Privacy Policy

Last updated 21 September 2026

Xinnace Reports is a client-reporting platform operated by Xinnace (Pty) Ltd, trading as Xinnace (“we”, “us”). This policy explains what personal information the platform holds, why it holds it, and what happens to it — in the terms of South Africa’s Protection of Personal Information Act (POPIA). Questions about anything here go to accounts@xinnace.co.za.

Two roles, two documents

The platform holds two different kinds of personal information, and our responsibility differs between them.

• Information about you and your account — your name, email address, sign-in activity, and billing details. For this, Xinnace is the responsible party, and this policy is the document that governs it.
• Information inside the data a client uploads — for example the names and performance figures of a client’s own staff. For this, the client is the responsible party and Xinnace is an operator processing it on their instruction. That relationship is governed by our Operator Policy.

What we collect

Account information

Your name and email address, provided when your organisation’s administrator invites you. Passwords are stored only as one-way hashes; nobody at Xinnace can read them.

Activity records

The platform keeps an audit trail: sign-ins, failed sign-in attempts, password changes, permission changes, uploads, and every report opened — each with the date, the IP address, and the browser it came from. When a report is opened, the specific version viewed is recorded. These records exist so that a client can always establish who saw what, and when. They are kept for 24 months and then deleted, except for entries that are themselves a record of something consequential — an invoice raised, a client’s data destroyed, or Xinnace staff working inside a client’s account — which are kept as long as the record they belong to.

If you enquire about the service

When someone at an organisation asks us about reporting, we keep a record of that conversation so that what was discussed is not lost between the enquiry and the work: the organisation, the name and email address of the person we spoke to, what they asked for, and notes on what was established. We do not buy contact details, and we send no marketing.

If the organisation does not become a client, that record is deleted after 24 months without contact. If it does, the record is kept for as long as they are a client, because it is the reasoning behind the reports they receive. You can ask us at any time what we hold from such a conversation, or ask us to delete it.

If you email a file to us

A client can be given an address to email their data to. When a message arrives at one, we keep a record of it: the address it came from, the subject, the name of the attached file, and what we did with it. We do not keep the body of the message — only the attachment, which is treated exactly like an uploaded file.

We keep that record even when the message was refused, and even when it was sent to an address that does not exist here. That is deliberate: it is the only thing that can answer “we emailed it and nothing happened”. It does mean we hold the address of anyone who writes to one of these addresses, including somebody who reached it by mistake.

To establish that a message really came from where it says, we look up the sending domain’s published SPF record in the public DNS. That is a lookup of the domain, not of the sender.

Billing information

For the client organisation: a billing contact and email address, and the invoices we have issued. We do not collect or store card numbers or bank account details from you.

What we use it for

• Delivering reports to the people named to receive them, and nobody else
• Securing accounts — including IP restrictions a client’s administrator configures
• Invoicing and payment follow-up
• Investigating problems and misuse, using the audit trail
• Meeting legal obligations

What we do not do

There is no advertising on the platform, no analytics or tracking scripts, no profiling, and no sale or sharing of personal information for anyone else’s purposes. The platform sends no marketing email.

Cookies and browser storage

The platform sets four cookies, all functional:

• a session cookie, which keeps you signed in for as long as you are using the platform
• a security token cookie, which protects forms against forgery
• if you tick Remember me when signing in, a sign-in cookie that keeps you signed in on that browser after the session ends. It is set only if you tick the box, and signing out removes it.
• ix-theme, which remembers whether you chose light or dark mode

Your browser also stores two preferences locally: your light or dark choice, under the same name, so a report opened in its own window matches the rest of the platform; and, under ix-nav, whether you collapsed the side menu. Nothing else is stored in your browser.

None of this tracks you, and there are no third-party cookies.

Who else touches the data

• Hosting — the platform and its databases run on a dedicated server in South Africa.
• Email — notifications and invoices are sent through Google Workspace, which may process email outside South Africa under Google’s own safeguards.

Typefaces are served from this platform, not from Google Fonts. Opening a page — including a report — asks nothing of any third party, so nobody outside Xinnace learns that you read it, or from where.

No other third party receives personal information from the platform.

How it is protected

• Every client’s data is held in its own database, separated by the database engine itself
• Report files are stored outside the web root and have no public URLs — nothing is reachable without signing in
• All traffic is encrypted in transit (HTTPS)
• Passwords are hashed, never stored or transmitted in readable form
• Access can be restricted to a client’s own networks by IP
• Actions taken by Xinnace staff while assisting inside a client’s account are recorded against the staff member who took them

How long we keep it

Activity records are kept for 24 months, and enquiry records for 24 months without contact, as described above. For everything else:

While a client’s account is open, their data is retained. The figures from every successful upload are kept as a version history, so an earlier version of a report can always be opened again — shown in the report’s current design — or exported. Each report keeps one saved page, its newest.

Uploaded files are kept while they are useful as files: the ten most recent for each report, together with any file still being processed and the file behind the figures a report currently shows. Older files are deleted; the figures they brought in stay in the version history. A file read in a client’s own export layout is converted into the report’s columns while it is processed; that working copy is deleted when the import finishes, or within a day if the run is interrupted.

Records of messages emailed to an intake address are kept for 24 months where the message fed a report — they are part of that report’s history, and say who sent the figures. A message that fed nothing, including one sent to an address that does not exist here, is kept for 3 months and then deleted: long enough to answer a question about a delivery, and no longer, because it is somebody’s email address and we have no continuing reason to hold it.

Everything is backed up nightly, and each backup is kept for 14 days. A copy is held off-site, in object storage in Cape Town, on separate infrastructure from the server and still inside South Africa.

When a client’s account is closed, everything is retained for 90 days — during which closure can be reversed — and then permanently destroyed: the client’s database is deleted and their stored files are removed. Copies in the nightly backups age out within 14 days after that, and the off-site copies they leave behind are permanently destroyed within a further 60 days. Invoices we have issued are retained as financial records, as the law requires.

Your rights

Under POPIA you may:

• ask what personal information we hold about you, and receive a copy
• ask for it to be corrected or, where we have no duty to keep it, deleted
• object to processing
• complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za

Access to records more broadly is governed by our PAIA Manual, published under section 51 of the Promotion of Access to Information Act.

Requests go to accounts@xinnace.co.za. Where the information sits inside a client’s uploaded data, we will refer the request to that client, who is the responsible party for it.

If something goes wrong

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected parties as POPIA requires, and tell affected clients what happened, what was involved, and what we are doing about it.

Changes

If this policy changes, the date at the top changes with it, and clients are told about any change that matters before it takes effect.