Privacy Policy

Responsible for your data: Monré van der Nest, 67 Grace Avenue, Murrayfield, Pretoria, South Africa, trading as Big4CFO ("we", "us"). Contact: info@big4cfo.com.

What we collect, and why

• Your email address and company name — to send your reports and run your account.
• Payment details are collected and held by Paddle, our Merchant of Record; we never see your card number.
• One-time reports: the bank statements you upload, to produce the report you paid for. Deleted permanently 30 days after upload, and immediately if you are refunded.
• Monthly plans: data read from your accounting system (accounts, transactions, balances), to produce and check your monthly report. Kept while you subscribe.
• Monthly plans: bank and card statements you upload for the monthly bank check. The file itself is never stored; we keep the figures read from it and a fingerprint of the file, which reveals nothing about its contents.
• Reports we have sent you and the figures in them, so you can see past reports and later summaries agree with what you were sent. Kept while you subscribe.
• Your goals, if you set any on your account page.
• Sign-in records: a one-time code that expires in 10 minutes, and a session cookie that ends after 14 days without use.

Cookies

We use one cookie, to keep you signed in, and one that protects your forms from forgery. No advertising or tracking cookies.

Who else sees it

These providers process data only to provide their service to us. Some are in the United States; where data about UK or EU customers is transferred, it is protected by the standard contractual clauses in each provider’s data processing terms.

• Anthropic (Claude, an AI model) reads PDF statements to extract the figures. For an Excel or CSV file, Claude sees the column layout and a few sample rows; our own software reads the rest. Anthropic is the one third party that sees the contents of your documents, and it does not train its models on data sent through its commercial service.
• Paddle processes payments as our Merchant of Record.
• Merge connects to your accounting system for monthly plans, read-only.
• Postmark sends our emails. Supabase hosts our database. Railway runs our software. Netlify serves this website.

What we never do

We never sell your data. We never write anything back to your bank or accounting system. We never use your documents to train AI models.

Aggregate figures

We may add findings from your reports into anonymised public totals — never naming you, never showing your figures alone, and never publishing a total until at least five customers contribute. You can opt out by emailing us.

When you leave

When a monthly plan ends, we delete your account, the data read from your accounting system, your statement figures, your goals and your stored reports 90 days later, or sooner if you ask. One-time report documents are deleted 30 days after upload regardless.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, by emailing info@big4cfo.com. We answer within 30 days.

We process your data to perform our contract with you and, for security and fraud prevention, in our legitimate interests. You can complain to the Information Regulator (South Africa), the Information Commissioner’s Office (United Kingdom), or the data protection authority where you live in the EU.