Legal

Privacy Policy

Effective 28 September 2026 · Last updated 28 September 2026

This policy explains what personal information Outgrown collects, why, where it is kept and what your rights are. It is written to meet South Africa's Protection of Personal Information Act (POPIA) and, for visitors in the EU and UK, the GDPR.

1. Responsible party

Information Officer: Dave Ward — [email protected].

2. The Spreadsheet X-ray: your file never leaves your browser

The X-ray reads your workbook with code that runs inside your own browser tab. The file is not uploaded to us, not stored by us and never seen by us. No AI is involved in the X-ray.

3. What we collect

3.1 If you join early access from the X-ray

Your email address, plus a short summary of the read: the sector you confirmed, a headcount band, how many sheets and rows the file has, and how many of each kind of finding it had. These are counts and totals only — never cell values, names or figures from your file.

3.2 If you email us

Your email address, name and whatever you choose to write.

3.3 If you become a paying customer

Account details (name, email, business name, billing country); your subscription status; and the business data you connect so the service can work — for example accounting totals from Xero for the Monday Number, and the records you load into The Spine. Card and bank details are handled by PayFast or Paddle and are never seen or stored by us.

3.4 Automatically

Standard security and delivery logs kept by our hosting providers (IP address, browser type, time of request). We do not use advertising or tracking cookies.

4. Why we use it

• To tell you when paid plans open and to reply to you (your consent — you can withdraw it at any time).
• To provide the plan you pay for and bill you (performance of our contract with you).
• To keep the service secure and meet legal and tax obligations.

We do not sell personal information, we do not send a newsletter, and we never use your business data to train AI models.

5. Where it is kept

Customer business data is stored on servers in Helsinki, Finland (Hetzner). Business data stored in The Spine is encrypted, and each customer's data is isolated from every other customer's. Because Finland is outside South Africa, this is a cross-border transfer under section 72 of POPIA; we rely on the EU's data-protection law (GDPR) giving protection substantially similar to POPIA and on written agreements with our providers.

6. Who we share it with

If we add a provider that receives personal information (for example an AI model provider for Ask Your Business) we will update this list before it is used.

7. How long we keep it

Early-access sign-ups: until you ask us to remove you, or 24 months without contact. Customer data: for as long as your subscription is active, then deleted within 30 days of cancellation unless the law requires us to keep it (for example billing records, kept for 5 years for tax).

8. Your rights

You may ask to see the personal information we hold about you, have it corrected or deleted, object to its use, or withdraw consent. Email [email protected]; we reply within 30 days. If you are not satisfied you may complain to the Information Regulator of South Africa (inforegulator.org.za) or, in the EU/UK, your local data-protection authority.

9. Security

Connections are encrypted (HTTPS). Access tokens for connected systems are encrypted at rest. Access to customer data is limited to what is needed to run and support the service.

10. Changes

We will post any change here and update the date above; material changes are emailed to customers.