Privacy Policy

We collect information in the following ways:

• Information you provide directly: When you register for an account, we collect your name, email address, business name, and billing information. When you contact us, we collect the contents of your message and any attachments.
• Financial data you upload: To deliver our service, we process transaction records, invoices, bank statements, and other financial documents you import or connect to ReconAgent.
• Usage information: We automatically collect log data, device information, browser type, IP address, pages visited, and features used when you interact with the Service.
• Cookies and similar technologies: We use essential cookies for authentication and session management, and analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your financial data and generate reports, reconciliations, and insights
• Send transactional emails (account confirmations, invoices, security alerts)
• Respond to your support requests and enquiries
• Improve and develop new features through aggregated, anonymised usage analysis
• Detect, investigate, and prevent fraudulent or unauthorised activity
• Comply with legal and regulatory obligations

We do not sell your personal information or financial data to third parties, and we do not use your financial data to train AI models without your explicit consent.

We process your personal information on the following legal bases under the Protection of Personal Information Act (POPIA) and applicable data protection law:

• Performance of a contract: Processing necessary to provide the Service you have subscribed to.
• Legitimate interests: Analytics, fraud prevention, and service improvement — balanced against your rights.
• Consent: For optional communications such as product updates and marketing, which you may withdraw at any time.
• Legal obligation: Where we are required to process data to comply with applicable law.

We share your information only in the following circumstances:

• Service providers (processors): We engage the third-party vendors listed below, who process data on our behalf under confidentiality and data-protection obligations. We name each one, what it does and where it processes data, so you can see where your information goes.
• Business transfers: If Requent is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you in advance.
• Legal requirements: We may disclose information when required by law, court order, or to protect the rights and safety of Requent, our users, or the public.

Our processors:

• Supabase — database, sign-in (authentication) and file storage for your account, documents and accounting records. Where: AWS Europe (Paris, France).
• Amazon Web Services (AWS) — hosting and compute for ReconAgent, operational logs and content delivery. Where: Compute and logs in Europe (Paris, France); content delivery from AWS edge locations worldwide.
• Google (Gemini API) — AI extraction, classification, matching and the ReconAgent assistant; documents, bank statement lines and the accounting records the agent reads are sent to it (see AI processing below). Where: United States and other Google locations; not tied to a single region.
• Postmark (ActiveCampaign) — delivery of transactional email such as invoices, documents, account confirmations and security alerts. Where: United States.
• PayFast — payment processing for your ReconAgent subscription. Where: South Africa.
• PostHog — product analytics, error reports and, with your consent, masked session recordings (section 9). Where: EU (Frankfurt, Germany); PostHog Inc. is a United States company.

Where you connect your own payment gateway account so that your customers can pay your invoices, you are the responsible party (controller) for those customer payments and we process the related data on your behalf.

AI processing (Google Gemini). ReconAgent uses AI to read your documents and to propose how they are coded, matched and reconciled. To do this we send the content you ask us to process (receipts, bills and other documents, including PDFs, and bank statement lines), your questions, and the related accounting records the agent reads to propose a result (such as open invoices and the customers on them, ledger accounts, and ledger entries) to the Gemini API from Google, and we receive the extracted or proposed result back. The agent also runs in the background, on items nobody asked about one by one, and that processing sends the same kinds of data. We use Google's paid API service, and under Google's terms for that service content sent through the API is not used to train Google's models. Google retains API content for a limited period for abuse monitoring under its API terms; we do not control that period, and it is set out in Google's terms rather than here. Because the documents and statement lines you upload can contain personal information about your customers, suppliers and staff, please upload only what you are entitled to share with us.

Cross-border transfer (POPIA section 72): your primary data is stored with Supabase and hosted on AWS in Paris, France, and is processed there by our services. Postmark (email delivery) and Google (AI processing) are United States companies and process data outside South Africa and outside the EU; Google's processing is not tied to a particular region. Supabase and Amazon Web Services are also United States companies; the Paris hosting rests on the same assessment, and carries the same caveat, as PostHog in section 9. We rely on our agreements with these processors and send them only what each task needs.

