Privacy Policy

Who this notice is about

O-IBS is a South African enterprise, registration number 2026/798906/07. This draft covers the marketing website and describes the separate application’s information handling at a general level. Information Officer details and an approved privacy channel remain outstanding. The final notice must confirm the respective legal roles of O-IBS, customers and service providers.

Information and why it is used

The application may process account identifiers, contact details, company settings and membership to provide access and support business workflows. Customer and supplier details, quotes, invoices, receipts, payments and other records support the business tasks you choose to carry out. Enter only information needed for those tasks. The final notice must confirm purposes and applicable lawful grounds.

Enquiries and support

The Contact preview asks for your name, company, email, subject/category and message to help prepare an enquiry. It does not ask for a phone number. An enabled email submission service would use those details to handle your enquiry; online sending is enabled only after its backend has been configured and tested. When the forms are disabled, entries stay on the page and are not sent. When enabled, an isolated marketing service validates the details and sends an internal email through Resend for O-IBS to review and reply. Submissions do not create an account, company or subscription. Support requests are handled by email at support@o-ibs.co.za. The early-access application preview asks for name, business name/email/type, approximate employee count, areas of interest, plan and an optional message. The prepared service keeps only short-lived keyed hashes and abuse counters in memory, not application/enquiry text on disk. Duplicate-check metadata expires after 23 hours; rate counters expire within at most 24 hours. All memory metadata disappears when the service restarts. Resend retains email retry keys for 24 hours to prevent duplicate sending across restarts. The submitted details are included in the email handled by Resend and the receiving mailbox. Email-provider and mailbox retention/deletion arrangements still require confirmation in the reviewed notice before activation. Do not put confidential financial records in the preview.

Bank account data

When you choose to connect your bank account, we use Banklink to retrieve your account number and transaction history from your bank. Banklink processes this information on our behalf as our operator under the Protection of Personal Information Act, 2013.

If you connect your account for ongoing access, Banklink stores your online banking login details in encrypted form so we can retrieve new transactions until you ask us to disconnect your account. If you share your data once, Banklink uses your login details only for that retrieval and does not store them or your transactions.

We use this information to provide bank feed integration in the O-IBS application. You can withdraw your consent at any time by contacting support@o-ibs.co.za. Banklink’s privacy policy is available at https://banklink.co.za/privacy.

Uploaded business documents

Documents may contain personal or confidential information, such as customer names, line items and business instructions. Application access to stored documents is checked against company and feature permissions. This marketing site has no document upload. Storage locations, provider arrangements, retention and deletion must be documented for the released service.

Bizzy and assisted document reading

Where enabled, AI may process your Bizzy request and details you include to interpret what you want to find or prepare. Assisted requisition reading may process document text, images or PDF pages to extract information for review. The AI & Data Use page explains scope and limitations. Website demonstrations are fictional and do not call AI services.

Technical and security records

Hosting and application services may process request, error, access, session and security-event records to operate and protect the service. Records may include network identifiers and timestamps. The final policy must confirm fields, providers, access, purposes and retention. This website includes no advertising trackers, analytics scripts or third-party fonts.

Cloud providers and international processing

Hosting, storage, email and AI services can process information on O-IBS’s behalf or under their applicable terms. The current AI implementation supports OpenAI when configured. The final notice must identify enabled providers, contractual roles, locations and any international-transfer arrangements. We do not claim that all information remains in South Africa.

Keeping and deleting information

Retention should follow the information’s purpose, applicable record-keeping duties and approved agreements. Deletion requests may be subject to lawful retention and backup handling. No fixed retention period or automatic deletion promise is asserted here. An approved retention schedule and operational request process are required.

Security principles

The application uses authenticated access, company permissions and document-access checks. Users should protect credentials and limit access to authorised people. Safeguards reduce risk but do not guarantee that incidents cannot occur. Operating controls and provider arrangements require review; this is not a security certification.

Access, correction and other privacy requests

Access, correction, deletion or objections may be available depending on the circumstances and applicable law. Requests need an approved channel and proportionate identity checks. A customer company may need to handle requests relating to records it entered. The final notice must explain the responsible contact, restrictions and escalation route.

Changes and questions

The reviewed policy should identify its effective date and how material changes are communicated. This draft is dated 7 October 2026 and is not an approved final policy. General privacy questions can be emailed to support@o-ibs.co.za. Formal privacy procedures and Information Officer governance remain outstanding.