Privacy Policy

This policy explains how Silver Sixpence (Pty) Ltd (“Coinfig”, “we”) processes personal information when you use coinfig.tax and the Coinfig application. We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

If you are in Ireland or elsewhere in the European Economic Area, the General Data Protection Regulation (GDPR) also applies. Section 16 of our full Privacy Noticeexplains how, including your rights and how to complain to a data protection authority.

What we collect

• Account details: your name and email, managed through our authentication provider.
• Connection credentials: exchange API keys (read-only wherever the exchange offers it) and wallet addresses you choose to add, so we can import your transaction history.
• Transaction data: trades, transfers, income and fees imported from the exchanges, wallets and CSV files you connect.
• Billing data: handled by our payment processors. We do not store full card details.
• Usage data: privacy-first, consent-gated analytics about how the site is used.

How we use it

We use your information to calculate your crypto tax position, generate reports, provide support, process payments and keep the service secure. We do not sell your personal information.

How we protect it

• Exchange API keys and other secrets are encrypted at rest using AES-256-GCM.
• We ask for read-only exchange access wherever the exchange offers it, and never for trading or withdrawal permissions.
• Access is authenticated and rate-limited, and consent and access events are logged for accountability.

Sharing and processors

We share data only as needed with the providers that run the service:

• Clerk: sign-in and accounts (name, email, sign-in data).
• Google, Microsoft and the other sign-in providers shown at sign-in: only if you choose to sign in with them (the login data needed to authenticate you).
• PayFast and Stripe: payments (billing and payment details).
• Amazon Web Services, Cape Town region: hosting, database and file storage (all account and transaction data).
• Cloudflare: website hosting, delivery and security (IP address and request data).
• Cloudflare Workers AI: reading uploaded files in a layout we do not yet recognise (column headers, a small sample of rows, and the distinct values of columns that contain only a few different values).
• PostHog: product analytics, if you accept optional cookies (your account identifier and email address, with usage, device and browser data).
• Google and LinkedIn: advertising measurement, if you accept optional cookies.
• Blockchain data providers: reading wallet history (the wallet addresses you add).
• Xero: only if you connect it (the journal data you export).
• Resend: account and report emails (email address and message content).
• CoinGecko and CoinMarketCap: market prices (no personal information expected).

Some of these providers process data outside South Africa. We transfer personal information outside South Africa only where a condition in section 72 of POPIA is met, usually through contractual protections with the recipient.

Your rights under POPIA

You may request access to, correction of, or deletion of your personal information, and you may object to certain processing. To exercise these rights, email [email protected].

Retention

We keep your data for as long as your account is active and as required to meet legal and tax-record obligations, after which it is deleted or anonymised. Closing your account erases your data from our active systems and cannot be undone, except for records the law requires us to keep. Backup copies may remain for a limited period until they are overwritten. Download your reports before you close your account.

Supplier details

• Legal name: Silver Sixpence (Pty) Ltd, trading as Coinfig
• Physical and service address: 1269 Gordon Hood Rd, Centurion Central, Centurion, 0046, South Africa
• Email: [email protected]

Contact

Silver Sixpence (Pty) Ltd, Pretoria, Gauteng, South Africa. Email [email protected].