Privacy Policy

This Privacy Policy explains how Major Bean (“Major Bean”, “we”, “us”), operated by Accounting Café, collects, uses, and protects personal information when you use our practice-management platform (the “Service”). We are committed to handling data in line with the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the EU/UK GDPR.

1. Who this applies to

This policy applies to the accounting and audit firms who subscribe to Major Bean (“firms”), the individual users within those firms, and the client and contact information those firms manage in the Service. Each firm is the responsible party (data controller) for the client data it processes in Major Bean; we act as an operator (data processor) on their behalf, in addition to being responsible party for our own account and billing data.

2. Information we collect

• Account information — name, email, password (hashed), role, and firm details you provide when registering.
• Firm and client records — the client, contact, task, document, and workflow information you create in or upload to the Service.
• Data from connected platforms — where you connect Xero, Sage, QuickBooks, or Google Workspace, we access only the data needed for the feature you use (for example, your customer/contact list for client import). We never receive your login credentials for those platforms — authorisation happens on their own sign-in pages.
• Billing information — subscription plan and payment status. Card details are handled by our payment processor (Stripe) and are not stored on our servers.
• Usage and technical data — log data, IP address, device/browser information, and activity within the Service, used for security and to operate the platform.

3. How we use information

• To provide, maintain, and improve the Service and its features.
• To authenticate users, secure accounts, and prevent misuse.
• To process subscriptions and communicate service, billing, and support messages.
• To send product updates or announcements (you can opt out of non-essential email).
• To comply with legal and regulatory obligations.

We do not sell your personal information, and we do not use your data or your clients’ data to train machine-learning models. Where AI features are used, data is sent to our AI provider only to generate the response you requested and is not used to train their models.

4. Service providers (operators / sub-processors)

We use trusted third parties to run the Service. Each is bound to protect your data and process it only on our instructions:

• DigitalOcean — cloud hosting and storage.
• Stripe — subscription payments.
• Anthropic — AI features (Claude), used for inference only.
• Email delivery provider — transactional and notification email.
• Xero, Sage, QuickBooks, Google — only when you choose to connect them, and only for the data you authorise.

5. International transfers

Some providers process data outside South Africa. Where personal information is transferred across borders, we take reasonable steps to ensure it receives a comparable level of protection as required by POPIA and applicable law.

6. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter only as required for legitimate business or legal purposes. You may request deletion of your data (see “Your rights”). On account closure, we delete or anonymise your data within a reasonable period, subject to legal retention requirements.

7. Security

We apply appropriate technical and organisational safeguards, including encryption of data in transit (HTTPS), enforced two-factor authentication, role-based access, network controls, and regular backups. No system is perfectly secure, but we work to protect your information and to notify affected parties and regulators of a material breach as required by law.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, object to certain processing, and lodge a complaint with a supervisory authority (in South Africa, the Information Regulator). To exercise these rights, contact us at peter@accountingcafe.co.za. If your request relates to client data held by a firm, we will refer you to, or act on the instructions of, that firm.

9. Cookies

We use essential cookies to keep you signed in and to operate the Service securely. We do not use advertising or third-party tracking cookies.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified within the Service or by email, and the “last updated” date above will change.

11. Contact

Questions about this policy or your data: peter@accountingcafe.co.za.