Privacy Policy
AssetBridge · Version 1.0 · Last updated 20 October 2026 · Version history
AssetBridge is an online fixed-asset and tax register used by accounting practices and businesses in South Africa. This policy explains what personal information AssetBridge collects, why, who it is shared with, how long it is kept and what rights you have. In short:
- We collect only what we need to run your account and keep it secure: mainly your name, email address, sign-in and two-step verification details, your role, and a record of what you do in AssetBridge.
- The companies, assets and accounting records you enter belong to your practice or business. We process them on its behalf and only to provide AssetBridge.
- We do not sell personal information, show advertising, use analytics or tracking cookies, or use artificial intelligence on your information.
- Your information is stored with our hosting providers in the United Kingdom and the European Union, and some emails are sent through a provider in the United States.
Contents
- About this policy
- Who we are
- Information we collect
- How we use your information and why
- Special personal information and children
- Who we share your information with
- International transfers
- Cookies and similar technologies
- How long we keep your information
- How we protect your information
- Your rights
- Automated decisions and AI
- Direct marketing
- Changes to this policy
- Contact us
1. About this policy
This policy applies to:
- account holders: the Practice Manager or Business Administrator who opens an AssetBridge account for a practice or a business;
- invited users: staff and clients who are given access to a practice or to particular companies;
- people connected to a customer's records: for example, a sole proprietor whose business is a client of a practice, or a person named in a note;
- developers whose applications we register to use the AssetBridge API; and
- visitors to our website at assetbridgehq.com.
In this policy:
- "AssetBridge" and "the Service" mean the AssetBridge website and web application at assetbridgehq.com, and the AssetBridge API;
- "we", "us" and "our" mean the operator of AssetBridge named in section 2;
- "you" and "your" mean the person whose personal information we process;
- "customer" means the practice or business that holds the AssetBridge account;
- "Customer Data" means the information a customer puts into AssetBridge about itself and its clients: companies, assets, journals, notes, reports and similar records; and
- "personal information" has the meaning given in the Protection of Personal Information Act, 2013 (POPIA), and includes information about an identifiable living person or an identifiable existing juristic person, such as a company.
This policy is written to meet POPIA, which is the law that applies to us. It does not form part of the Terms of Service, which are a separate agreement.
2. Who we are
AssetBridge is operated by Risen Advisory (Pty) Ltd, a South African private company.
You can contact our Information Officer at hello@risenadvisory.co.za.
Our two roles
We hold two different kinds of information, and our role is different for each.
- Your account information. For the information about you as a user (your name, email, sign-in and security details, your role and your activity), we are the responsible party. We decide why and how it is processed, and this policy describes that.
- Customer Data. For the records a customer enters about its own business and its clients, the customer is the responsible party and we are its operator. We process Customer Data only on the customer's instructions, only to provide AssetBridge, and under the confidentiality and security terms in our Terms of Service. If you are a client of a practice that uses AssetBridge and you have a question about your information, please contact that practice first. We will help it respond.
3. Information we collect
3.1 Information you give us
| When | Information | Required? |
|---|---|---|
| You are invited, or you create an account | Your name and email address. A password, unless you use Sign in with Xero. | Email and password are required to have an account. If no name is given, we show the part of your email address before the "@". |
| You set up two-step verification | An authenticator app linked to your account, and the name you give it. If you tick "remember this device", a device code. | Two-step verification is required for every user. Remembering a device is optional. |
| You edit your profile | Your display name. | Optional. |
| You open a practice or business | The practice or business name, its type and its financial year-end. | Required to open an account. |
| You invite someone | Their name and email address, and the role and companies you give them. | Required to send the invitation. Please only invite people who expect to hear from AssetBridge. |
| You work in AssetBridge | Customer Data: company names, legal names, company registration numbers, tax numbers, tax settings, asset details, depreciation and tax figures, journals, reasons and notes, and imported spreadsheet files. | As your work needs. Notes and reasons are optional free text. |
| You email us | Your email address and whatever you write, for example your account type, number of companies and assets, and whether you use Xero. | Optional. |
If you do not give us the information marked as required, we cannot open or keep your account, or send an invitation.
3.2 Information we collect automatically
- Activity records. AssetBridge keeps an audit trail of changes: who made a change, when, and what the record looked like before and after. This is a core feature of a financial register.
- Sign-in information. When you last signed in, and the company you last opened, so that AssetBridge reopens it for you.
- Security information. If you remember a device for two-step verification, we store a scrambled (hashed) version of a code held in a cookie on that device. When someone opens a one-time link to view an API secret, we briefly store their IP address to limit repeated attempts.
- API request records. When a connected application uses the AssetBridge API, we record which application, which company, which part of the API, when, and whether it succeeded. We do not record IP addresses for these requests.
- Cookies and browser storage. See section 8.
We do not use analytics, advertising or tracking tools.
3.3 Information from third parties
- Xero (if your practice or business connects it). When a company is connected to Xero, we receive that Xero organisation's name and identifiers, its chart of accounts, its fixed assets and asset settings, its balance sheet and its manual journals. We use them only to sync and reconcile that company's register.
