Effective date: 6 September 2026 · Last updated: 6 September 2026
FinImali is operated by Enhle-Miya (Pty) Ltd, a private company incorporated in South Africa (“we”, “us”, “our”). For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), Enhle-Miya (Pty) Ltd is the responsible party for the personal information processed through the FinImali service.
You can reach us about any privacy matter at info@finimali.co.za. Formal company particulars and designated Information Officer contact details will be published here once confirmed; in the interim, info@finimali.co.za serves as the privacy contact.
This Privacy Policy (also our privacy notice under section 18 of POPIA) applies to personal information processed when you visit the FinImali website, create an account, use the FinImali application, subscribe and pay, or communicate with us.
It applies to visitors, account holders and the authorised users of a business account. It does not apply to third-party websites or services that have their own privacy policies, such as Google or PayFast.
Important: if you enter personal information about your own customers, employees or suppliers into FinImali (for example client names, contact details or amounts on invoices), your business is the responsible party for that information. You are responsible for having an appropriate lawful basis and, where required, your own privacy notices for that information. We process it on your behalf as described in section 9.
Account and authentication data — your name, email address and sign-in credentials (passwords are handled by our authentication provider; we never see or store your plain-text password), plus your account identifiers and session information.
Business profile data — the business details you provide during onboarding and in settings, such as business name, business type, VAT registration status and VAT number, contact and location details, and a logo you choose to upload.
Financial and business records you enter — invoices and their line items, expenses and their categories, VAT amounts, receipts you upload, compliance deadlines you mark as done, and related notes.
Client and customer information you choose to store — names, contact details and transaction history relating to your own clients, where you choose to capture them in invoices or records.
Payment and subscription information — your chosen plan, trial status, billing dates and subscription status. Payments are processed by PayFast: your card or bank details are entered on PayFast’s secure pages and processed by PayFast. We do not receive or store your full card or bank account credentials; we receive payment confirmations and references from PayFast.
Support and communications — correspondence when you contact us, including your email address and the content of your messages.
Technical, device and log information — standard server and error logs (such as IP address, browser type, timestamps and pages accessed) generated when the service is used, used for security, debugging and reliability.
Information from Google sign-in — if you choose “Continue with Google”, Google shares basic profile information with us (typically your name, email address and Google account identifier) after you consent on Google’s sign-in page.
FinImali is designed for ordinary business bookkeeping. Please do not enter special personal information (such as information about health, biometric data, race, religious or similar beliefs, trade-union membership, or criminal behaviour) or children’s personal information into the service unless it is strictly necessary for your records and you are legally entitled to process it.
We do not design or intend the service to process special personal information, and we do not require it for any feature.
We collect personal information directly from you when you register, complete your business profile, use the app, upload receipts or logos, and contact us; from Google when you choose Google sign-in (with your consent given to Google); automatically from your use of the service (technical and log data); and from our payment processor PayFast in the form of payment confirmations and status notifications.
We process personal information to:
• create and secure your account and authenticate you when you sign in;
• provide the service you signed up for — invoices, expenses, receipts, reports, compliance reminders, the dashboard, and the Financial Health Score and Credit Readiness Score, which are generated from your own account data as internal FinImali features only (they are not credit-bureau scores, credit assessments or lender decisions);
• operate the AI Finance Assistant where your plan includes it. When you ask the assistant a question, a summarised snapshot of your business, invoice and expense figures is sent, together with your question, to the AI service provider we use to generate an answer. Please avoid typing unnecessary personal or sensitive information into the assistant, and remember its answers are not professional advice;
• process your subscription and billing through PayFast, manage trials, and keep payment records;
• respond to your support requests and communicate with you about your account;
• keep the service secure, prevent fraud and misuse, and debug errors;
• operate, maintain and improve the service; and
• comply with our legal obligations (for example tax, accounting and consumer-protection record-keeping).
