Privacy policy

How Tjommie collects, uses and protects your personal information under South Africa’s Protection of Personal Information Act (POPIA). Last updated 22 October 2026.

Who we are

Tjommie is a money assistant that reads the bank statements you upload and shows you where your money goes. For POPIA, Tjommie is the responsible party for your information. Our Information Officer is Morné Augustyn, reachable at morne@basilei.com.

What we collect

Your account: your email address, your password (stored only as a one-way scrambled version, never readable), your name if you add it, and when you agreed to these terms.
Your statements: the bank name, the account type with the last 4 digits of the account number, the statement period, balances, and each transaction’s date, description, amount and category. Long numbers in descriptions are masked to their last 4 digits.
What you add yourself: investment values, assets and debts, credit scores and the account summary from a credit report, your budget, payday and settings.
If you ask for a call back: your name and phone number, which we pass to the partner you chose.
Usage logs: a record of uploads and questions, kept for 7 days to enforce daily limits.
If you join the early-access list: your email address, which page you signed up on, and when. We use it only to tell you when your spot opens and about Tjommie launching. Ask and we'll remove it.

We never collect your banking password, PIN or app login. We don’t store your statement PDFs, your ID number, your full account numbers or your address.

Why we use it

To show you your dashboard, plan, budget, reports and comparisons, and to answer your questions in Ask Tjommie.
To keep your account secure and the service working.
To pass your details to a partner, such as a financial adviser, only when you ask us to.

We rely on your consent, which you give when you create an account, and you can withdraw it at any time by deleting your account. We don’t sell your information, and we don’t use it for advertising.

Who helps us

We use these companies to run Tjommie. Each may only use your information to provide its service to us:

Supabase: our database and sign-in. Stored in London, United Kingdom.
Vercel: hosts the app. App servers in London, United Kingdom; pages are delivered through its global network.
Anthropic (United States): reads uploaded statements and answers Ask Tjommie questions through its business API. It doesn’t use this information to train its models, and deletes it within 30 days unless it’s flagged for misuse or must be kept by law.
Resend (United States): sends account emails such as password resets.

This means your information is processed outside South Africa. POPIA allows this when the receiving country or the company’s binding terms give protection similar to POPIA, or with your consent. By using Tjommie you consent to these transfers for the purposes above.

How long we keep it

Statements and their transactions: 3, 6 or 13 months, as you choose in Settings (13 by default). Older ones are deleted automatically every night.
Your account and what you added: until you delete your account.
Usage logs: 7 days.
Early-access list: until you get access, ask to be removed, or we stop the list.

How we protect it

Encrypted connections, data locked to your account in the database, masking of account and ID numbers, optional two-step sign-in, automatic sign-out and daily limits. Read How we protect you for the details.

Your rights

See it: Settings shows what we keep about you. Ask us for a full copy at any time.
Correct it: edit or remove anything you added, or ask us to correct something.
Delete it: Settings → Delete everything removes your account and all your data immediately.
Object or complain: email us first, and if you’re not happy you can complain to the Information Regulator at inforegulator.org.za.

Changes

If we change this policy in a way that matters, we’ll tell you in the app before it takes effect.

Contact

Questions about your information: morne@basilei.com.