Be Boaz is a software division of Echo Reach (Pty) Ltd (registration 2024/147636/07), 18 Figaro Crescent, Brackenfell South, 7560, Western Cape. For your account details, Echo Reach is the responsible party under the Protection of Personal Information Act, 2013 (POPIA). This policy says what we collect, why, who else handles it, and what you can ask us to do with it. POPIA protects companies as well as people, so it covers your suppliers' company details too.
What we collect
When you sign up: your company name, your name and your work email. You don't have to give them, but without a name and email we can't open an account or send you a sign-in link. We also keep a record of what you accepted. If you connect WhatsApp, we also keep the phone number you send the link code from.
When you add a certificate or sworn affidavit: the company-level details Boaz reads from it, such as the supplier's name, registration number, B‑BBEE level, ownership percentages, dates and verification agency. We keep those details and a fingerprint of the file so the same document isn't read twice. We don't keep the file itself.
A sworn affidavit names the person who signed it and may show their ID number. The document is sent to our reading service (Anthropic, below) so Boaz can read it, but we don't store that person's name or ID number.
When you use the scorecard: the figures you enter, such as payroll, ownership, training and development spend, and what you spent with each supplier. These are totals and percentages for your business, not records about individual employees.
When you correct details Boaz read, or confirm a supplier's Empowering Supplier status: the new values, what Boaz originally read, which checks your confirmation cleared, any change to which supplier the certificate belongs to, who on your account made the change and when, and the evidence you name (the type of document, its date and who signed it). Your verifier may ask for this record.
When you pay, from 15 November 2026: your plan, the billing email and buyer details you give at checkout (your company and its registration number, or that you're a sole proprietor), what you paid and when, the receipts we send you, and the reference Paystack gives each payment. We never see or store your full card number or security code.
We don't use advertising trackers or sell personal information. Your sign-in session is kept in your browser's local storage and expires on its own.
The free Supplier File Check doesn't keep your files
Anyone can check a certificate at beboaz.co.za/check without an account. Echo Reach (Pty) Ltd, trading as Be Boaz, sends the document to Anthropic (below) to be read and shows you the result. Neither the file nor what was read is saved to our database. A copy of the read stays in our server's memory until the server restarts, so the same file isn't paid for twice. Your IP address is held in memory to limit how many checks one connection can run, and dropped within about a day.
We do record, with no link to you, the cost of each read and an anonymous count of each check: what the result was and what kind of document it was, but no IP address, file, file name or company name. If you then create an account from the check, we note that your account came from the check. We do this to run the check fairly and to know whether it helps people. Only upload documents you're entitled to use.
We record which version of our terms you accepted
When you create an account, you tick a box to accept our Terms of Service and this Privacy Policy. We record which version of each you accepted, when, and who accepted (your name and email). The version is shown at the top of each page; this one is 2026-10-03. The same tick records that you agreed to documents you upload being sent to Anthropic in the United States to be read. That agreement is an extra ground for that one transfer. Our other transfers outside South Africa rest on the grounds described below. We keep the record, name and email included, while your account is open and for 3 years after it closes, because it shows what we agreed.
We email the founding-spot list only after you confirm
You can join our founding-spot list on beboaz.co.za to hear when founding places open. When you do, we keep:
- your email address;
- your name and company, if you give them;
- which page you signed up on;
- the version of the consent wording you agreed to, when you agreed, and when you confirmed;
- when we last emailed you, and how many confirmation links we've sent you, so we keep to the limits below;
- a scrambled copy of the unsubscribe link in each email we send you, so every one of those links works.
We then email you a link to confirm. If you ask again, we send a fresh link at most once a day, and no more than three while an earlier one still works. Spellings that differ only by a +tag (name+news@ and name@) share that daily limit. Only the newest link works, for 7 days after we send it. Until you click a link we send you nothing else. If you don't confirm within 30 days of first asking, we delete your details. Asking again after all your links have expired starts a new 30 days, with the details you give that time. Once you've confirmed, we email you about founding places and Be Boaz news. Every email has an unsubscribe link, and you can also unsubscribe by emailing us.
When you unsubscribe, we delete your name, your company and the count of confirmation links straight away. We keep the time of our last email to you for at most two days after sending it, and use it only to keep to our daily email limits. What stays is your email address, the page you signed up on, the version of the consent wording you agreed to, when you agreed, when you confirmed (if you did) and when you unsubscribed. That record shows you agreed to the emails we sent, and stops us emailing you again. We also keep the scrambled unsubscribe links, so the link in every email we sent you still works, and the page it opens lets you rejoin if you change your mind.
