← Back to Ayrexa

Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Getabyte (Pty) Ltd ("Getabyte", "we", "us"), the operator of Ayrexa, collects, uses, and protects personal information in connection with the Service, in line with South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA"). It applies to the personal information of our customers' users, and — to the extent your organisation enters it into the Service — your own customers, suppliers, and employees.

1. Who we are / Information Officer

Getabyte (Pty) Ltd is the responsible party for personal information processed through Ayrexa. Our appointed Information Officer, who you can contact with any privacy question, access request, or complaint, is:

Solomon Mathebula, Information Officer
Getabyte (Pty) Ltd
128 Leslie Avenue, Spaces Building 2, Design Quarter, Fourways, 2191, South Africa
Email: admin@getabyte.co.za

2. What personal information we collect

  • Account & organisation data: name, email, password (hashed), role, phone number.
  • Organisation profile: company registration number, VAT number, address, banking details, contact details.
  • Transactional data you enter: customer/supplier names and contact details, invoices, bills, payments, payroll runs — entered by your organisation as the data controller for that data.
  • Usage data: audit log entries (who did what, when), login timestamps, IP address (for security/rate-limiting).
  • Billing data: handled by our payment processor, PayFast — we do not store your full card details ourselves.

3. Why we process it (purpose specification)

  • To provide and operate the Service you've signed up for (accounting, invoicing, payroll, reporting);
  • To authenticate you and secure your account;
  • To send essential service communications (e.g. password resets, invoice delivery, overdue reminders you've configured);
  • To process subscription billing via PayFast;
  • To maintain a tamper-evident audit trail of changes to your financial records;
  • To generate the AI-assisted insights you request (see Section 6 below for how this data is handled);
  • To comply with our own legal obligations (e.g. tax and company-law record-keeping).

We do not sell personal information, and we do not use your Customer Data to train any third-party AI model.

4. Lawful basis & processing limitation

We process personal information only where necessary to perform our contract with you (providing the Service you signed up for), to comply with a legal obligation, or with your consent (e.g. an optional marketing email, which you may withdraw at any time). We collect no more information than is necessary for these purposes.

5. Who we share it with

We only share personal information with service providers who help us operate Ayrexa, under contractual confidentiality obligations:

  • Microsoft Azure (South Africa North region) — hosting and database infrastructure.
  • PayFast — subscription billing and payment processing.
  • Stitch (if you enable it) — Pay-by-Bank / payout processing for your own customers/suppliers.
  • SimplePay (or another payroll provider you connect) — payroll synchronisation.
  • Microsoft Graph / SendGrid — transactional email delivery (password resets, invoices, reminders).
  • OpenAI / Microsoft Azure OpenAI — only if you (or your organisation) use the AI CFO or receipt-scanning features. By default this uses our shared platform connection; you may instead connect your own independently-held OpenAI/Azure OpenAI key in Settings, in which case your data is sent directly to your own account under your own agreement with that provider.

We do not sell or rent personal information to third parties for their own marketing purposes.

6. Cross-border transfers

Your Customer Data is hosted in Microsoft Azure's South Africa North region. Where you enable AI-assisted features using our shared OpenAI/Azure OpenAI connection, the specific text sent to generate that response (e.g. a summarised financial context or your question) may be processed on infrastructure located outside South Africa, subject to that provider's own data protection commitments. You can avoid this entirely by not enabling AI features, or by connecting your own API key under your own data processing terms with that provider.

7. Retention

We retain Customer Data for as long as your organisation's account remains active, and for a reasonable period after closure to allow data export, after which it is securely deleted — except where South African law requires longer retention (for example, financial records under the Companies Act 71 of 2008 and tax legislation, typically 5-7 years). Audit log entries are retained in a tamper-evident form for the same period as the records they relate to.

8. Security safeguards

We apply technical and organisational security measures appropriate to the sensitivity of the data we hold, including: encrypted connections (TLS) for all traffic, encrypted password storage, role-based access control, a tamper-evident audit trail of changes to financial records, and restricted internal access to production systems. No method of transmission or storage is 100% secure, and we will notify affected data subjects and the Information Regulator without undue delay in the event of a security compromise affecting personal information, as required by POPIA.

9. Your rights as a data subject

Under POPIA, you have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate or outdated personal information;
  • Request deletion of personal information we no longer have a lawful basis to retain;
  • Object to processing of your personal information in certain circumstances;
  • Lodge a complaint with the Information Regulator of South Africa.

You can access your own basic account information and submit an access or deletion request at any time from Settings > Privacy & Data Rights once logged in, or by emailing our Information Officer directly at admin@getabyte.co.za. We will respond within a reasonable time, and in any event within the time limits POPIA prescribes. Where a deletion request concerns financial records we are legally required to retain, we will explain the specific legal basis for retaining them rather than deleting immediately.

10. The Information Regulator

If you believe we have not handled your personal information in accordance with POPIA, you may lodge a complaint with South Africa's Information Regulator:

Information Regulator (South Africa)
Email: complaints.IR@justice.gov.za
Website: inforegulator.org.za

11. Cookies & sessions

We use strictly necessary session cookies to keep you signed in and to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice at least 15 days before taking effect. See our Terms of Service for the terms governing your use of the Service generally.

13. Contact

Getabyte (Pty) Ltd
128 Leslie Avenue, Spaces Building 2, Design Quarter, Fourways, 2191, South Africa
Information Officer: Solomon Mathebula — admin@getabyte.co.za
General support: support@ayrexa.com