Join the waiting list
Privacy & POPIAVersion 1, 13 October 2026 · a lawyer reviews it in January 2027

Privacy notice

How OarBook collects and uses personal information, and your rights, under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA). In plain words, and only what OarBook does today.

1. Who we are

OarBook is a trading name of Deidre and Co (Pty) Ltd, registration number 2023/811635/07, registered office Regus Century City, The Colosseum, Foyer 3, 1st Floor, Century Way, Century City, Cape Town 7441, South Africa. In this notice “OarBook”, “we” and “us” mean that company.

2. Our Information Officer

Deidré de Waal, director, is the company’s Information Officer. Write to the Information Officer at hello@oarbook.com with “For the Information Officer” in the subject, or by post to the registered office.

3. Our two roles

  • For our own users, we are the responsible party. The information about the people who use OarBook (owners, the people they invite, accountants), the people who join our waiting list or write to us, and visitors to this website is ours to look after, and this notice says how we do it.
  • For the records a business keeps in OarBook, we are its operator (section 21 of POPIA). Its books, bank statements, invoices, slips, documents and payroll, with the personal information in them about its owners, staff, customers and suppliers, belong to that business. The business is the responsible party. We process that information only on its instructions, keep it confidential and secure, and tell the business at once if we have reason to believe someone got into its records who should not have. If you work for, buy from or supply a business that uses OarBook and want to see or correct your information, ask that business; we help it answer. If you ask us, we pass your request on to it.

4. What we collect, why, and on what basis

The lawful basis is the one in section 11 of POPIA that applies.

  • Your account: your name, e-mail addresses, the companies you belong to and your role in each, who invited you, and when you signed in. To give you an account, sign you in safely and show you only what your role allows. Basis: our agreement with you or your business (s11(1)(b)), and our legitimate interest in keeping accounts secure (s11(1)(f)).
  • What you do in OarBook: each change and approval, with who made it and when, in the audit log. So that the books can be trusted and shown to the tax office. Basis: the laws that require records to be kept (s11(1)(c)), and our legitimate interest (s11(1)(f)).
  • The iPhone app: the name of each phone you sign in on and when it was last used. To keep your sign-in on that phone and let you remove it. Basis: s11(1)(b).
  • The records a business keeps in OarBook: as its operator (section 3), on its instructions, under its basis.
  • The waiting list: your name, e-mail address, business, country, what the business does and where its books are now. To tell you when OarBook is ready for you. Basis: your consent (s11(1)(a)).
  • When you write to us or report a problem: what you send. To answer you and fix the problem. Basis: our legitimate interest (s11(1)(f)).
  • Visits to this website and the app: your IP address and the page you asked for, as every web server sees them, and error reports from the app (what went wrong, on which page). To run the website and the app and to fix faults. Basis: our legitimate interest (s11(1)(f)).

OarBook is not meant for children, and we take no card details: OarBook takes no payments today.

5. Who we share it with

We never sell or rent personal information. We share it only with the services OarBook runs on, each only for its part of the work, and with anyone a law requires us to give it to.

  • Amazon Web Services (AWS), Cape Town: the database and every document, encrypted. When you ask OarBook to read an answer aloud, Amazon Polly turns the text into speech; for a real company only once AWS’s opt-out from keeping that text is switched on.
  • Vercel: runs the app, in its Cape Town region, and this website.
  • Resend: sends OarBook’s e-mails: sign-in codes, documents a business sends from OarBook, and waiting-list sign-ups to our own mailbox.
  • Apple (iCloud Mail): holds our mailbox, hello@oarbook.com.
  • Anthropic (Claude), the AI that reads documents and suggests entries: only for a company whose owner agreed during setup and which OarBook then approved. For that company, bank statement lines, the text of documents (with identity, account and card numbers masked) and pictures of documents go to Anthropic; to look a business up on the web, only its name and town. We have asked Anthropic not to keep any of it (“zero data retention”); that is not yet granted, so until it is, Anthropic keeps it as long as its own commercial terms allow.
  • Meta (WhatsApp): only when a business lets people send slips to OarBook’s WhatsApp number, which is not switched on yet. Meta then carries those messages and keeps the pictures for up to 30 days. OarBook keeps each slip and the sender’s first name and number, and nothing else of the chat.
  • Google Fonts: this website (not the app) loads its typefaces from Google, which sees your IP address.

Speaking to OarBook is off until you switch it on. For a real company your voice is then turned into text on your own device, and the sound never leaves it.

