Privacy Policy
Groworx Finance
1. Who we are
Groworx (Pty) Ltd (registration number 2018/302674/07), 52 Richmond Avenue, Auckland Park, Johannesburg, 2092, South Africa ("Groworx", "we", "us").
Groworx is the responsible party for the personal information processed through Groworx Finance, within the meaning of the Protection of Personal Information Act, 2013 ("POPIA").
Questions about this policy: financesupport@groworx.com.
2. What Groworx Finance is
Groworx Finance is an internal tool. It connects to Groworx's own QuickBooks Online company and produces financial reports and answers questions about that data for authorised Groworx personnel and the company's appointed external accountant.
It is not offered to the public. There is no sign-up. We do not process any other organisation's QuickBooks data.
3. What we access
Groworx Finance reads accounting records from Groworx's QuickBooks Online company. These records include:
- Customer and supplier records, including business names, contact names, email addresses, telephone numbers and postal addresses
- Invoices, credit notes, payments, balances and ageing positions
- Inventory items and quantities on hand
- Accounts, journals, and standard financial reports
Some of this constitutes personal information under POPIA. We note that POPIA protects the information of juristic persons as well as natural persons, so records relating to corporate customers and suppliers are treated as personal information.
4. Read-only access
Groworx Finance reads. It does not write. It does not create, modify, void or delete records in QuickBooks Online. Where it identifies a bookkeeping issue, it produces a list for a person to review and act on; the correction is made by a human, in QuickBooks, not by this application.
5. Why we process this information
- To produce accounts-receivable ageing reports and financial summaries for internal management
- To answer internal questions about invoices, payments, balances and stock
- To identify bookkeeping errors and inconsistencies for correction
- To meet Groworx's own accounting, tax and record-keeping obligations
The lawful basis is that processing is necessary for the proper performance of Groworx's own business and legal obligations, and for the pursuit of its legitimate interests as the party to whom the underlying records belong.
6. Who processes the information on our behalf
We use the following operators. We do not sell information, share it for advertising, or make it available to anyone other than as set out here.
| Operator | Purpose | Processing location |
|---|---|---|
| Intuit Inc. | QuickBooks Online — the source system holding the records | United States |
| Amazon Web Services | Hosting and storage of computed figures and reports | South Africa (Cape Town region) |
| Anthropic PBC | Processing of queries and generation of report narrative via the Claude service | United States |
| Meta Platforms | Delivery of scheduled reports over WhatsApp, where enabled | Outside South Africa |
7. Transfers outside South Africa
Computed financial figures and reports are stored in South Africa. However, query content and report data are transmitted to Anthropic PBC in the United States for processing, and — where scheduled delivery over WhatsApp is enabled — report content is transmitted through Meta Platforms infrastructure outside South Africa. The source records themselves are held by Intuit Inc. in the United States.
These transfers are made under section 72 of POPIA on the basis that they are necessary for the performance of the functions for which the information was collected, and that the recipients are bound by contractual terms providing an adequate level of protection. Groworx remains accountable for the information throughout.
Data submitted to Anthropic through its commercial services is not used to train its models.
8. Retention
Computed figures, reports and audit records are retained for as long as Groworx requires them for management and statutory record-keeping, and are then deleted. Query logs and audit records are retained to allow any reported number to be traced back to its source. Disconnecting the QuickBooks company stops all further access and begins deletion of the cached data derived from it.
9. Security
- All QuickBooks access is routed through a single gated client that classifies each request and refuses anything that is not a read
- OAuth credentials are held in a managed secret store, never in source control or configuration files
- Access is limited to named, authorised individuals
- An append-only audit record is kept of what was queried, by whom, when, and what was returned, including refused requests
- Transport is encrypted, and stored data is encrypted at rest
10. Your rights
Data subjects may request access to the personal information we hold about them, request correction or deletion, or object to processing. Requests should be sent to financesupport@groworx.com.
A data subject who is not satisfied with our response may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
11. Disconnecting
An authorised user may disconnect the QuickBooks Online company at any time. Disconnection revokes our access and refresh tokens and ends all further access to the QuickBooks data.
12. Changes
We will update this policy when the application changes. The version number and effective date above will change with it.