Privacy Policy

Tax Chommie (mytaxchommie.co.za) is the responsible party for personal information processed through the Service. Information Officer contact: support@mytaxchommie.co.za.

• Account data — name, email, phone: to create and secure your account (contract).
• Identity & tax data — SA ID number, tax reference number, date of birth: required to prepare a SARS return (contract / legal obligation).
• Financial documents you upload — IRP5s, payslips, medical and retirement certificates, bank statements — and the figures our AI extracts from them: the core service you ask us to perform (contract).
• Payment data — handled by PayFast; we never see or store your card number. We store the payment reference, amount and plan (legal obligation / contract).
• Usage data — pages viewed, feature usage, device info, error logs: to operate, secure and improve the Service (legitimate interest).
• AI chat messages — stored for 90 days so your conversation survives page reloads, then automatically deleted.

Tax documents can reveal special personal information (e.g. medical scheme membership, disability status used for tax credits). We process it solely to prepare your return, with your consent given when you upload the document, and never for marketing.

• Amazon Web Services — hosting, storage and databases in the af-south-1 (Cape Town) region. AI document analysis and chat run on Amazon Bedrock (Anthropic Claude models); because these models are not yet hosted in South Africa, AI processing of your documents and chat messages currently takes place on AWS servers outside South Africa (European Union and/or other AWS regions) under POPIA section 72 contractual safeguards. Your documents and messages are not used to train AI models and are not retained by the AI provider beyond processing.
• Vercel — hosts the web application front end.
• PayFast — payment processing (PCI-DSS compliant).
• Sentry — error monitoring (technical error data, not your tax documents).
• SARS-registered tax practitioners — on Smart+/Pro, your return data is shared with the practitioner who reviews and files it, under confidentiality obligations.

Some operators process data outside South Africa; where they do, POPIA section 72 safeguards apply (jurisdictions or contracts providing comparable protection).

Data is encrypted in transit (TLS) and at rest. Access is restricted by role (customer / practitioner / admin) and authenticated through AWS Cognito. Documents live in private S3 storage accessible only through time-limited signed URLs. We log and monitor for abnormal access.

• Tax records and filed-return artefacts — kept 5 years, as the Tax Administration Act requires.
• AI chat history — 90 days, then deleted automatically.
• Payment/transaction records — 5 years (financial record-keeping laws).
• Everything else — for as long as your account exists.

You may access, correct, or object to the processing of your personal information, and you may delete your account at any time from Settings → Delete account. Deletion permanently removes your profile, uploaded documents, extracted figures, returns-in-progress and chat history from our systems. Two narrow exceptions are kept because the law requires it: payment/transaction records and copies of returns already filed with SARS (5-year Tax Administration Act retention). You can also email support@mytaxchommie.co.za to exercise any right. If you are unsatisfied with our response you may complain to the Information Regulator (South Africa) — enquiries@inforegulator.org.za.

We do not sell personal information. We send service emails (payment confirmations, filing updates); marketing email only with an unsubscribe link. The web app uses strictly-necessary storage for login sessions and preferences, plus privacy-respecting analytics. The Service is intended for taxpayers 18 and older.

We will notify you by email or in-app of material changes to this policy at least 14 days before they take effect.