Privacy and POPIA.

Who is responsible

CustomBeast (Pty) Ltd, Cape Town, South Africa, operates Vouchpack and is the responsible party for the personal information you give us directly (your email address). Contact: [email protected].

For the bank statements you upload, you or your firm are the responsible party under POPIA and we act as your operator: we process the statements only to build your pack, only on your instruction, and only in South Africa.

What we process and why

Statement PDFs and the text read from them: to verify the lines, reconcile the months and categorise the transactions into the pack you download. Legal basis: performance of the service you asked for.

Your email address, if given: to tell you the pack is ready. Nothing else. No marketing lists unless you opt in separately.

Server logs: request paths and timings for security and reliability, never statement contents.

Where and by whom

All processing happens on our own server in South Africa. We do not transfer statement data outside South Africa and we do not use sub-processors for it: no external AI, OCR, storage or analytics providers touch the statements.

Only the operator's technical staff can access the server, by key-based SSH, for maintenance.

Counting visits

We count visits with our own analytics, on our own server in South Africa. It sets no cookie and involves no third party.

Your internet address and browser details are turned into a code that changes every day, then thrown away. We see totals: the pages visited, where visits came from, the type of device and the country. We can't tell who you are.

Placing an order is counted too, without your name, email address or firm name. Visit records are deleted after 90 days; daily totals are kept.

We rely on our legitimate interest in knowing how the site is used (POPIA section 11(1)(f)). To object, let your browser send Do Not Track or Global Privacy Control, or open any page with ?ea=off. Nothing is counted then.

How long we keep it

Uploads, OCR text and packs: until you delete the job on its page, or 30 days after the job was created, whichever is first. Your email address is deleted with the job.

Your rights

You may ask what we hold, ask for correction or deletion, or object to processing, by emailing us. Because packs are opened only by their private link, we will ask you to prove you hold that link before acting on a request about a specific job.

You may lodge a complaint with the Information Regulator (South Africa): [email protected].

Security

Encryption in transit and at rest, private per-pack links, deletion on request and by sweep, no third parties. The detail is on the security notes page.

Changes

We will post changes to this notice here with the date. Last updated September 2026.