SmartMoney Privacy Policy
Version 1.1, draft for approval. Last updated 16 September 2026.
This policy explains what personal information the SmartMoney app collects, why, where it is stored, who else processes it, how long it is kept, and how to exercise your rights under the Protection of Personal Information Act 4 of 2013 (POPIA). It describes the app as it works today. It is not legal advice.
1. Who we are
SmartMoney is a product of Lorde Global Holdings (Pty) Ltd, registration number 2020/167081/07 ("we", "us"), the responsible party under POPIA for personal information processed in the SmartMoney app.
Information Officer: Natasha Thokozile Sichone Lorde
Contact for privacy requests: support@getsmartmoney.co.za
Physical address: 155 West Street, Johannesburg, 2001, South Africa
2. What we collect
| When | Information |
|---|---|
| Creating an account | Email address and password (stored only as a secure hash by our authentication provider). If you sign in with Apple or Google, we receive your email address and the name your Apple or Google account shares with us. The date and version of your consent to this policy are recorded when you complete your profile. |
| Getting started with Sam | First name, the profile types you choose (individual, solopreneur, business) and your preferred tone. Sam uses your first name in its replies. |
| Before your first diagnosis | South African ID number or passport number, nationality, date of birth, citizenship and tax residency, whether you are registered for eFiling and whether you have a tax number. You can also add your surname, mobile number and tax reference number in your profile. |
| Tax diagnosis | Your answers about income, employment, rental property, travel, business activity and filing history, and the results, score, flags and tasks produced from them. |
| Money and records you enter | Income and expense records, bank account names and balances you type in, debit orders, assets and liabilities, investment goals and holdings, rental properties, bonds and improvements, and calculator history. |
| Business Suite | Business name, entity type and tax regime, registration and VAT numbers, logo, invoices and quotes, VAT periods, recurring invoice schedules, and the details of customers you add (name, email address and any other contact details you enter). For your customers' details you decide what to add; see section 9. |
| Files you upload | Receipt photos and PDFs, business logos, invoice PDFs and documents you attach to submissions. The app reads only the files and photos you choose, using the camera or photo library when you ask it to. |
| Sam, the tax companion | The messages you send Sam and Sam's replies, kept as conversations in your account. If you use voice input, see section 4. |
| Support and requests | Feedback you send, practitioner waiting-list requests and quote requests, including the name, email address, phone number and notes you give with them. |
| Subscriptions | Which plan you hold, its expiry, the practitioner minutes credited to you, and store transaction references. We never receive your card or bank details. |
| Device and diagnostics | A push notification token for your device, and crash reports (the error, the device model and operating system). Crash reports are not linked to your account and do not include your name, email, ID number or financial details. |
Some information stays on your phone only: your sign-in token, your Face ID or fingerprint lock setting, the profile you last had open, and draft answers while you work through a diagnosis or rental entry, which are sent to our servers when you submit. The app uses your phone's motion sensor for a background visual effect only; that reading never leaves the phone.
The app does not use advertising identifiers, does not track you across other apps or websites, and does not collect your location or contacts.
3. Why we process it
- To provide the service you signed up for: your tax diagnosis, estimates, tasks, deadline reminders, reports, Business Suite and Sam.
- Your ID number or passport number is used to confirm your identity, work out age-based rebates and prevent duplicate accounts.
- To manage your subscription and the practitioner minutes that come with it.
- To send the emails the service needs: account confirmation, password reset and, when you press send, invoices and reports. Feedback, waiting-list and quote requests are emailed to the SmartMoney team so they can respond to you.
- To answer support requests and keep the app working, including fixing crashes.
The lawful basis is performing the service you asked for and your consent, which you give when you complete your profile. We do not sell personal information and do not use it for third-party advertising.
4. Sam does not use outside AI
Sam answers from a library of approved answers written for SmartMoney. It runs on our own backend and no outside artificial intelligence provider receives your messages. The content of your messages is not written to our logs. Sam refuses messages that contain long numbers such as an ID, tax, card or phone number, so that those numbers are not stored in your conversation.
Voice input is optional. When you tap the microphone, speech recognition is performed by your phone's operating system: on iPhone by Apple and on Android by Google, under their own privacy terms. The app receives only the recognised text, and does not record or store audio.
5. Who else processes your information
We use the following service providers (operators under POPIA). Each processes information only to provide its part of the service.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in and backend functions for all account and app data. | European Union (Ireland) |
| Afrihost | Hosts the SmartMoney mail service that sends account emails such as sign-up confirmation and password reset. | South Africa |
| Google Firebase | Crash reporting (Crashlytics) and push notifications (Cloud Messaging). | United States and other Google locations |
| RevenueCat | Manages subscriptions. Receives your SmartMoney account identifier and your store purchase records, not your name or email. | United States |
| Apple App Store and Google Play | Take payment for subscriptions under their own terms. | Global |
| Resend | Sends the emails the app itself sends: invoices and reports when you press send, and feedback, waiting-list and quote requests to the SmartMoney team. | [United States unless the Resend account is set to its EU region; to be confirmed] |
| Google Fonts | Delivers the app's typeface, which shares your device's IP address with Google when the font first loads. | Global |
Some providers are outside South Africa. Where information is transferred outside South Africa we rely on the provider being bound by data protection law or contractual terms that give comparable protection, as POPIA section 72 requires.
Reports are emailed only to you, to the SmartMoney practice address, or to one address you enter per send, with a daily limit. Invoices are emailed only to the customer address you enter.
6. How we protect it
- All connections between the app and our servers are encrypted in transit.
- Our hosting provider encrypts stored data at rest.
- Database access rules mean only your signed-in account can read or change your records.
- Sign-in tokens are kept in your device's secure storage. You can add a Face ID or fingerprint lock, and the app signs you out after a short time in the background unless that lock is on.
- Your ID, passport and tax numbers can be hidden on screen from your profile and are never written to our logs.
7. How long we keep it
- While your account exists: we keep your information so the service works. Some financial records you delete in the app are marked as deleted and hidden rather than erased, so that linked records stay consistent; they are erased when your account is deleted.
- When you delete your account: your profile, every record listed in section 2, your Sam conversations and your uploaded files are permanently erased, and your sign-in is removed.
- Backups: our hosting provider keeps daily database backups for 7 days, so deleted information can remain in a backup for up to 7 days before it is overwritten.
- Crash reports are kept by Firebase for 90 days.
- Purchase records remain with Apple or Google and with RevenueCat under their own policies and financial record-keeping duties.
8. Your rights
Under POPIA you may ask whether we hold personal information about you and request access to it, ask us to correct or delete it, object to its processing, and withdraw consent.
- Delete your account: in the app, open your Profile and choose Delete account. This erases your information as described in section 7.
- Correct your details: edit them in your profile.
- Everything else, including a copy of your information: contact the Information Officer at support@getsmartmoney.co.za. We will respond within a reasonable time and in any event within the periods POPIA sets.
If you are not satisfied with our response, you may complain to the Information Regulator (South Africa): inforegulator.org.za.
9. Information about other people
If you add customers in the Business Suite, you are responsible for having a lawful reason to hold and use their details. We process that information on your behalf only to provide the Business Suite to you, and it is erased with your account.
10. Age
SmartMoney is intended for people aged 18 and over.
11. Changes to this policy
If we change this policy in a way that matters, the app will show the change before it takes effect. The date at the top is the date of the current version.