Last updated 24 August 2026

Privacy Policy

This policy explains what personal information Kassie handles, why, and what you can do about it. It is written with the Protection of Personal Information Act 4 of 2013 (POPIA) in mind. The responsible party is [REGISTERED BUSINESS NAME], [business address], South Africa.

What we collect

Account information: the name, email address and company details you give us when you sign up, plus billing records received from Lemon Squeezy. We never see or store your card number.
Slip images you submit: processed in memory and discarded immediately after extraction by default. They are retained only if you explicitly set store_image on a request, and then for 30 days.
Extracted slip data: retailer, store, timestamp, line items, totals, VAT and a hash computed over those normalised fields. Retained for 30 days to support retrieval and duplicate detection, then deleted.
Technical logs: API key identifier, timestamp, endpoint, response status and latency. Retained for 90 days for security and billing accuracy.

Personal information on slips

Till slips can incidentally carry personal information — a loyalty card number, a partial card PAN, a cashier name. Kassie does not extract these fields, and because images are discarded by default the exposure window is the duration of the request. If you enable image storage you become responsible for ensuring you have a lawful basis to hold those images, and for informing the people concerned.

Why we process it

To provide the Service you asked for (performance of a contract).
To bill you and meet tax and accounting obligations (legal obligation).
To detect abuse and keep the Service secure (legitimate interest).

Who we share it with

Only operators who need it to run the Service: our payment provider (Lemon Squeezy), our cloud hosting provider, our OCR provider, and our error-monitoring provider. Each is bound by contract to process data only on our instructions. We do not sell personal information and we do not share it for advertising.

Cross-border transfer

Some of these operators process data outside South Africa. Where that happens we rely on contractual safeguards that require a level of protection substantially similar to POPIA.

Your rights

You may ask us what personal information we hold about you, ask us to correct or delete it, object to processing, or lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za). Write to hello@kassie.dev and we will respond within 30 days.

Security

Traffic is encrypted in transit. API keys are stored hashed. Access to production data is limited to people who need it. No system is perfectly secure; if a breach affects your data we will notify you and the Regulator as POPIA requires.

Cookies

This website sets no advertising or tracking cookies. Any cookie present is strictly necessary to keep you signed in.

Changes

If we change this policy materially we will update the date above and notify account holders by email.

Before you publish: fill in the bracketed details, name your actual hosting, OCR and monitoring providers once chosen, and confirm your POPIA information officer registration.