We don't buy contact lists. POPIA section 69 lets us ask someone for consent to marketing emails only once. If we ever ask a business contact, we ask once, tell them where we found their details, and record that we asked so it never happens twice. If they say no or don't answer, we don't send them marketing.
Why we use it
To run the service you signed up for: read documents, keep your supplier records, calculate your indicative scorecard, send sign-in links and reply on WhatsApp. From 15 November 2026, we also use your billing details to charge for your plan, send receipts and check whether you qualify for the First-Month Guarantee. We email you about your account. We don't send marketing without your consent.
B‑BBEE ownership figures relate to race. We process them only at company level and only to measure B‑BBEE compliance, which POPIA section 29 allows as a measure to advance people disadvantaged by unfair discrimination.
When we act for you
Your suppliers' details are yours. We process them on your behalf as your operator under POPIA, on the terms in our Terms of Service. You're responsible for having a lawful reason to hold the documents you upload. For documents your suppliers gave you for B‑BBEE purposes, you normally do.
Each business sees only its own data
Every record belongs to one business account. The database enforces that separation itself, so one customer's suppliers, figures and certificates can't appear in another customer's account. Sign-in links work once and expire after 15 minutes, and we store only a hash of each link, never the link itself. If we find that personal information has been accessed without authorisation, we'll notify the Information Regulator and the people affected as soon as reasonably possible.
Who else handles it, and where
- Anthropic (United States) reads uploaded documents. Under its commercial terms it does not train models on this content, and it deletes what we send within 30 days, or keeps it for up to 2 years if it is flagged under Anthropic's usage policy.
- Render hosts the application and Neon hosts the database, both in Frankfurt, Germany.
- Resend sends our emails from Ireland, including founding-spot list emails.
- Meta carries WhatsApp messages, only if you choose to use WhatsApp.
- Paystack (Paystack South Africa (Pty) Ltd) takes card payments for paid plans, from 15 November 2026. You type your card details on Paystack's own checkout page, so Paystack holds them, not us. It protects them under the card industry's security standard (PCI DSS) and handles them under its own privacy notice. We send Paystack your billing email, your company name and the plan you chose. Paystack sends us whether a payment went through, the amount, the date, a reference and its customer and subscription codes. It handles billing only, never your supplier documents or figures. We're confirming with Paystack where it stores this information, and we'll add that here, and email account owners, before we take the first live payment.
Our transfers outside South Africa rest on two grounds in POPIA section 72. Each operator we use is bound by a data processing agreement that requires security safeguards like the ones POPIA demands (section 72(1)(a)). And sending information to them is necessary to deliver the service you asked for (section 72(1)(c)): Be Boaz can't work without them, because our reading service and hosting are outside South Africa.
One transfer has a third ground. When you create an account, you tick a box agreeing to documents you upload being sent to Anthropic in the United States to be read (section 72(1)(b)). That tick covers the transfer to Anthropic only.
If the Be Boaz business is ever sold, your account and the information in it would go to the buyer, who would have to keep the promises in this policy. We'd email you before that happens.
How long we keep it
For as long as your account is open. B‑BBEE verification looks back over several years, so supplier and scorecard records stay until you delete them or close your account. After closure we delete your data within 90 days, except:
- invoices and payment records, which the Companies Act requires us to keep for 7 years;
- the record of which terms you accepted, with the name and email of who accepted, kept for 3 years after closure;
- if you unsubscribed from our founding-spot list, the consent record and scrambled unsubscribe links described above, so we don't email you again;
- anything else the law requires us to keep longer.
Founding-spot list details stay until you unsubscribe, and unconfirmed sign-ups are deleted 30 days after the request that started them. After you unsubscribe, we keep the consent record and scrambled unsubscribe links, and delete the rest as described above. Sign-in and WhatsApp link codes expire within minutes.
Your rights
You can ask to see the personal information we hold about you, to correct it, or to delete it, and you can object to how we use it. You can withdraw a consent at any time, for example by unsubscribing. That stops what we do from then on, but doesn't undo what we did before. Contact our Information Officer, Rynard Snyman, at info@beboaz.co.za or 071 678 4010. We'll answer within 30 days.
If you're unhappy with our answer, you can complain to the Information Regulator. Complaint forms and contact details are at inforegulator.org.za.
We'll email you before this policy changes
If we change this policy in a way that matters, we'll email account owners before the change takes effect, and the version at the top of this page changes with it.