Privacy Policy

Last updated: 5 October 2026

1. Introduction

Taxzi ("we", "us", "our") is committed to protecting your personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African legislation. This Privacy Policy explains what information we collect, how we use it, and your rights.

2. Information We Collect

2.1 Account Information

  • Name and surname
  • Email address (verified via Google sign-in or a confirmation link we send to that mailbox)
  • Password, if you choose email sign-up (stored securely using bcrypt hashing; Google-only accounts have no password)
  • Google account identifier, if you sign in with Google

2.2 Tax Profile Information

  • Occupation and employment type
  • Tax identification number and ID number (encrypted at rest using AES-256)
  • Medical aid details and dependants
  • Retirement annuity contributions

2.3 Bank Statement Data

  • Transaction text extracted from uploaded bank statements (CSV or PDF)
  • We do not store the original uploaded files. Text is extracted in memory for AI analysis and the raw file is discarded immediately.

2.4 Payment Information

  • Payments are processed by PayFast, a PCI DSS Level 1 compliant payment processor.
  • We do not receive, process, or store your credit card number, CVV, or banking credentials.
  • We store only: PayFast payment ID, plan selected, amount, status, and timestamp.

2.5 Security and usage data

  • IP address, approximate location (country, region, and city when provided by our host), and browser user-agent on sign-up and sign-in. We use this security record to detect abuse, fake accounts, and unauthorised access. We do not sell that record. Site analytics and advertising measurement are separate and are described in section 6.
  • Sign-in method (Google or email) and the time of your last successful sign-in.

3. How We Use Your Information

We use your personal information to:

  • Provide and improve the tax analysis service.
  • Process transactions via AI (OpenAI) to categorise and identify potential deductions.
  • Manage your account and credit balance.
  • Process payments through PayFast.
  • Communicate with you regarding your account or the Service.
  • Detect fake sign-ups, abuse of free credits, and unauthorised access (IP address and approximate location).
  • Measure how the site is used, and whether advertising leads to visits or sign-ups, using the Google tags in section 6. That measurement does not include your bank statements, ID number, or tax number.
  • Comply with legal and regulatory obligations.

4. AI Processing & Third Parties

Bank statement transaction text is sent to OpenAI via their API for AI-powered analysis. OpenAI's API data usage policy states that data submitted via the API is not used to train their models. No identifying information such as your name, ID number, or account number is included in the data sent to OpenAI - only transaction descriptions, dates, and amounts.

If you choose "Continue with Google", Google authenticates you and shares your name, email address, and Google account id with us. We only accept Google accounts whose email Google has verified. See Google's Privacy Policy.

The public site also loads Google Analytics 4 and a Google Ads tag (section 6). Those tags measure site use and advertising. They are not part of Google sign-in, and we do not send bank statements, tax-profile fields, or card details to them.

5. Data Storage & Security

  • Your data is stored in a secure PostgreSQL database hosted by Neon, with encrypted connections (TLS).
  • Sensitive fields - your ID number, tax number, transaction descriptions, transaction notes, and bank account numbers - are encrypted at rest using AES-256-GCM.
  • Passwords are hashed using bcrypt and never stored in plain text.
  • Authentication uses HTTP-only, secure, SameSite cookies (JWT).
  • The application is served over HTTPS via Vercel's edge network.

6. Cookies

We use first-party cookies to run the service, and we load Google measurement tags for analytics and advertising. We do not sell your personal information.

Cookies we set

  • auth-token - an HTTP-only, secure, SameSite cookie that keeps you signed in. JavaScript on the page cannot read it.
  • google-oauth - a short-lived HTTP-only cookie during Google sign-in, used to prevent cross-site request forgery. It is cleared after sign-in.
  • tz-visitor - an HTTP-only cookie with a random identifier so we can count a unique view of a guide or article once. We do not use it to build an advertising audience.

Google Analytics and Google Ads

When you use taxzi.co.za, the site loads Google's tag (gtag.js from googletagmanager.com) and configures:

  • Google Analytics 4, measurement ID G-Q2G30M8715, to understand how the site is used (pages visited, and in-product events such as starting a calculator or completing sign-up).
  • Google Ads, tag AW-963187150, to measure advertising, including whether a visit followed an ad. After you create an account, we may also send a sign-up conversion to Google Ads, once per browser session.

These tags can store cookies in your browser and send technical data to Google, such as pages viewed, a cookie or client identifier, device and browser information, and an approximate location derived from your IP address. We do not send your bank statements, ID number, tax number, or card details through these tags. Google processes this measurement data under its own policies: Google Privacy Policy and how Google uses information from sites that use its services.

Other site measurement

We also use Vercel Web Analytics and Speed Insights for aggregate traffic and page performance. Those tools are separate from the Google tags above and are not advertising cookies.

Your controls

You can block or delete cookies in your browser, or use your browser's tracking protections. Google also offers an Analytics opt-out browser add-on and ads settings. Blocking cookies or the Google tag limits this measurement. If the tag still loads, Google may receive a page request that includes your IP address. Blocking the sign-in cookie will sign you out. We do not offer a separate in-app cookie switch.

7. Data Retention

  • Account data is retained for as long as your account is active.
  • Transaction analysis results are retained to allow you to generate reports across tax years.
  • You may request deletion of your account and all associated data at any time (see section 8).

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

  • Access - request a copy of the personal information we hold about you.
  • Correction - request correction of inaccurate personal information.
  • Deletion - request deletion of your personal information where there is no lawful reason for us to continue processing it.
  • Objection - object to the processing of your personal information.
  • Complaint - lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date. Continued use of the Service constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related enquiries or to exercise your rights under POPIA, contact us at david.sampson@superstack.co.za.

See also our Terms & Conditions.