Data Notice

1. Who we are and what this notice covers

1.1 Acorn Draft is operated by Acorn Financial Services CC, a close corporation registered in Namibia with its principal place of business in Windhoek ("Acorn", "we"). Acorn Draft is software that prepares, checks and records the review of annual financial statements and tax computations from data an accounting practice uploads.

1.2 This notice is addressed to the firms that subscribe to Acorn Draft ("the Firm"). It explains what data the Service holds, what we do with it, where it is processed, who else processes it on our behalf, how it is protected, how long it is kept, and how the Firm can get it back or have it deleted.

1.3 It applies to the Acorn Draft portal at app.acorndraft.com, the JSON API behind it, and the emails and support we provide around them. It does not cover the public website at acorndraft.com, which collects nothing beyond demonstration requests and ordinary server logs.

1.4 The Firm's clients. Acorn has no relationship with the Firm's clients and does not deal with them. The Firm decides what to upload, and the Firm's engagement with its client governs that client's data. Section 7 says what we expect the Firm to have done before it uploads.

1.5 Terms used here (Firm Data, Client Data, Output, Users, Sub-processor) have the meanings in clause 2 of the Terms.

2. What data the Service holds

2.1 Personal information inside Client Data. Financial statements and their inputs contain personal information about people connected with the Firm's clients: directors' and members' names and interests, loan accounts with related parties, shareholdings, and sometimes employees' and customers' names in ledgers and listings. We treat all of it as the Firm's confidential Client Data under this notice. We do not extract, profile or index these people.

2.2 What we do not collect. The Service does not collect payment-card details (invoices are paid by bank transfer), does not place advertising or analytics trackers in the portal, and does not read a User's device beyond what a web browser sends.

3. What we use it for

3.1 To provide the Service to the Firm. Client Data is used to prepare the draft, run the checks, present findings, apply the Firm's amendments, run the independent review and record the review and approval. Output is kept so that the Firm's Users can download it and so that later re-runs and the next year's draft can refer to it.

3.2 To improve the next draft for the same Firm. The house rules the Firm sets, the responses its Users record and each client's approved years are kept and applied to later drafts for that client and that Firm. This learning stays inside the Firm's own workspace and is never applied to, or visible to, another firm (Terms, clause 5.5).

3.3 To run the Firm's account. Firm Data is used to sign Users in, enforce roles and two-factor authentication, invoice the Firm, send service notices to the owner account and answer support requests.

3.4 To keep the Service secure and reliable. The audit log and operational data are used to investigate suspected unauthorised access, to lock accounts after repeated failed sign-ins, to diagnose faults and to restore from backup.

3.5 To meet legal obligations. We keep invoices and billing records for the period tax law requires, and we respond to lawful requests as described in clause 5.7 of the Terms, telling the Firm first where the law allows.

3.6 What we never do. We do not sell Client Data or Firm Data, share it with anyone except the Sub-processors in section 4 and the persons permitted by the Terms, use it for advertising, or use it to train or improve any machine-learning model, whether ours or anyone else's. Our Sub-processors that provide language-model services are contractually prohibited from training on the data we send them (section 4). We do not look at a Firm's Client Data ourselves except when the Firm asks for support on a specific draft, when investigating a security incident, or when the law requires it, and every such access by Acorn staff is recorded.

3.7 Aggregate statistics. We may count how the Service is used across all firms (for example how many drafts run each month, which checks fail most often, which layouts are requested) to plan and improve it. These counts do not identify a firm, a client or a person.

4. Where data is processed and by whom

4.1 Outside Namibia. The Service runs on servers in Germany and sends parts of Client Data to language-model providers in the United States and Europe, as set out below. Client Data therefore leaves Namibia. The Firm must be satisfied that its engagement with each client allows this (section 7). Namibia has no data protection statute in force at the date of this draft (section 10), so this is a professional and contractual question for the Firm rather than a statutory one; this notice is written so that it will also satisfy the Data Protection Bill's disclosure requirements when that law commences.

4.2 Sub-processors. We use the following third parties to provide the Service. Each receives only what is listed, is bound by written terms that prohibit using the data for anything other than providing its service to us, and is listed here under clause 5.6 of the Terms, which gives the Firm 30 days' notice of any change.

4.3 Monitoring services. Two services receive no Client Data: an uptime monitor that requests the portal's public health page every five minutes, and a backup-completion monitor that receives a timestamp when the nightly backup finishes. [confirm the providers in use and name them here: the deployment guide proposes uptimerobot.com and healthchecks.io.]

4.4 Acorn's own staff. Acorn's members and staff administer the Service from Namibia. Administrative access is limited to named individuals with two-factor authentication, from known network addresses, and is recorded.

