Privacy Notice
Version 2026-10-13
This notice explains what personal information Accura AI (Pty) Ltd ("Akurra", "we", "us") handles when you use Akurra AI, why, who else handles it, how long we keep it, and your rights. It is the notice section 18 of the Protection of Personal Information Act, 2013 (POPIA) requires. It forms part of our Terms of Service.
1. The short version
- Your figures are worked out on your device. Every sum in your result is calculated in your browser. We keep no copy of your statements, agreements, account numbers, rates or the figures worked out from them.
- Your documents are sent to be read, with your consent at the start of each run. Deep Analysis is how the Service reads the documents you add: they are sent to our contracted AI provider, in the United States, to read the figures out. Nothing is sent before you tick the box, and without it a run cannot start. Section 4 explains exactly what is sent, where, and for how long it may exist.
- What we keep is about your account, not your facility: who you are, your sign-in, your credits and payments, and a record that a report was produced — never its contents.
- No advertising, no tracking, no selling. We do not sell or rent personal information or use it for marketing profiles.
2. Who is responsible
The responsible party is Accura AI (Pty) Ltd (registration number 2026/571438/07), 127 Dummer Street, Fairview Heights, Somerset West, 7130, South Africa.
Information Officer: Martin Bizor, info@akurra.ai, Coming Soon.
3. What we collect, why, and on what basis
| What | Where it comes from | Why we need it | Lawful basis (POPIA s11) | Required? |
|---|---|---|---|---|
| Name and email address | From the person who invites you, and from you | To create and run your account, sign you in, send invitations, password resets, receipts and security alerts | Performing our contract with you (s11(1)(b)) | Yes — without them we cannot give you an account |
| Password (stored only as a one-way hash) and two-step verification settings | You | To keep your account secure | Contract (s11(1)(b)); legitimate interest in security (s11(1)(f)) | Password yes; two-step verification is your choice |
| Sign-in and session records: time, IP address, browser type | Your browser | Security, fraud and abuse prevention, troubleshooting | Legitimate interest (s11(1)(f)) | Yes |
| Credit and run records: credits bought, granted, held and used; when a run started and finished; which kind of credit it used; promotion codes redeemed | Created as you use the Service | To count credits fairly, return credits that were not used, and answer billing questions | Contract (s11(1)(b)) | Yes |
| Report record: a serial number and a cryptographic fingerprint (hash) of each signed report, and how many times it was signed | Created when your report is signed | So that a report can later be shown to be genuine and unaltered. The fingerprint cannot be turned back into the report | Contract (s11(1)(b)); legitimate interest in preventing forged reports (s11(1)(f)) | Yes, for a signed report |
| Payment records: amount, date, status, provider reference, card brand and last four digits | Our payment provider | To credit your account, issue receipts, handle refunds and meet tax record-keeping duties | Contract (s11(1)(b)); legal obligation (s11(1)(c)) | Only if you buy credits |
| Refund records: amount, date and bank reference of a refund we pay you | You and our bank | To pay and account for refunds | Contract; legal obligation | Only if you are refunded |
| Deep Analysis usage counters: per day, how many documents and how much text were analysed, and the cost | Created when a document you add is read | To enforce daily limits and control cost. Contains no document content | Legitimate interest (s11(1)(f)) | Yes, in every run in which a document is read |
| Error reports from the app: the kind of error, a short reason, the app version and the time | Your browser, when something fails | To find and fix faults. Limited by design to a fixed list of fields, so it can never carry a figure or a document | Legitimate interest (s11(1)(f)) | Yes |
| What you write to us | You | To answer you | Legitimate interest; contract | Your choice |
What we do not keep. We keep no copy of your statements, agreements, account numbers, interest rates, balances, results or reports. Your documents, and for the review your figures, pass through our servers on their way to the AI provider, as section 4 describes. The password of a protected PDF is used only on your device and is never sent to us.
Information about other people. Your documents may name other people (for example a co-borrower). Every document you add is sent through Deep Analysis, so please add a document only if you are entitled to send it.
Children. The Service is for people aged 18 and over. We do not knowingly process children's personal information.
4. Deep Analysis — what is sent, and what happens to it
Deep Analysis is how the Service reads the documents you add. It never runs before you consent: at the start of each run you must tick a box that is not ticked for you. There is no separate choice for each document. Your consent is recorded in your report.
What is sent. For extraction: every document you add in the run — a typed PDF or a CSV file as its text, a scanned document as page images. For the plain-language review: the figures your device worked out and the terms read from your agreement. Your name and account number are never part of the review.
Who receives it. Our servers, which run on Microsoft Azure in South Africa, pass it to Anthropic, PBC, our contracted AI provider, in the United States. Anthropic processes it only to return the figures or the review to you.
What is kept, and for how long.
- On our servers: nothing readable. Our analysis function does not log document content. For long documents, the result is held on our server for a few seconds, encrypted with a one-time key that only your browser has, until your browser collects and deletes it. If you close the tab first, it is deleted within 15 minutes.
