CountWell terms of use

1. What the service is

CountWell is a bookkeeping hub. It receives bills and receipts, reads them, proposes how they should be coded, asks a company's people what a payment was for, keeps stock, cash flow and other subledgers, and posts approved entries to the company's accounting ledger. A person at the practice decides what posts; the hub proposes.

The service is for practices and companies in business. It is not for consumers and it is not accounting, tax or legal advice. The practice remains responsible for the books it keeps and the returns it files.

2. Your account and your people

A practice administrator may invite staff, and a practice or a company administrator may invite the company's own people to the client app. Each person has their own sign-in and must keep it to themselves. You are responsible for what the people you invite do in the service and for removing them when they should no longer have access.

You must give us accurate information and keep the entity profile of each company (registration, VAT status and the like) correct, because the hub follows it.

3. The ledger connection

You connect a ledger (Xero today) with your own ledger credentials and may disconnect it at any time. The hub uses the ledger's interface only, incrementally and within the permissions you grant, and never acts as you in the ledger's own screens. Your use of the ledger stays under your agreement with its provider.

Anything the hub writes to the ledger is an entry a person at the practice approved, or an entry within a tolerance that person set. The hub keeps a record of every write and can reverse it.

4. Reading documents and proposing coding

The hub uses an AI provider to read documents and short answers and to propose coding. Proposals are suggestions. No model is trained on your data, and what the hub learns for a company is kept as plain rules and history that your people can read, change and delete.

5. Fees

Modules are priced per company per month, with a free trial. Prices and the trial period are shown in the hub before anything is switched on. Fees are invoiced to the practice unless a company subscribes directly. Fees exclude VAT where it applies. We may change prices with 30 days' notice.

6. Your data

Your books, documents and personal information stay yours. We process them to run the service for you, as the privacy policy and Schedule 1 describe, and for nothing else. We do not sell data and we do not use one practice's data to improve the service for another.

You may export your data from the hub at any time. When a company disconnects or you ask us to, we delete that company's data within 30 days, keeping only what the law requires us to keep and the audit record of what was posted to the ledger.

7. Security and incidents

We keep the service behind sign-in, separate each practice's data by row-level security, encrypt ledger tokens at rest and keep an audit trail of every change. If we learn of a security incident that affects your data, we tell the practice without undue delay, tell the ledger provider within the time its terms require, and tell the Information Regulator and the people affected where POPIA requires it.

8. Availability and support

We aim to keep the service available at all times and to tell you in advance of planned maintenance, but we do not promise uninterrupted service. Support is by email at the address below, during South African business hours.

9. Acceptable use

You may not use the service to break the law, to process data you have no right to process, to probe or overload it, to copy it, or to build a competing product from it. You may not pass access to anyone outside your practice or company.

10. Liability

We provide the service with reasonable care and skill. To the extent the law allows, we are not liable for indirect or consequential loss, for loss of profit, or for the consequences of an entry a person at the practice approved. Our total liability to you in any twelve months is limited to the fees you paid us in those twelve months. Nothing in these terms excludes liability that cannot be excluded under South African law, including the Consumer Protection Act where it applies.

11. Ending the agreement

You may stop using the service and disconnect at any time. We may suspend or end your access if you break these terms and do not put it right within 14 days of being told, or at once if the breach puts other users' data at risk. Section 6 applies to your data when the agreement ends.

12. Changes to these terms

We may change these terms. We will show the new version in the hub and ask you to accept it before you connect another ledger or carry on after the date it takes effect. The version you accepted, and when, is recorded.

13. Law and contact

These terms are governed by the law of the Republic of South Africa and the courts of South Africa have jurisdiction. Questions about these terms go to ane@countwellhub.com.

Schedule 1: Operator agreement (POPIA)

Under POPIA, the practice and each company it keeps books for decide why and how personal information is processed: they are the responsible parties. Accuvio Accounting processes that information on their behalf and on their instruction: it is the operator. This schedule is the written contract POPIA requires between a responsible party and its operator.

The operator will: process personal information only to provide the service and only as the responsible party instructs through its use of the hub; keep it confidential and allow access only to people who need it to run the service; keep the security safeguards in section 7 and review them at least once a year; tell the responsible party without undue delay when it has reason to believe personal information was accessed or acquired by an unauthorised person; help the responsible party answer requests from data subjects and the Information Regulator; and delete or return the information when the service ends, as section 6 says.

Sub-operators. The operator uses the providers listed below to run the service. Each holds data where stated, under written terms at least as protective as this schedule. The responsible party consents to their use and to the transfer of personal information outside South Africa to them, as POPIA section 72 allows where the recipient is bound by adequate protection. The operator will tell the responsible party before adding a provider that holds personal information.

The personal information processed: names, email addresses and sign-in details of the practice's and the company's people; supplier and customer names and contact details as they appear in the ledger and on documents; employee details on expense claims; and whatever personal information appears in the documents and answers a company sends in.

• Vercel: Hosts the two apps and runs their server code. Data held in Dublin, Ireland (EU), with Vercel's global network serving static files. Under Vercel's Data Processing Agreement.
• Supabase (on Amazon Web Services): The database, sign-in and file storage. Data held in Ireland (EU), AWS eu-west-1. Under Supabase's Data Processing Addendum.
• Cloudflare: Receives bills emailed to a company's forwarding address and passes them to the hub. Data held in Cloudflare's global network; the message is processed in transit and not kept by Cloudflare. Under Cloudflare's Data Processing Addendum.
• Anthropic: Reads bills, receipts and short answers to propose coding (the AI provider). Data held in United States. Under Anthropic's commercial terms: inputs and outputs are not used to train its models and are kept only as its terms allow.
• Resend: Sends the hub's emails (reminders, notices, invitations) when the practice turns email on. Data held in United States. Under Resend's Data Processing Agreement.
• Google: Calendar and Drive, only for a practice that connects them for its own meetings and notes. Data held in Google's data centres under Google's terms. Under Google's API Services User Data Policy.
• Xero: The accounting ledger the practice connects; the hub reads from and writes to it on the practice's instruction. Data held in Xero's data centres under Xero's own terms. Under Xero's terms of use between Xero and the practice or company.