POPIA does not make consent the only justification for processing. Depending on the purpose, we rely on one or more of the following: processing necessary to conclude or perform the contract you enter with us (providing the service); compliance with legal obligations that apply to us; your consent where it is appropriate (for example optional sign-in via Google, or marketing communications); and protecting your legitimate interests or pursuing our legitimate interests — such as securing the service and improving it — where lawful and appropriate and balanced against your rights.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing that happened before withdrawal; some features may then become unavailable.
Service providers that process personal information on our behalf act as operators under POPIA. We require them to process personal information only on our instructions, to keep it confidential, and to maintain appropriate security measures.
Our own personnel and contractors with access to personal information are bound by confidentiality obligations, and access is limited to what is needed for their role.
Depending on where our service providers’ infrastructure is located, some personal information may be processed or stored outside South Africa. Where personal information is transferred across borders, we will do so in accordance with POPIA — for example where the recipient is subject to laws, binding corporate rules or agreements that provide substantially similar protection, or where another lawful ground in section 72 of POPIA applies.
We keep account and service data for as long as your account is active and as needed to provide the service. After closure, we may retain certain records for longer where required or permitted by law (for example financial and tax record-keeping obligations), and to resolve disputes or enforce our agreements.
When information is no longer needed, we will delete, destroy or de-identify it in accordance with POPIA. Residual copies may persist in backups for a limited period until those backups cycle out; deleted information is not restored to live systems.
We take reasonable, appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration and disclosure. These include: authenticated access to accounts; database-level row security so that each account can only access its own records; private storage for uploaded files such as receipts and logos; encrypted connections (HTTPS) and encryption provided by our hosting infrastructure; and access to systems limited to those who need it.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We continually review our safeguards as the service develops.
If we become aware of a security compromise affecting personal information, we will investigate, take steps to contain and remedy it, and notify the Information Regulator and affected data subjects where POPIA requires notification, as soon as reasonably possible.
If you suspect a security issue with your account, please contact us immediately at info@finimali.co.za.
Under POPIA, and subject to its conditions and exceptions, you have the right to: request confirmation of whether we hold personal information about you, and request access to it; request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; object, on reasonable grounds, to certain processing; withdraw consent where processing is based on consent; not be subject to decisions based solely on automated processing that significantly affect you, in the circumstances the law provides; opt out of direct marketing communications; and lodge a complaint with the Information Regulator (details in section 21).
Some rights are subject to legal limitations — for example, we may need to retain certain records even after a deletion request where the law requires it.
Email us at info@finimali.co.za with your request. To protect your account and data, we may need to verify your identity before acting on a request. We will respond within the timeframes and in the manner required by applicable law. Many details — such as your profile and business information — can already be viewed and corrected directly in the app.
We send service-related (transactional) messages necessary for your account — for example sign-up verification, password resets, billing and payment notifications, and important service announcements. You cannot opt out of these while you hold an account.
We only send marketing communications in line with POPIA and the Electronic Communications and Transactions Act 25 of 2002, and every marketing message will include a simple way to opt out. You can also opt out at any time by emailing info@finimali.co.za.
FinImali is business software intended for adults running businesses. It is not directed at children, and we do not knowingly collect personal information of children. If you believe a child’s information has been entered into the service, contact us and we will address it.
The service links to or relies on third parties such as Google (sign-in) and PayFast (payments). Their handling of your information is governed by their own privacy policies, which we encourage you to read. This policy does not cover third-party practices.
We may update this policy from time to time. The “Last updated” date above shows the latest revision. For material changes we will give reasonable advance notice — for example by email or an in-app notice — before the change takes effect. Continued use of the service after an update takes effect means you accept the updated policy.
For any privacy question, request or complaint, contact us first at info@finimali.co.za so we can try to resolve it.
You also have the right to complain to the Information Regulator (South Africa):
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 0800 017 160 (toll-free) or 010 023 5200
This policy describes our current practices in good faith and is a business draft intended to be finalised after legal review. It does not by itself guarantee compliance with POPIA or any other law, and it does not constitute legal advice. If anything in this policy conflicts with rights you have under applicable law that cannot lawfully be limited, those rights prevail.
Privacy questions or requests? Email us at info@finimali.co.za.