- At Anthropic: Anthropic does not use the content to train its models. Under its commercial terms it deletes inputs and outputs within 30 days of receiving or generating them. It may keep content longer in three cases: where the content is flagged for a breach of its usage policy, when it may be kept for up to two years for safety review; where the law requires it; and in services where the customer sets how long content is kept.
- In your report: each figure records whether it was read by Deep Analysis, read on your device, or typed by you.
If you do not consent, nothing is sent and nothing is charged, and the run does not start. The Service cannot be used without this consent.
If a document cannot be read, or a figure was read wrongly, you type or correct the figure yourself, and the result is calculated the same way.
If you act for someone else. An account that we have set up to act for clients sends a client's documents in the same way. At the start of each run it must also confirm that it is permitted to send them, and the report records that confirmation.
Withdrawing consent. You can withdraw at any time by leaving the run and not starting another. Withdrawal stops anything further being sent. It does not undo what was already processed: what the AI provider has already received stays with it until it is deleted, within 30 days, as described above.
5. Who we share personal information with
- Our sub-processors, listed in Schedule A to our Terms of Service: the AI provider (which reads the documents you add and writes the review), our hosting provider, our email provider, and — once switched on — our payment provider. Each processes information only on our instructions, under a written agreement requiring confidentiality and security (POPIA s20 and s21).
- Operators we authorise within Akurra, who can see account, credit and payment records (never your documents) to support you. Every change they make is recorded in an audit log.
- Authorities, where the law requires it — for example the South African Revenue Service, or under a court order.
- A buyer of our business, if the Service is sold, on condition that this notice continues to apply.
We do not sell personal information and do not share it for advertising.
6. How long we keep it
| Record | How long |
|---|---|
| Account (name, email, sign-in settings) | While your account is open, then deleted within 30 days of closure |
| Credit, run and report records | While your account is open, plus 5 years, so that billing questions and report checks can be answered; then deleted or anonymised |
| Payment and refund records | 5 years from the transaction (Tax Administration Act, 2011, s29) |
| Operator audit log | 5 years |
| Deep Analysis usage counters | 90 days |
| App error reports | 90 days |
| Logs of our application servers (Microsoft Azure) | 30 days |
| Logs of our sign-in server (FiberPulse) | [to be supplied: retention period for the sign-in server's logs] |
| Encrypted Deep Analysis results awaiting collection | Seconds; at most 15 minutes |
We may keep a record longer if we must for a legal claim or investigation, and only for as long as that lasts.
Backup copies. The database that holds the credit, run, report, payment, audit, usage and error records above is backed up, and each backup copy is kept for 30 days. A record that has been deleted from the database can therefore remain in a backup copy for up to 30 days more. We use backup copies only to restore the service after a failure.
7. Information sent outside South Africa
In every run, after your consent at the start of it, Deep Analysis sends the content of the documents you add, and for the review your figures and the terms of your agreement, to Anthropic in the United States. The pages of the app and the website are delivered from Microsoft's global network, which receives your IP address to deliver them. Account emails are sent through Microsoft Azure Communication Services, whose data location for our account is Africa. Section 72 of POPIA allows this where the recipient is bound by law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA. Our agreements with these providers include data-processing terms that do so. For Deep Analysis, you are also told about the transfer before you consent.
8. How we protect it
- Calculation on your device: every figure in your result is worked out in your browser, and we keep no copy of your documents.
- Encryption in transit (TLS) for every connection; one-time-key encryption for the Deep Analysis results we briefly hold.
- Two-step verification for accounts, and separate, restricted access for operators.
- Allow-listed error reporting that cannot carry document content.
- Least-privilege access, credentials held only server-side, and an audit log of operator actions.
If a breach compromises your personal information, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.
9. Cookies and browser storage
We use only what the Service needs to work: a sign-in session (a cookie or browser storage set by our sign-in service) and, while a card payment is in progress, a payment reference kept in your browser tab until the payment completes. We use no advertising, analytics or tracking cookies, and no third-party scripts. Your run lives in your browser tab's memory and is gone when you close it.
10. Your rights
Under POPIA you may:
- ask whether we hold personal information about you and for a copy of it (s23);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
- object to processing based on our legitimate interests (s11(3));
- withdraw consent you gave, such as for Deep Analysis, by not starting another run (section 4 says what happens to what was already sent);
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (s71). Akurra does not make decisions about you: it produces figures for you and your adviser to consider;
- complain to the Information Regulator.
To use a right, email the Information Officer at info@akurra.ai. We may need to confirm your identity first. We answer within 30 days. A copy of your information is free of charge; requests under the Promotion of Access to Information Act, 2000 follow our PAIA manual [to be supplied: where the PAIA manual can be found].
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 Complaints: POPIAComplaints@inforegulator.org.za · General: enquiries@inforegulator.org.za · www.inforegulator.org.za
11. Changes to this notice
We will update this notice when what we do changes. We will tell you of material changes by email or in the Service before they take effect. The version and date at the top show which notice applies.