Privacy Policy

Claimer ("Claimer", "we") is a South African expense-ops platform. We are the responsible party for personal information you provide while using the service. This notice explains what we collect, why, how long we keep it, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).

• Identity & contact data: name, work email, phone, employee number, job title, department.
• Financial data you submit: receipt images, expense amounts, VAT details, mileage, banking last-four (for reimbursement reference only).
• Authentication & security: bcrypt-hashed passwords, session metadata (IP, user-agent), audit logs of admin actions.
• Device telemetry: app version, error reports (no PII attached).

To process your reimbursement claims, prove they happened (SARS audit trail), notify you of status changes, and detect fraud or policy violations. We do not sell your data and we do not use it for marketing without your explicit opt-in.

• Receipts and tax records: 5 years from submission, per SARS requirements.
• Account data: until you delete your account. After deletion we soft-delete and scrub PII within 30 days.
• Session and audit logs: 12 months.

You can access, correct, or delete your personal information at any time. Use GET /api/users/me/export to download everything we hold about you, or delete your account from your profile settings. We respond to written requests within 30 days.

We use TLS in transit, encryption at rest (Postgres, R2), bcrypt cost-12 for passwords, JWTs for short-lived sessions with revocable refresh tokens, rate limiting on auth endpoints, and account lockout after 10 failed sign-ins. Receipt images live on Cloudflare R2 behind short-lived presigned URLs only.

Questions? Reach our Information Officer at privacy@claimer.co.za. You may also lodge a complaint with the South African Information Regulator at inforegulator.org.za.