6. Information that leaves South Africa

The books and documents are kept in South Africa, in Cape Town, and so are their backups. These leave the country:

  • to the United States: what goes to Anthropic for a company that agreed to the AI (section 5); e-mails sent through Resend; our mailbox at Apple; WhatsApp messages through Meta, once switched on; and, for this website, your IP address to Google Fonts. Vercel and Resend are United States companies, and their records of the requests and e-mails they handle may be kept outside South Africa.
  • Namibian businesses: there is no data centre in Namibia, so their books and documents are kept in Cape Town, and the business keeps a full copy of its own (Company → Your records → Download everything).

How we protect it (section 72 of POPIA): we send each service only what its part of the work needs; before anything goes to the AI, identity, account and card numbers are masked; the AI is used only for a company whose owner agreed; and each service works under its own data-processing terms, which bind it to use the information only to provide its service to us and to keep it secure.

7. How long we keep it

  • Books and documents: 7 years from the day each is kept, the period the tax authorities can ask for them. They are locked so they can’t be changed or deleted in that time. Until February 2027 that lock is in “governance” mode: OarBook’s app cannot lift it, but an administrator of OarBook’s storage holding a special right could. From February 2027 it is in “compliance” mode, which nobody can lift.
  • When a business leaves: it takes a full download first. We keep its records as a read-only archive until their 7 years end, or, if it asks, we close the archive at once and delete each record as soon as its lock allows.
  • Your account: while you use OarBook. Your name stays in the audit log beside what you did and approved, for as long as those records are kept.
  • Sign-in codes: stored only as a scrambled hash, and valid for 10 minutes.
  • The waiting list and e-mails to us: in our mailbox, for as long as we need them to answer you or tell you when OarBook is ready for you. Ask, and we delete yours.

8. How we keep it safe

  • Everything is encrypted, in Amazon’s Cape Town data centre and on its way to and from you.
  • Staff identity and tax numbers and bank account numbers are encrypted a second time, with a key for each company.
  • You sign in with a one-time code that OarBook e-mails you; it works for 10 minutes, and only people who were invited can sign in. Approving a payment, a payroll or a return asks for a fresh code. OarBook’s own staff also need a code from an authenticator app.
  • Each company is walled off from every other in the database, and each person sees only what their role allows.
  • Every change is logged, in a log that cannot be changed without it showing. An entry in the books, once posted, is never changed; a mistake is put right with a reversing entry.
  • If we have reason to believe someone got into personal information who should not have, we tell the Information Regulator and the people affected, or, for a business’s records, that business, as POPIA requires (section 22).

9. Your rights, and how to ask

Under POPIA you may:

  • ask whether we hold personal information about you, and for a copy of it (section 23; how, and any fee, is in our PAIA manual);
  • ask us to correct or delete information that is wrong, out of date, incomplete or misleading, or that we may no longer keep (section 24);
  • object to our processing it on the ground of our legitimate interest (section 11(3));
  • withdraw a consent you gave, from then on;
  • refuse direct marketing (section 69);
  • complain to the Information Regulator (section 12).

Ask the Information Officer (section 2), in your own words or on the Regulator’s forms (Form 1 to object, Form 2 to correct or delete, on inforegulator.org.za/popia). We check that you are who you say you are before we answer. For the records a business keeps in OarBook, see section 3.

10. Direct marketing

We send marketing only to people who asked for it, and every such message says how to stop it. Joining the waiting list asks us to tell you when OarBook is ready for you, and that is all we use it for.

11. Cookies

This website sets no cookies and uses no tracking or analytics.

The app sets only the cookies it needs to work, none for advertising or tracking:

  • oarbook_session: keeps you signed in, for 12 hours.
  • oarbook_signin_email and oarbook_link_email: remember the address you are signing in with, or adding, between the two steps, for 10 and 15 minutes.
  • oarbook_pause: remembers a pause you chose, for 12 hours.
  • Notes you have already seen (names ending in _seen or _asked), so they are not shown again: 1 year.
  • oarbook_theme and oarbook_speech: your light or dark choice and your speech setting: 1 year.

The app also keeps an unsent question, and error reports waiting to be sent, in your browser until you close the tab.

12. Complaints

If you are unhappy with how we handle your information, tell the Information Officer first if you like. You may complain to the Information Regulator at any time, on its eServices portal: eservices.inforegulator.org.za.

Information Regulator, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191 · 010 023 5200 · enquiries@inforegulator.org.za

Versions

  • 13 October 2026: version 1. A lawyer reviews it in January 2027.

Questions: hello@oarbook.com