- Sign in with Xero (optional). If you choose to sign in with your Xero login, Xero sends us your email address, your name and your Xero user identifier. We use them to recognise you and link the Xero login to your AssetBridge account. We do not receive your Xero password.
- Your colleagues. A Practice Manager, Business Administrator or company Manager may give us your name and email address to invite you, and decide which companies you can see.
4. How we use your information and why
POPIA allows us to process personal information only on a lawful ground. These are ours.
| Purpose | Information used | Lawful ground (POPIA s11(1)) |
|---|---|---|
| Opening and running your account, signing you in, and giving you access to the right practices and companies | Name, email, password, roles, memberships | Necessary to provide the Service you or your organisation asked for (contract) |
| Requiring two-step verification and protecting accounts | Authenticator details, remembered-device codes, sign-in times | Contract, and our legitimate interest in keeping AssetBridge and its customers' records secure |
| Sending service emails: invitations, password resets and security notices | Name, email | Contract |
| Providing the register: depreciation, tax registers, journals, reconciliations, reports and year-ends | Customer Data | Processed as the customer's operator, on its instructions |
| Connecting to Xero, syncing assets and posting journals, when a customer turns this on | Xero organisation data, Customer Data | Contract; on the customer's instructions |
| Keeping an audit trail of changes | Who did what, and when; before and after values | Contract, and our customers' and our own legitimate interest in accurate, accountable financial records |
| Sharing company details with an application a Manager connects to the API | The data in section 6 | On the customer's instructions, given when the Manager approves the connection |
| Supporting you and fixing problems | Account information and, where needed, Customer Data | Contract, and our legitimate interest in running a reliable service |
| Answering enquiries sent to us by email | Your email and message | Our legitimate interest in responding, or steps you asked for before an agreement |
| Meeting legal duties and responding to lawful requests | As required | Legal obligation |
You may object to processing that relies on legitimate interests (see section 11).
5. Special personal information and children
AssetBridge does not ask for special personal information (such as health, religious beliefs, race, or criminal behaviour) and is not designed to hold it. Please do not put it in notes, reasons or other free-text fields. If we find it, we may ask the customer to remove it.
AssetBridge is a business tool and is not intended for anyone under 18. We do not knowingly collect information about children. If you believe a child's information has been entered, contact us and we will help the customer remove it.
6. Who we share your information with
We do not sell personal information, and we do not share it for advertising.
Within your organisation. People with access to a company can see the names of the users who made changes to it (for example in the audit trail and asset history). Practice Managers and Business Administrators can see the people in their practice or business. Clients given access to particular companies see only those companies.
Our service providers (operators). These providers process information on our behalf to run AssetBridge:
| Provider | What they do | Information they handle | Where |
|---|---|---|---|
| Supabase | Database, sign-in and two-step verification | All information stored in AssetBridge | United Kingdom (London); service logs in the European Union |
| Vercel | Hosts the AssetBridge website and application | Information passing through the application | Europe, with a global network for delivering pages |
| Resend | Delivers AssetBridge emails (invitations, password resets, security notices) | Recipient email address and name, and the email content | United States |
We give these providers only the information they need to provide their service to us.
Xero. If a customer connects a company to Xero, we send that company's depreciation and other journals, and any assets the customer chooses to push, to the customer's own Xero organisation. Xero handles that information under the customer's agreement with Xero and Xero's own privacy notice. If you use Sign in with Xero, Xero handles your sign-in under its own terms.
Applications a customer connects to the AssetBridge API. A Manager can approve an application's access to one company. That application can then read the company's name, legal name, registration number, tax number, tax type, financial year-end and currency, and the display name of the person who approved the connection. The Manager can end the connection at any time. No information is passed to an application without that approval.
AssetBridge platform staff. A small number of our staff (Developers and Admins) can access every practice and company in AssetBridge, to provide support, investigate problems, set up and maintain the Service and keep it secure. They access Customer Data only when needed for those purposes.
Legal reasons and business changes. We may disclose information where the law requires it, to protect our rights or the safety of others, or as part of a sale or restructuring of the business that operates AssetBridge. In a sale, the new operator would be bound by this policy for information it receives.
7. International transfers
We are based in South Africa, but our providers store and process information outside South Africa:
- United Kingdom and European Union: the AssetBridge database, sign-in service and their backups (Supabase, London), Supabase's service logs (EU), and the AssetBridge application (Vercel, Europe).
- United States: email delivery (Resend).
- Xero: where Xero processes its customers' data, for companies that are connected to Xero.
POPIA (section 72) permits these transfers where the recipient is bound by a law or binding agreement that gives the information adequate protection, or where the transfer is needed to provide the service you asked for. Our providers publish data-protection commitments for the personal information they process, and we limit what they receive to what they need. Transfers to Xero happen because the customer asked us to connect to its Xero organisation.