4.5 No other recipients. Apart from the above, the only people who see a Firm's data are that Firm's own Users, and anyone the law compels us to disclose to under clause 5.7 of the Terms.

5. How we protect it

The measures below are in place today unless marked [confirm]. They are the measures referred to in clause 4.5 of the Terms.

Access

• Every User has a personal, named account with a role (viewer, drafter, manager, partner or owner); roles decide who may upload, respond, review, approve, download, and manage Users.
• Two-factor authentication with an authenticator app is available to every User and can be made compulsory for the whole Firm by its owner; once on, no User can switch it off, and only Acorn's platform administrator can lift the requirement.
• Sign-in is locked after five failed attempts on an account within fifteen minutes, or twenty from one network address, and the lock is recorded in the audit log. Wrong two-factor codes are limited the same way.
• Sessions expire after ten hours and cookies are marked secure and HTTP-only.
• Acorn's administrative console requires two-factor authentication and is reachable only from network addresses on an allow-list.

Separation between firms

• Each Firm is a separate organisation in the Service. Every record carries its organisation, and every page, file and API call is resolved through the signed-in User's (or the API token's) organisation, never by a record number alone. Uploaded files are never served as public static files.
• An automated test suite exercises every object URL in the Service for cross-organisation access on every build, and the build fails if a new URL is added without that cover.

Transport and storage

• All traffic between the User's browser and the portal, and between the Service and its Sub-processors, is encrypted with TLS; the portal enforces HTTPS with HTTP Strict Transport Security.
• The server exposes only the web ports and SSH (key-based, no password sign-in); the database is not reachable from the internet.
• Operating-system security updates are applied automatically.
• Data at rest: [confirm and state: whether the server's disk and the backup archives are encrypted at rest. If not yet, say so plainly or implement before publication; firms will ask.]

Backups and recovery

• A nightly backup of the database and the uploaded and generated files is taken and copied over an encrypted connection to a separate Hetzner storage account in Germany. Backups are kept for 14 days and then overwritten. A monitor alerts Acorn if the backup does not run.
• Restores are rehearsed [confirm: state the frequency, for example quarterly].

Accountability

• The audit log records every User action with the User, the time and the network address, and cannot be edited through the Service. The Firm's owner can inspect its own log at any time.
• Acorn will tell the Firm within 72 hours of confirming a security incident that affects its data (Terms, clause 4.5), with what is known and what Acorn is doing, and will keep the Firm informed until the incident is closed.

What we ask of the Firm

• Switch on compulsory two-factor authentication, remove Users who leave on the day they leave, keep API tokens secret and rotate them if in doubt, and tell security@acorndraft.com at once if an account or token may have been compromised.

6. How long we keep it

6.1 The principle. We keep data for as long as the Firm needs it in the Service to do its work and to show, later, how a set of financial statements was prepared and who approved it. After that we delete it, unless the law requires us to keep it.

6.2 When a subscription ends. For 30 days after termination the Firm's Users can sign in only to export, for each client year, the Output, the Client Data as uploaded, the findings and responses and the audit log (Terms, clause 13.6). Within 60 days after that window closes we delete all Firm Data and Client Data from the live Service, and backups containing it expire within a further 14 days. We keep only the Firm's name, billing records and audit-log entries for the periods above, and confirm the deletion in writing when asked.

6.3 Deletion on request. The Firm's owner can ask us at any time, in writing, to delete a client's data or the whole workspace. We act within 14 days and confirm in writing. The Firm is responsible for exporting anything it still needs before it asks.

6.4 At our Sub-processors. Anthropic and OpenAI delete the data we send them from their systems within 30 days under their standard terms (section 4); nothing we send them is stored under our control on their side. Hetzner holds only what is in the live Service and its backups.

6.5 The Firm's own retention. These periods are ours. The Firm's professional rules require it to keep working papers and issued financial statements for its own period, and the Service is not the Firm's archive: the Firm should download and file the approved statements and review pack for each client year.

7. The Firm's responsibilities towards its clients

7.1 Authority to upload. Before uploading a client's data, the Firm must be satisfied that its engagement letter, the client's consent or the law allows it to use a third-party processor outside Namibia for the preparation of that client's financial statements (Terms, clause 5.1). Most engagement letters already permit the use of software and service providers; where one does not, a short addendum is enough, and we can supply suggested wording on request.

7.2 Telling clients. If the Firm's professional rules or its engagement terms require it to tell a client which service providers handle the client's information, this notice is written so that the Firm can pass it on as it stands.

7.3 Only what is needed. The Firm should upload what the draft needs: the trial balance, the prior-year statements and the supporting schedules. It should not upload identity documents, payroll files with personal details, or correspondence unrelated to the financial statements.

