Privacy Policy

1. Introduction

Jimpro (Pty) Ltd, trading as StatementParse ("we", "us", "our"), is committed to protecting the privacy of our users. This Privacy Policy details how we collect, use, process, and safeguard your personal information in compliance with the South African Protection of Personal Information Act, No. 4 of 2013 ("POPIA").

2. Responsible Party and Information Officer

Jimpro (Pty) Ltd is the "responsible party" for the processing of your personal information. We have designated an Information Officer to address any enquiries relating to this Privacy Policy or your data rights.

3. Information We Collect and Process

We process different categories of information depending on how you interact with the service:

• Account Information: First Name, Surname, Email Address, and encrypted credentials. We collect this when you register on our platform to establish and secure your account.
• Bank Statement Data: Financial transaction descriptions, transaction dates, bank names, account numbers, and balances contained in the statements you upload for parsing.
• Usage & Analytics Data: IP address, browser type, page views, and interactions with the service. This information is anonymized and used to monitor platform stability and improve performance.

4. Lawful Bases for Processing

Under POPIA, we process your personal information only where:

• Contractual Obligation: It is necessary to process your account details and payment information to deliver the conversion service you have requested or purchased.
• Consent: You have provided clear, explicit consent for us to process your information (e.g., during signup).
• Legitimate Interest: Processing is necessary to protect the security, integrity, and operational health of our platform (e.g., fraud prevention and system log audits).

5. In-Memory Processing & Storage Policies

We adhere strictly to "Privacy by Design" principles to protect sensitive financial records:

• No Long-Term Retention of Statement Data: Uploaded bank statement files are processed entirely in server memory. Transactions are extracted, compiled into your download files, and immediately discarded from active server memory.
• 24-Hour Auto-Deletion: Any temporary cache or working files generated on our staging storage during processing are protected by a strict automated server lifecycle policy that permanently deletes files after 24 hours. We do not store statement data on persistent databases.
• Account Data Retention: Your email address and transaction history metadata (invoice status, payment reference, remaining credits) are retained only for as long as your account is active, or as required by South African financial audit laws.

6. Third Parties and Cross-Border Data Transfers

We do not sell, rent, or trade your personal information to third parties. To provide our core services, we securely share specific information with external service providers:

• AI Processing (Anthropic): We use Anthropic's Claude API to extract financial data from statements. Uploaded statement content is transmitted to Anthropic (based in the USA) securely. Under their developer API agreement, they operate on Zero Data Retention (ZDR) guidelines—data sent via the API is processed in-memory only and is not retained or used for model training.
• Payment Gateways (Paystack & Stripe): We use Stripe and Paystack (licensed South African billing providers) to handle payments. Card details are handled directly by their secure payment overlays under PCI-DSS compliance. We never access or store your raw card details.

Cross-Border Disclosures (Section 72): Since our technical processing nodes (Anthropic) and payment processors operate in international jurisdictions (such as the USA and EU), your information may be transferred outside South Africa. We ensure these transfers are protected by standard contractual clauses, GDPR-aligned data processing agreements, and security safeguards that match or exceed South Africa's POPIA requirements.

7. Security Safeguards

We implement appropriate, reasonable technical and organizational measures to protect personal information against loss, unauthorized access, or destruction. All data transmission between your browser and our servers is encrypted using HTTPS (SSL/TLS). Additionally, we enforce Row-Level Security (RLS) on our database layers to prevent unauthorized account access.

8. Your Data Subject Rights

Under POPIA, you have the following rights regarding your personal information:

• Right of Access: You can request confirmation of whether we hold personal information about you, and request a copy of that data.
• Right to Correction: You have the right to request that we update, correct, or complete any inaccurate or misleading personal information.
• Right to Deletion: You can request that we permanently delete your account data and email records.
• Right to Object: You can object to the processing of your personal information at any time on reasonable grounds.

To exercise any of these rights, please email our Information Officer at info@statementparse.co.za.

9. Information Regulator Complaints

If you believe we have processed your personal information in a manner that infringes POPIA, you have the right to lodge a complaint with the South African Information Regulator at:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints Email: complaints.IR@inforegulator.org.za
General Enquiries: enquiries@inforegulator.org.za
Website: www.inforegulator.org.za