8. Cookies and similar technologies
Cookies are small files a website stores in your browser. AssetBridge uses only the cookies it needs to sign you in and keep your account secure, and stores a few of your screen preferences in your browser. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner.
| Name | Purpose | Type | Duration |
|---|---|---|---|
sb-…-auth-token | Keeps you signed in | Strictly necessary cookie | Until you sign out or the session expires |
ab_mfa_device | Remembers this device for two-step verification, if you tick "remember this device" | Strictly necessary cookie | 30 days |
xero_oauth_state, xero_pending_entity_id | Security checks while connecting a company to Xero | Strictly necessary cookies | 10 minutes |
xero_auth_state, xero_auth_verifier, xero_auth_next, xero_auth_mode | Security checks during Sign in with Xero | Strictly necessary cookies | 10 minutes |
theme, sidebar-collapsed, assetbridge-active-practice, risen-recent-entities, and saved table-column choices | Remember your light or dark theme, sidebar state, last practice, recent companies and column choices | Browser storage (preferences) | Until you clear your browser storage |
assetbridge.demo-… | Avoids repeating Demo Company setup while a tab is open | Browser session storage | Until you close the tab |
You can delete cookies and browser storage in your browser settings. If you delete the sign-in cookie you will be signed out; if you delete preferences, AssetBridge returns to its defaults.
9. How long we keep your information
We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires.
| Information | How long |
|---|---|
| Your account information | While you have access to AssetBridge, and afterwards only as long as a customer's records need them (see below) |
| Customer Data, including the audit trail | While the customer's account is open, and afterwards for as long as needed for the customer to retrieve it and to meet legal record-keeping requirements. Accounting records are often subject to legal record-keeping periods (for example five years under the Tax Administration Act and seven years under the Companies Act), which are the customer's to decide. A customer can ask for its data to be exported or deleted sooner. |
| Remembered devices for two-step verification | 30 days |
| Records of API requests | 12 months |
| IP addresses kept to limit API secret-link attempts | 2 days |
| Temporary sign-in and connection codes | Between 5 minutes and 60 days, depending on the code, then deleted automatically |
| Demo Company copies | Reset every 28 days, and deleted if not opened since the last reset |
| Enquiry emails | As long as needed to deal with your enquiry |
| Backups | Deleted information can remain in backups for a limited period, until the backups expire |
When the period ends, we delete the information or remove anything that identifies you. Where a record must stay for the integrity of a customer's financial records, we may keep it and remove your name and email address from your user account instead.
10. How we protect your information
We use measures appropriate to financial records, including:
- encrypted connections (HTTPS) to AssetBridge;
- two-step verification for every user;
- encryption of the keys that connect AssetBridge to Xero;
- storing access tokens, sign-in codes and remembered-device codes only in scrambled (hashed) form;
- strict separation between practices and companies, enforced in the database, and role-based access within each practice and company;
- an audit trail of changes; and
- limits on repeated attempts to use the API.
No system is completely secure. Please keep your password and authenticator private, and tell us straight away if you think your account has been misused. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.
11. Your rights
Under POPIA you have the right to:
- access the personal information we hold about you;
- ask us to correct information that is wrong, out of date or incomplete;
- ask us to delete information we no longer have a lawful reason to keep;
- object to processing that relies on our legitimate interests; and
- complain to the Information Regulator.
How to use them. You can change your display name yourself on your profile page, remove your authenticators, forget remembered devices and disconnect Sign in with Xero. For anything else, including a copy of your information, a change of email address or deleting your account, email our Information Officer at hello@risenadvisory.co.za. We may ask you to confirm your identity first, and we will respond within a reasonable time.
If your request is about Customer Data (for example, records a practice keeps about your business), we will pass it to the customer, who is responsible for that information.
Removing your access does not always delete everything: we may need to keep a record of the changes you made to a customer's financial records. In that case we remove your name and email address from your account, so the record no longer identifies you, where the law allows.
The Information Regulator. If you are not satisfied with how we handle your information, you may complain to:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 General enquiries: enquiries@inforegulator.org.za · 010 023 5200 · toll-free 0800 017 160 Complaints are lodged through the Regulator's online portal: https://eservices.inforegulator.org.za/complaints/default.aspx Website: https://inforegulator.org.za
12. Automated decisions and AI
AssetBridge calculates depreciation, tax allowances, deferred tax and reconciliations from the figures and rules your organisation enters. These are calculations for your organisation to review, not decisions about people. AssetBridge does not make decisions about you based solely on automated processing, and does not use artificial intelligence on your information.
13. Direct marketing
We do not send marketing emails. AssetBridge emails are service messages you need to use your account, such as invitations, password resets and security notices. If we ever want to send marketing, we will ask for your consent first, as POPIA requires, and every message will let you opt out.
14. Changes to this policy
We may update this policy when AssetBridge or the law changes. Each version has a number and an effective date at the top, and the version history below lists what changed. If a change materially affects how we use your information, we will tell you by email or in AssetBridge before it takes effect.
15. Contact us
Questions or requests about this policy or your personal information:
Information Officer, Risen Advisory (Pty) Ltd Email: hello@risenadvisory.co.za
Version history
| Version | Date | Changes |
|---|---|---|
| 1.0 | 20 October 2026 | First version. |