Privacy Policy

Last updated 7 October 2026 · Version 2026-10-07

RowCast helps businesses understand the spreadsheets they already keep. This policy explains what information we collect, why, where it goes, how long we keep it and your rights under the Protection of Personal Information Act, 2013 (POPIA). We've written it to be read, not skimmed past. If anything is unclear, ask us.

Who we are
Our two roles
What we collect
What we don't keep
Why we use it
Who we share it with
AI and transfer outside South Africa
How we protect it
Cookies and browser storage
How long we keep it
Your rights
Security incidents
Changes to this policy

1. Who we are

Operator: Winand Cronje, a sole proprietor trading as RowCast
Email: hello@rowcast.co.za
Website: rowcast.co.za
Information Officer (POPIA): Winand Cronje, hello@rowcast.co.za

2. Our two roles

Your account and billing details: we are the responsible party and decide how this information is used, as described here.
The business data you upload: your business is the responsible party and we are your operator. We process it only to provide RowCast to you, under the operator agreement in our Terms of Service.

3. What we collect

From you

Account: your email address, a password (stored only as a one-way hash, never readable), your business name, currency, industry and settings, whether you've turned on two-step sign-in, and when you accepted our terms and the AI consent.
Your data: only the columns you choose when you upload a sheet, for example dates, amounts and groupings such as branch or product, plus how you labelled them. Columns left on Don't use are never stored.
Notes you add to explain a period, your answers to report questions, and the reports we generate for you.
Messages you send us by email.

Automatically

Security log: account events such as sign-ins, lockouts and settings changes, linked to an internal account number. It never contains your business figures.
Server logs: our web server records requests (IP address, date and time, page requested and browser type) to keep the service secure and working. Repeated failed sign-ins from an address can cause it to be blocked temporarily.

From PayFast

When you pay, PayFast tells us the amount, its payment reference and the result. For monthly plans it also gives us a token that lets us cancel the plan when you ask. We never receive your card details.

4. What we don't keep

We never store your uploaded file. It's read in our server's memory (never written to disk), held there for at most 20 minutes while you confirm your columns, and then discarded. We don't use advertising or analytics trackers, and we don't sell or rent personal information to anyone.

5. Why we use it

To provide RowCast (charts, reports, forecasts, your account, billing and support). This is necessary for our contract with you.
To send AI summaries to Anthropic so reports can be written. This is based on your consent, which you give when you register (see section 7).
To keep RowCast secure: preventing abuse, fraud and unauthorised access. This is in our legitimate interest and yours.
To send service emails: account confirmations, password resets, "report ready" emails, receipts and important changes. You can switch the optional monthly upload reminders off in Settings.
To meet legal obligations, for example tax records and responding to lawful requests.

We won't send you marketing unless you've agreed to it, and every marketing email will let you unsubscribe. Reports help you make decisions, but no decision about you is made automatically by RowCast.

We share personal information only with the service providers we need to run RowCast. Each one is bound to protect it.

xneelo (South Africa): hosts our servers and database in Johannesburg, and our email.
Anthropic PBC (United States): writes the text of reports from a summary of your figures (see section 7).
PayFast (South Africa): processes payments. We give PayFast your email address so it can send you receipts. When you pay, PayFast's own page applies PayFast's privacy policy, including its own cookies and security checks.

We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a sale of the business (the buyer would be bound by this policy).

7. AI and transfer outside South Africa

To write a report, we send Anthropic PBC (the company behind the Claude AI) a summary of your figures and your notes, and Anthropic processes it in the United States. The summary contains totals, changes, trends and forecasts.

We never send your raw rows or your file.
Grouping values you mark "hide from the AI", such as customer names, are replaced with stand-ins like "Customer 3" before anything is sent.
Under Anthropic's commercial terms, it may not use this content to train its AI models. It deletes it within 30 days, keeping it only that long for safety and abuse monitoring.

This transfer happens with your consent, which you give when you register (POPIA section 72). Without it we can't write reports, but you can still upload data and use the dashboard.

Everything else, including your account, your data, your reports and our backups, is stored in South Africa.

8. How we protect it

Encryption at rest: your business name, data, notes and reports are encrypted in our database (AES-256-GCM), with the keys kept separately from it. Backups are encrypted too.
Separation: each business's data is isolated from every other business's.
Connections: all traffic uses HTTPS (TLS 1.2 or 1.3).
Accounts: passwords must be at least 12 characters, accounts lock after repeated wrong passwords, and two-step sign-in is available.
Limited access: our admin tools show only platform totals (for example, how many reports were generated). We don't view your data.

No system is perfectly secure, but we work hard to keep your information safe and review our measures regularly.

9. Cookies and browser storage

We use only what's needed to run RowCast. There are no advertising or tracking cookies.

Sign-in cookie: keeps you signed in.
Security cookie: protects forms against forgery.
Remember-this-browser cookie: set only if you choose it at two-step sign-in.
Browser storage: your browser remembers your light or dark choice, and whether you hid the getting-started checklist. This stays on your device.

10. How long we keep it

Account, data and reports: kept while your account is open. You can delete any upload or report at any time.
When you close your account: your account and business data are deleted from our live database immediately, and from our encrypted backups within 14 days.
Server logs: 14 days.
Security log and payment notification records: 12 months.
AI summaries at Anthropic: deleted within 30 days (see section 7).
Payment records needed for tax purposes: kept by PayFast and in our accounting records for 5 years, as the law requires.
Emailed reports: if you ask us to email you a PDF copy, that copy lives in your mailbox, which we don't control. We send it only to your own confirmed address.

11. Your rights

Under POPIA you may:

ask whether we hold personal information about you, and for a copy of it (Account & security › Personal data lets you download it yourself);
ask us to correct or delete it (you can delete data and your account yourself in RowCast);
object to processing, or withdraw your AI consent (we then can't write reports for you);
refuse direct marketing; and
complain to the Information Regulator (inforegulator.org.za).

To use these rights, email our Information Officer at the address in section 1. We may need to confirm your identity, and we'll respond within a reasonable time, normally 30 days. If you're asking about data a business uploaded to RowCast, please contact that business first. We'll help them respond.

12. Security incidents

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires. We'll tell you what happened and what you can do.

13. Changes to this policy

We'll update this policy when our practices or the law change. For important changes we'll email you before they take effect. The date at the top shows when it last changed.