Taxly handles some of the most sensitive information you have — your receipts, your income and your tax documents. This policy sets out exactly what is collected, where it goes, who else can process it, and what you can demand of us. It is written to be read, not to be skimmed past.
The short version. Your data is used to run Taxly for you and nothing else. There is no advertising and nothing is sold or shared for marketing. To understand how many people visit the site, Taxly keeps a small, anonymous count of page visits on its own servers — no cookies, no tracking pixels, no third-party analytics like Google, and nothing that identifies or follows you. Receipt images are sent to an AI provider purely to read them, and are not used to train anyone's models.
Taxly is operated by Pierrie Kirby, trading as a sole proprietor in South Africa. Under POPIA this makes him the responsible party for the personal information described here, and he also acts as the Information Officer.
Contact for any privacy matter, including requests to access or delete your data: support@gettaxly.co.za
Only what the product needs in order to work. Nothing is collected speculatively.
| Category | What it includes |
|---|---|
| Account | Your email address and how you signed in. Passwords are handled by our authentication provider and are never visible to Taxly. |
| Tax profile | Your age band and the taxpayer details needed to estimate tax. Taxly does not currently ask for or store your SARS tax number. |
| Receipts & documents | The images and PDFs you upload or email in, and everything extracted from them — merchant, date, totals, VAT, line items and category. Tax certificates (IRP5, IT3, medical, RA) if you choose to import them; note that such a certificate is stored as you supplied it, so if the document itself shows your SARS tax number, that original is kept in your private storage. |
| Income | Income entries you record: date, source, amount and type. |
| Deduction worksheets | Home-office details (floor area, work pattern), medical scheme and out-of-pocket costs, travel logbook (odometer readings and trips), and retirement contributions. |
| Email-in address | A secret token forming your private forwarding address. Anyone holding it can submit receipts to your account, so treat it like a password. |
| Push reminders | If you enable deadline reminders, the browser-issued subscription details needed to deliver them. Declining collects nothing. |
| Audit log | An append-only record of significant actions on your account, kept for security and to support the SARS audit trail. |
| Website analytics | An anonymous record of page visits — the page visited, a coarse device type (mobile, tablet or desktop), and where the visit came from (for example, a link from Facebook) — and of a few anonymous steps within a visit, such as "opened the sign-up form", "submitted it" or "used the refund calculator". It records that a step happened, never what you typed. It is not linked to your account, uses no cookies, and stores no IP address. A short-lived, per-tab identifier groups the pages of a single visit and is discarded when you close the tab; it cannot follow you across visits or to other sites. |
Under POPIA, processing is justified as follows:
When you upload a receipt or tax certificate, the image or PDF is sent to Anthropic's Claude API, which reads it and returns the merchant, date, amounts, VAT and a suggested category. This is the core of how Taxly works.
Anthropic processes this data outside South Africa. See cross-border transfers below.
Taxly relies on a small number of operators, each contractually bound to protect your data:
| Provider | Role | Location |
|---|---|---|
| Supabase | Authentication, database and receipt file storage | EU (eu-central-1) |
| Anthropic | AI reading of receipts and tax certificates | United States |
| Hetzner | Server hosting | European Union |
| Google Fonts | Serves the typeface. Your browser's IP address is visible to Google when a page loads. No account data is shared. | Global CDN |
| Push services | Only if you enable reminders — your browser's push provider (e.g. Google, Apple or Mozilla) delivers the notification. | Global |
Your information is never sold, rented, or shared with advertisers or data brokers. It is disclosed otherwise only where the law compels it.
Taxly's servers are in the European Union, and AI processing occurs in the United States. Your personal information therefore leaves South Africa.
POPIA section 72 permits this where the receiving country offers comparable protection. The EU operates under the GDPR, which affords protection substantially similar to POPIA, and transfers to our US provider are governed by contractual data-protection terms. By using Taxly you acknowledge this transfer. If it is unacceptable to you, please do not upload personal data — and tell us, because it is useful to know.
You may request earlier deletion at any time — see your rights below.
No system is perfectly secure. If a breach ever affects your personal information, you will be notified, along with the Information Regulator, as POPIA requires.
You are entitled to:
Write to support@gettaxly.co.za and you will receive a response within 30 days. There is no charge for a reasonable request.
Information Regulator (South Africa)
If you believe your information has been mishandled, you may complain directly to the
Regulator: inforegulator.org.za
Taxly is intended for taxpayers and is not directed at children under 18. Accounts are not knowingly created for minors. If you believe a child's information has been submitted, contact us and it will be removed.
Every figure Taxly produces is an estimate to help you prepare your own return. Taxly is software, not a registered tax practitioner, and does not submit anything to SARS on your behalf. Confirm your position with a registered tax practitioner before submitting.
If this policy changes materially, the version and date above will be updated and you will be notified in the app before the change takes effect. Continued use after that constitutes acceptance.
Pierrie Kirby — Responsible Party & Information Officer
Email: support@gettaxly.co.za
Web: gettaxly.co.za