health, biometric, criminal record) or payment card numbers, passwords or full ID numbers into chats or documents unless it is strictly necessary and lawful.

Why we process it

To provide the service you asked for: producing invoices and reports, categorising expenses, estimating tax, forecasting cash flow, reconciling bank data and answering your questions. We also process information to bill you, to secure the platform against fraud and abuse, and where the law requires it. We do not use your business financial records to train third-party AI models.

AI processing

rumii is powered by third-party large language models. Content you send in a chat, an uploaded receipt or a voice note is transmitted to the model provider to generate a response, which may involve processing outside South Africa. AI answers are automated general information — they can be wrong or incomplete, they are not certified accounting, audit, legal or tax advice, and they must be verified with a registered professional before you rely on them.

Sharing and cross-border transfers

We share information only with operators that run parts of the service on our behalf: cloud hosting and database storage, AI model providers, email and messaging providers, and — where you enable it — bank feed and payment providers. Operators are bound by contract to process information only on our instructions and to apply appropriate security safeguards. Some operators process information outside South Africa; where that happens we rely on section 72 of POPIA, using contractual safeguards that give comparable protection. We do not sell personal information. We may disclose information where compelled by law, court order or a valid regulatory request.

Storage and security

Data is stored in managed cloud infrastructure with encryption in transit and at rest. Access is restricted by row-level security so each business can reach only its own records, and team members you invite see only what their assigned role permits. No system is completely secure: we cannot guarantee absolute security, and you are responsible for the strength and confidentiality of your credentials and for the access you grant your team.

Security compromises

If we become aware of a security compromise affecting personal information we process, we will notify the Information Regulator and affected parties as required by section 22 of POPIA, without undue delay.

Retention

Financial records are kept for as long as your account is active and, after closure, for any period required by law — including the record-keeping rules in the Tax Administration Act, 2011 and the Companies Act, 2008 (generally five to seven years). You may ask for deletion of anything not subject to a legal retention obligation.

Your rights

Under POPIA you may request access to your personal information, request correction or deletion, object to processing, withdraw consent where processing relies on it, and lodge a complaint with the Information Regulator of South Africa (enquiries@inforegulator.org.za). Requests relating to your own account should be sent to us; requests about records held inside a customer's workspace should be directed to that business as responsible party. We action requests within a reasonable period and may need to verify your identity first.

Children

The service is intended for business use by persons 18 years or older. We do not knowingly process the personal information of children without the consent of a competent person.

Changes and contact

We may update this notice as the service changes; material changes will be highlighted in the app before they take effect. Information officer enquiries: LEAFFYHUB PROPRIETARY LIMITED, 17 Gladstone Road, Kingsburgh, KwaZulu-Natal, 4125.