Sign inStart free trial

POPIA notice

Last updated: August 2026

⚠️ Scope check — written for the previous business model.This page describes the earlier practice/channel arrangement (software supplied to bookkeeping practices, priced per client entity). The product now also sells directly to businesses on the Business plan. Both this scope and the placeholders below must be resolved by a professional before launch.
⚠️ Not legal advice — review before launch. This notice was drafted to satisfy the Protection of Personal Information Act (POPIA)'s transparency requirements as a starting point. It has not been reviewed by a lawyer or POPIA specialist, and the Information Officer registration referenced below must actually be completed with the Information Regulator before this notice is accurate. Do not treat this page as final until both have happened.

Responsible party

Maribo Softwares (Pty) Ltd (registration number 2020/755292/07), registered in South Africa, trading as Cost InSight. The registered office address is available on request from the Information Officer below.

Information Officer

The company's founder acts as the default Information Officer.
Email: hello@costinsight.co.za
Registration status: [to be confirmed — register with the Information Regulator at inforegulator.org.za before launch; this is a required, free, non-code launch step — see FR-LGL-003].

What "processing" means here

Cost InSight processes personal information belonging to: (1) practice users (the bookkeepers/accountants who administer the product), (2) client-entity users (the practice's own clients, where they have direct logins), and (3) individuals named in accounting records — e.g. a contact's name and email on an invoice.

Purposes of processing

  • Providing the accounting service: bookkeeping, invoicing, VAT201 reporting, and related features.
  • Account authentication and security (password hashing, multi-factor authentication, session/audit logging).
  • Sending transactional email (verification, password reset, invoice/quote delivery and reminders).
  • Responding to support requests.
  • Meeting South African tax and companies-law record-keeping obligations.

We do not process personal information for unsolicited electronic marketing (POPIA s69) and do not sell personal information to third parties.

Lawful basis

Processing is necessary to perform the contract between Cost InSight and the practice (or client entity) using the product, and to comply with our legal obligations (tax and company record-keeping).

Data-subject rights

Under POPIA, you may:

  • Request confirmation of whether we hold personal information about you, and access to it.
  • Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, or misleading.
  • Object, on reasonable grounds, to the processing of your personal information.
  • Complain to the Information Regulator if you believe your rights under POPIA have been infringed: inforegulator.org.za.

To exercise any of these rights, contact our Information Officer using the details above.

Operators (third parties who process data on our behalf)

  • Microsoft Azure — hosting, in the South Africa North region. A Data Processing Agreement with Microsoft is kept on file.
  • Microsoft Azure Communication Services — sends transactional email on our behalf, with data residency in Africa. Covered by the same Microsoft data-processing terms as our hosting.

Cross-border transfers

Cost InSight is hosted in Microsoft Azure's South Africa North region. Personal information does not leave South Africa as part of normal operation, which keeps this outside POPIA section 72's cross-border transfer requirements.

Security safeguards

Passwords are hashed, never stored in plain text. Multi-factor authentication is available for user accounts. Administrative and data-changing actions are recorded in an audit trail. Access is scoped per tenant so one practice or client entity cannot see another's data.

Retention

We retain accounting records for as long as an account is active and as required by South African tax and companies legislation.