Privacy Policy

FinVeil is operated by FinVeil (Pty) Ltd (CIPC 2016/369600/07), a private company registered in South Africa, with its registered office in Midrand, Gauteng. FinVeil is the responsible party under the Protection of Personal Information Act, 2013 (“POPIA”) for all personal information processed through the FinVeil platform on behalf of employer customers.

FinVeil processes the following categories of personal information on behalf of employer customers:

(a) Payroll records

Gross pay, net pay, deduction line items (garnishees, loan repayments, insurance premiums, pension contributions), pay period dates, and source file integrity hashes uploaded by the employer.

(b) Payment transaction data

Disbursement and salary-advance transaction references, amounts, payment statuses, and Paystack payment identifiers generated when processing payments through the platform.

(c) Tax calculation inputs

Salary band classifications, tax bracket indicators, and deduction categories used to compute tax estimates. FinVeil does not submit returns to SARS on any person's behalf.

(d) Employment verification tokens and Merkle anchors

Cryptographic verification tokens issued to prove employment status, salary band, or tenure, together with Merkle tree root hashes anchored for tamper-evidence. Verification tokens contain only the minimum claim required and expire after a defined period. Merkle root hashes are 32-byte values that contain no personal information.

(e) Consent records

Consent status (pending, granted, or revoked), the date and time consent was granted or revoked, and the POPIA consent version accepted by each data subject. Consent records are retained independently of the underlying data to satisfy audit requirements.

(f) Feedback data

Voluntary feedback submitted by platform users, including satisfaction ratings, free-text comments, and associated metadata (user role, submission timestamp). Feedback is used solely to improve the platform and is not shared with third parties.

(g) Analytics and benchmarking aggregates

Department-level trend aggregates derived from payroll data. Stress scores, risk levels, and predicted productivity-loss estimates — only when the Wellness Suite product is subscribed. These analytics are presented to employer administrators only and are never sold or shared outside the employer's tenancy.

Employee identifiers

Name, employee reference, department, job title, salary band, and employment start date as provided by the employer.

FinVeil processes personal information under the following lawful bases recognised by POPIA:

• Consent — obtained by the employer from the data subject (employee) prior to data upload. Consent status is tracked per employee and may be revoked at any time.
• Legitimate interest — where the Wellness Suite product is subscribed, employer workforce analytics to identify financial-stress risk and implement interventions, where the benefit to employees and employer materially outweighs any privacy impact.
• Legal obligation — processing required by SARS, SARB, or POPIA compliance requirements.

Personal information is encrypted at rest using AES-256-GCM with per-field authenticated encryption. Access is gated by JWT-based authentication and row-level-security tenant isolation. Every access is audit-logged and retained for at least 12 months.

FinVeil engages the following third-party operators (processors) to deliver the platform. Each processor is contractually bound to process personal information only on FinVeil's instructions and to maintain appropriate security measures:

• Paystack — payment processing for disbursements and salary advances. Paystack receives only the minimum transaction data required to execute a payment.
• Railway — application hosting and infrastructure. All data at rest is encrypted and hosted within Railway's infrastructure.
• Stellar — tamper-evidence anchoring. Only 32-byte Merkle root hashes are written to the Stellar public ledger. No personal information, transaction amounts, identifiers, or claims are published on-chain.

Personal information is processed and stored in South Africa. Cryptographic proofs (32-byte Merkle root hashes containing no personal information) are anchored to the Stellar public ledger for tamper-evidence. No personal data, transaction amounts, identifiers, or claims are ever published on-chain.

Personal information is retained for as long as the employer customer's subscription is active, and for a further 90 days after cancellation to permit reactivation. After that period, personal information is irreversibly deleted or anonymised. Consent records and audit logs are retained for a minimum of five years to satisfy regulatory requirements.

Under POPIA Sections 23 to 25, data subjects (employees whose information is processed through FinVeil) have the following rights:

• Access (Section 23) — request confirmation of whether FinVeil holds personal information about you and, if so, obtain a copy. Submit a request to privacy@finveil.money.
• Correction (Section 24) — request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully. Submit a request to privacy@finveil.money or contact your employer's HR department.
• Objection (Section 11(3)(a)) — object to the processing of personal information on reasonable grounds. Direct your objection to privacy@finveil.money.
• Deletion (Section 24) — request deletion of personal information where the responsible party is no longer authorised to retain it. Deletion requests are processed within 30 days.
• Complaint (Section 74) — lodge a complaint with the Information Regulator if you believe your personal information has been processed in violation of POPIA. Contact details: inforegulator.org.za.

All requests are acknowledged within 5 business days and resolved within 30 days. Identity verification may be required before a request is actioned.

FinVeil may update this privacy policy from time to time. Material changes will be communicated to employer customers via email notification and an in-platform banner at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

An Information Officer has been designated in accordance with Section 55 of POPIA. Registration with the Information Regulator is in progress. For data protection queries contact privacy@finveil.money.