Privacy notice
Last updated: August 2026
Who we are
Cost InSight is a product of Maribo Softwares (Pty) Ltd (registration number 2020/755292/07), a private company registered in South Africa, which is the "responsible party" under POPIA for the processing described in this policy.
Cost InSight ("we", "us") provides white-label accounting software to bookkeeping and accounting practices ("practices") in South Africa, who in turn provide it to their own clients ("client entities"). This policy explains how we collect, use, and protect personal information when you use Cost InSight, whether you are a practice user or a client-entity user accessing a practice's branded instance.
What we collect
- Account information: name, email address, and role, for every user we create or that a practice invites.
- Company and client-entity information: trading name, VAT number, address, and banking/accounting records entered into the product (invoices, bills, payments, journal entries).
- Usage and security data: sign-in timestamps, IP address, and audit-trail entries for actions taken in the product (already built into Cost InSight's audit log).
- Uploaded files: logos, attachments to invoices/bills, and imported bank statements.
Why we collect it
- To provide the accounting service itself — books, invoicing, VAT201 reporting, and the other features you use.
- To authenticate users and protect accounts (passwords are hashed, never stored in plain text; multi-factor authentication is available).
- To maintain the audit trail required for reliable financial record-keeping.
- To send transactional email: verification links, password resets, invoices, and invoice/quote reminders you or your practice send through the product.
- To respond to support requests.
We do not sell personal information, and we do not use it for unsolicited marketing (see POPIA s69 — we don't send unsolicited electronic marketing at all).
Where your data is hosted
Cost InSight is hosted on Microsoft Azure, in the South Africa North region. Your data stays in South Africa; it is not transferred out of the country as part of normal operation.
Who we share data with
We use two categories of third-party processor ("operators" under POPIA):
- Microsoft Azure — hosting infrastructure (compute, database, backups).
- Microsoft Azure Communication Services — sends verification, reset, and notification emails on our behalf, with data residency in Africa (covered by the same Microsoft data-processing terms as our hosting).
We do not share your data with any other third party except where required by law, or with your practice (a client entity's data is visible to the practice that administers it, as part of the accounting relationship you have with them).
Your rights
Under POPIA, you have the right to:
- Ask what personal information we hold about you.
- Ask us to correct or delete inaccurate or outdated information.
- Object to processing you believe is unlawful.
- Complain to the Information Regulator (South Africa) if you believe your rights have been infringed.
To exercise any of these rights, contact our Information Officer — see the POPIA notice for full contact details and processing purposes.
Data retention and security
We retain accounting records for as long as your account is active and as required by South African tax and companies legislation. We use encryption in transit, hashed passwords, and role-based access control; administrative and audit actions are logged.
Changes to this policy
We'll update the "last updated" date above whenever this policy changes materially.
Contact
Questions about this policy: hello@costinsight.co.za.
Maribo Softwares (Pty) Ltd, registered in South Africa.