We retain your personal information and financial data for as long as your account is active. When you request deletion, your account is locked for a 30-day grace period — sign in during that window and choose Restore to bring your account and data back (your subscription is cancelled immediately and restoring means resubscribing). If you take no action, your personal information, AI conversation history, and notification and communication data are permanently deleted after 30 days. Your accounting records (invoices, journals, payments, allocations, bank transactions and source documents) are retained for a further seven (7) years, as required by section 24 of the Companies Act 71 of 2008 (which also covers the shorter period the Tax Administration Act requires) — locked and hidden from everyone except authorised Requent staff, and only where the law requires us to produce them — and are permanently purged once that period ends. Full detail: Account Deletion policy.

We implement technical and organisational measures appropriate to the risk, including:

• Encryption in transit using TLS 1.3 and at rest using AES-256
• Role-based access controls and multi-factor authentication for internal systems
• Regular security assessments and vulnerability testing
• Incident response procedures with notification timelines aligned to POPIA requirements

No transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention obligations)
• Object to processing based on legitimate interests
• Withdraw consent for marketing communications at any time
• Data portability — export your data in a machine-readable format

To exercise any of these rights, email us at info@requent.co.za. We will respond within 30 days.

To delete your account and personal information, use Settings → Delete account inside the app, or visit our Account Deletion page to request deletion by email. See that page and section 5 above for what is deleted immediately, what is retained and for how long, and how to change your mind within the 30-day grace period.

We use the following categories of cookies:

• Essential cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand how the Service is used so we can improve it, plus the ra_analytics_consent cookie described in section 9 below, which records your own accept/decline choice.

We do not use third-party advertising cookies.

We use PostHog (PostHog Inc.) as our analytics processor for both ReconAgent (recon.requent.co.za) and our marketing website (www.requent.co.za), on the same PostHog project. Our PostHog project is hosted on PostHog Cloud EU (Frankfurt, Germany).

What PostHog collects in ReconAgent: pages viewed, clicks and other interactions (on-screen text and attribute values are masked before capture), device and browser information, your account and business (tenant) identifiers once you are signed in, product usage events (e.g. a reconciliation match, a report export), and error reports.

What PostHog collects on the marketing website: pages viewed, clicks (masked the same way), scroll and time-on-page, which call-to-action or contact-form field you interacted with, and web vitals (page-load performance). The website never records a session replay.

Linking your website activity to your account. PostHog also sets its own identifier in a cookie shared across both sites. This means that once you have signed in to ReconAgent in a browser, your marketing-website page views and clicks in that same browser are linked to your account — including earlier, anonymous visits to the website, which are merged in at the moment you sign in. If you would rather your website browsing was not linked to your account, use a different browser (or a private/incognito window) for one or the other, or decline analytics as described below.

Session recordings — ReconAgent only, never the marketing website — are captured only with your consent, given through the banner shown on your first visit or reopened at any time via "Analytics preferences" (below, and in the site footer). Every recording masks all on-screen text and all input values, and recordings are never captured on banking, reconciliation, general ledger, or report screens, regardless of consent.

One consent choice covers both sites. Your accept/decline decision is stored in a cookie named ra_analytics_consent, shared between requent.co.za and recon.requent.co.za (set on the parent domain, requent.co.za), so declining on either site stops analytics collection on both, for 12 months, and changing your mind on one site changes it on the other too, the next time either site loads. If you made this choice in ReconAgent before this shared cookie existed, it is carried over automatically the next time you visit ReconAgent in that browser — until then, the website treats you as not yet having decided.

Retention: session recordings are kept for 30 days; analytics events are kept for up to 12 months. Opting out: use the consent banner or the "Analytics preferences" control at any time — declining stops further collection from your browser, including session recordings; any event already queued in your browser at the moment you decline may still be sent (there is no way to recall network traffic in flight).

Server-side error and usage events tied to your account (not session recordings — these never involve your browser or device storage) continue on the legitimate-interests basis described in section 3, because they are first-party service telemetry needed to operate and secure the Service; they are disclosed here rather than gated by the banner.

Cross-border transfer (POPIA section 72): we consider the EU GDPR to provide protection substantially similar to POPIA, which is why our PostHog project is hosted there. This is our own assessment, not a recognition published by South Africa's Information Regulator. PostHog Inc. is a United States company, so — even though the data is hosted in the EU — US authorities could in principle seek access to it under US law (e.g. the CLOUD Act). We state this plainly rather than imply an immunity no vendor can guarantee.

Analytics preferences

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice within the Service at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your information in accordance with POPIA. Contact us first — we would like the opportunity to address your concern.