Privacy Notice

1. Who we are

BLVNK (Pty) Ltd is an AI-powered workflow platform for South African accounting firms. We act as an Operator under the Protection of Personal Information Act 4 of 2013 (POPIA).

2. What personal information we collect

• Contact details: names, email addresses, phone numbers of client representatives
• Financial data: invoices, payments, bank transactions, account balances
• Tax information: VAT numbers, tax reference numbers, financial year-end details
• Usage data: IP addresses, browser type, access timestamps (for security and audit)

3. Why we process it

• Automated bookkeeping workflow orchestration
• South African tax analysis and regime arbitrage
• SARS compliance monitoring and deadline tracking
• AI-assisted bank reconciliation and quality control
• Security auditing and fraud prevention

4. POPIA rights and deletion

Where POPIA applies, users may request access, correction, or deletion of their data. BLVNK keeps sufficient audit and security records while honoring valid deletion requests within applicable timelines.

Information Officer: Tadys Makua — privacy@blvnk.co.za

5. How long we keep it

We retain personal information for as long as your accounting firm maintains an active subscription, or as required by South African tax law (whichever is longer). Upon termination, data is either returned to the firm or securely deleted within 60 days.

6. Who we share it with

• Supabase — database hosting (EU or South Africa)
• Google Cloud — AI model inference (United States)
• Xero / QuickBooks — accounting platform integrations

We do not sell personal information to third parties.

7. Security safeguards

• AES-256-GCM encryption of sensitive tokens at rest
• Database row-level security with strict tenant isolation
• HTTPS/TLS for all data in transit
• Structured logging with automatic PII redaction
• Zod input validation on every API boundary
• Automated dependency vulnerability scanning

8. Cookies and session technologies

BLVNK uses essential cookies and similar session technologies for authentication, active workspace selection, and secure Xero and QuickBooks OAuth flows. BLVNK does not currently use advertising or third-party behavioral analytics cookies in the product.

Read the Cookie Notice for the current cookie categories and operational impact.

9. Your rights as a data subject

Under POPIA, you have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to processing in certain circumstances
• Lodge a complaint with the Information Regulator

To exercise these rights, contact your accounting firm (the Responsible Party) or email us at privacy@blvnk.co.za.

10. Cross-border transfers

Ledger data and personal information may be processed in the United States by our AI providers (Gemini, OpenAI, Anthropic) and in regions operated by Vercel and Supabase. Our API terms with these providers prohibit the use of BLVNK data to train their models, and we are executing formal data-processing agreements with each provider. We only transfer personal information across borders where the recipient is bound by law, binding corporate rules, or a binding agreement to uphold a substantially similar level of protection to that provided by POPIA, as required by section 72 of POPIA.

11. Contact us

BLVNK privacy and information officer contact — privacy@blvnk.co.za

Information Regulator: inforeg@justice.gov.za / 012 406 4818