Effective Date: 13 September 2026
Grey Analytics ("we", "our", or "us") is an AI-assisted financial document analysis web application for South African businesses and their authorised accountants. This Privacy Policy explains how the Grey Analytics application collects, uses, shares, protects, retains and deletes personal and financial information in accordance with applicable South African data-protection law, including POPIA.
By creating an account or uploading business documentation, you acknowledge the processing practices described here. Where consent is the appropriate legal basis, we will request it through the application.
Account Information: Business name, designated representative name, email address, role, and contact phone numbers (specifically WhatsApp numbers for automated leak notifications).
Google Sign-In Information: If you choose Sign in with Google, we may receive the basic account information Google makes available for authentication, such as your email address, display name, profile image and Google account identifier. Grey Analytics does not receive your Google password.
Financial Documentation: Bank statements, accounting exports (Xero, Sage, QuickBooks), payroll spreadsheets, and invoice imagery uploaded for analysis.
Extracted Telemetry: Anonymized line items, transaction amounts, debtor days, and tax compliance indicators extracted via our Siphon Cypher pipeline.
Grey Analytics accounts may be created and accessed using an email address and password or, where enabled, through Google OAuth. Authentication is handled through our managed authentication provider. Passwords are never stored in readable form by Grey Analytics, and Google credentials are entered with Google rather than shared with Grey Analytics.
Information received from Google is used only to authenticate you, create or identify your Grey Analytics account, maintain your session, prevent unauthorised access and support account functionality. We do not sell Google account information or use it for unrelated advertising.
Original documents are stored in a private Supabase Storage bucket and access is scoped to the signed-in account. Data is transmitted over HTTPS. Encryption at rest and transport security are provided by the configured hosting and database providers; Grey Analytics does not claim a specific cipher, TLS version, or data region beyond the deployed providers' verified configuration.
Financial records and analysis telemetry are maintained only for the duration required to generate your audit assessments and maintain your alert historical trails.
Using Delete my account requests immediate deletion of private original documents followed by deletion of the account and its linked uploads, reports, alerts, settings, and audit records. If storage deletion fails, account deletion stops and reports the failure instead of claiming completion. No automatic 30-day purge schedule is currently claimed.
Supabase: authentication, database, and private original-document storage.
Google: optional OAuth identity provider when you choose Sign in with Google.
Groq: AI inference for extraction, specialist analysis, summarisation, and report narrative generation. Extracted financial text may be sent to Groq when an AI operation is requested.
Twilio: WhatsApp delivery when that channel is configured and enabled.
Resend: email delivery when that channel is configured and enabled.
Cloudflare: application hosting when the included Cloudflare deployment target is used. The actual deployment operator must keep this list aligned with its live configuration.
We use account and document information to authenticate users, provide document extraction and AI-assisted analysis, generate reports, apply usage limits, deliver enabled notifications, prevent abuse, diagnose failures, and comply with legal obligations.
We do not sell personal information. We do not use uploaded financial documents or Google account information for unrelated advertising.
Subject to applicable law, you may ask whether we hold your personal information, request access or correction, object to certain processing, withdraw optional notification consent, or request deletion.
You may also lodge a complaint with South Africa's Information Regulator. We may need to verify your identity before completing a privacy request.
Grey Analytics uses authentication and application storage required to keep users signed in and preserve product state. The service is intended for business users and is not directed to children.
We may update this policy when our services or legal obligations change. Material changes will be published on this page with a revised effective date.
For inquiries regarding POPIA access requests, data corrections, or permanent account deletion, please reach out to our legal compliance desk at privacy@greyanalytics.co.za.