7.4 People in the data. The Firm is responsible to the directors, members, employees and other people whose details appear in its clients' records. Requests from such people about their information should come to us through the Firm; we will help the Firm answer them within 10 working days.

7.5 Its own copies. The Firm must keep its own copies of source records and of every set of financial statements it issues. The Service is a drafting and review tool, not a system of record, and the Terms exclude liability for data loss the Firm could have avoided by keeping its own copies (clause 12.5).

7.6 Its own users. The Firm decides who its Users are, what roles they hold and when they leave. We act on the owner account's instructions and do not verify them with the Firm's partners.

8. Access, export, correction, deletion and incidents

8.1 Access and export. The Firm's Users can see everything the Service holds about their clients from the portal, and can download the Output and the uploaded files for any client year at any time. The owner account can download the Firm's audit log. If the Firm needs a complete export in machine-readable form (for example to move to another system), it can ask privacy@acorndraft.com and we will supply it within 14 days at no charge once in any 12 months.

8.2 Correction. Client Data is corrected by the Firm itself: upload the corrected file and re-run, or record an amendment. Firm Data (names, emails, roles) is corrected by the owner account on the Users page. Audit-log entries are not changed; a correction is recorded as a new entry.

8.3 Deletion. Section 6.3 says how the Firm asks for deletion and how fast we act.

8.4 Questions and complaints. Questions about this notice or about how we handle data go to privacy@acorndraft.com. We answer within 10 working days. If the Firm is not satisfied with the answer it may raise the matter with a member of Acorn, and the Terms' dispute clause applies.

8.5 Security incidents. If the Firm suspects that an account, a token or a file has been compromised it must tell security@acorndraft.com at once. If we confirm an incident that affects the Firm's data, we tell the owner account within 72 hours of confirming it, say what data is affected, what we have done and what the Firm should do, and keep the Firm informed until the incident is closed. Where a client of the Firm needs to be told, the Firm decides how; we give the Firm what it needs to do so.

8.6 Requests from authorities. If a court, regulator or other authority requires us to disclose a Firm's data, we tell the Firm first where the law allows, disclose only what is required, and record the disclosure (Terms, clause 5.7).

9. Changes to this notice

9.1 We may change this notice as the Service, our Sub-processors or the law change. The current version is always at acorndraft.com/data-notice, with its date.

9.2 A change that adds or replaces a Sub-processor, moves data to a new country, lengthens a retention period, or reduces a protection described here takes effect 30 days after we email the Firm's owner account and post the new version. The Firm may object in writing within that period, and if we cannot accommodate the objection the Firm may end its subscription with a pro-rata refund of prepaid fees (Terms, clause 5.6).

9.3 Other changes (clarifications, a shorter retention period, a stronger protection, a new contact address) take effect when posted.

9.4 We keep earlier versions and will supply any of them on request, so that the Firm can show which version applied to a particular client year.

10. Namibian law and contact details

10.1 The law today. At the date of this draft Namibia has no general data protection statute in force. The Data Protection Bill has been under preparation since public consultation in 2022; in the 2026/27 budget estimates the Ministry of Finance reported that the Cabinet Committee on Legislation had approved it and referred it to the Ministry of Justice and Labour Relations for review, and practitioners expected promulgation around the end of 2026. Until it commences, the handling of client information by an accounting practice is governed by the practice's professional rules, its engagement terms, the common-law duty of confidence and this agreement. [Check the Bill's status immediately before publication and update this paragraph.]

10.2 When the Act commences. This notice is written to meet the disclosure duties the Bill is expected to impose on a processor: the categories of data, the purposes, the recipients, the cross-border transfers, the security measures, the retention periods and the rights of data subjects are all set out above. When the Act commences we will review this notice, register with the regulator if required, enter into any processing agreement the Act requires with each Firm, and tell Firms what changes.

10.3 Electronic records. The Service's records, including the audit log and the record of acceptance of the Terms, are kept as data messages under the Electronic Transactions Act 4 of 2019, which gives them legal effect and allows them to satisfy requirements for writing, original form and retention (sections 17, 19, 21 and 24).

10.4 Other countries. Where a Firm serves clients in South Africa or elsewhere, the data protection law of that country (for example POPIA in South Africa) may apply to the Firm's processing of that client's information. The Firm is responsible for its own compliance; we will provide the information and assistance a processor reasonably should.

10.5 Contact. Acorn Financial Services CC, Windhoek, Namibia. Data questions and requests: privacy@acorndraft.com. Security incidents: security@acorndraft.com. Support: support@acorndraft.com. Legal notices under the Terms: legal@acorndraft.com. [Add the registered address and the name of the member responsible for data matters before publication.]

Sources