Privacy Policy
Tennsa (Pty) Ltd | Registration 2025/913829/07 | Last updated 7 October 2026
This policy explains what Tennsa does with information, in plain language. We have tried to write it so that you do not need a lawyer to understand it, and so that it describes what the software actually does rather than what a template says software usually does.
If anything here is unclear, write to us at info@tennsa.com.
1. Who we are
Tennsa (Pty) Ltd is a South African company based in Cape Town. We build Tennsa OS, a platform that connects the systems a business already runs - accounting, inventory, payments, commerce, CRM, email and team chat - and reads them together to tell the business owner what needs attention.
Our Information Officer under the Protection of Personal Information Act (POPIA) is Rivar Maharaj, Chief Executive Officer. You can reach the Information Officer at info@tennsa.com.
2. Who this policy covers
This policy applies to three groups of people.
Our customers - the businesses that sign up for Tennsa and the people who administer those accounts.
Our customers' staff - people who are given a seat on a customer's Tennsa account.
People who appear in our customers' data - a customer's own customers, suppliers, staff and correspondents whose names, contact details and transactions appear in the accounting records, emails and other systems the customer connects. These people have no direct relationship with Tennsa. Section 5 explains how we treat their information.
3. Our role under POPIA
When a customer connects their systems to Tennsa, we process personal information on that customer's behalf and under their instruction. Under POPIA, the customer is the responsible party and Tennsa is the operator.
This means the customer decides what to connect and why, and holds the primary obligations to the people whose information appears in their data. Tennsa's obligations as operator are to process that information only as the customer instructs, to keep it secure, and to tell the customer if anything goes wrong.
Our customer agreement includes the written operator terms that section 21 of POPIA requires.
For the account information you give us directly when you sign up - your name, email address and company details - Tennsa is the responsible party.
4. What we collect
4.1 Account information
When you sign up we collect your name, email address, company name and password. If you subscribe, our payment provider collects your payment details; we receive confirmation of payment and the last four digits of the card, never the full card number.
4.2 Connected source data
When you connect a system to Tennsa, we read from it. What we read depends on the system:
Accounting systems (Xero, QuickBooks Online, Sage, Sage (SA), Zoho Books, SYSPRO): invoices, bills, credit notes, customer and supplier records, balances and ageing, bank transactions where the system provides them.
Inventory and retail systems (IQ Retail): stock items, quantities on hand, prices and costs, reorder levels, bin locations, stocktake dates, debtor and creditor balances.
Business management systems (Odoo): invoices, bills and credit notes; the names of your customers and suppliers, and whether each is a customer, a supplier or both; stock on hand and deliveries to customers; sales orders; purchase orders and the goods received against them. Where your Odoo holds more than one company, each company is read separately.
Payment providers (PayFast, Ozow, SnapScan, Peach Payments, Stripe): transactions, settlements and payment status.
Commerce platforms (Shopify, WooCommerce): orders, products and customer records.
CRM systems (HubSpot, Salesforce): contacts, deals, companies and activity.
Email (Gmail, Microsoft 365, IMAP): message headers and bodies, sender and recipient addresses, and attachments where relevant to a business finding. We read email to connect correspondence to what the other systems show - for example, a supplier's email about a delayed delivery against an invoice that is due.
Team chat (Slack): messages posted in the public channels you invite Tennsa into, with the channel each was posted in, when it was sent and the Slack ID of the person who sent it; and the name and Slack ID of your workspace and the Slack ID of the person who connected it. A public channel shared with another organisation through Slack Connect includes messages from that organisation's members. We read team chat to connect what your team is discussing to what the other systems show. We read public channels only. Tennsa does not read private channels or direct messages: it cannot yet limit what it shows from a private channel to the people who are members of that channel, so it does not read them at all. If a channel Tennsa reads is made private, Tennsa stops reading it and deletes the messages it holds from that channel, with their search index entries, the next time it checks. It checks regularly, by asking Slack whether each channel it holds messages from is still public (the Slack permission to view basic information about public channels), and it does not keep the details Slack sends back. Tennsa keeps a message as it was first posted: editing or deleting it in Slack does not change or remove Tennsa's copy, which is deleted on the schedule in section 12, when you disconnect Slack in Tennsa, or when your workspace removes the Tennsa app from Slack. When Slack tells Tennsa the app was removed, Tennsa deletes the messages it holds from that workspace, their search index entries, the connection, and its record of when it read them.
Calendar (Microsoft 365): upcoming events, so the briefing can tell you what is coming.
Files (Microsoft 365): for the twenty most recently changed items in your OneDrive, we read the file name, its size, when it was last changed and who changed it. We read this information ABOUT your files; we do not open or read the files themselves.
Every connection is read-only. Tennsa never writes to, changes, or deletes anything in a connected system. This is enforced in our code by a structural check that fails if any connector could perform a write, and for IQ Retail we additionally require the customer to create an API user that is only granted read permissions.
The complete list of systems Tennsa can connect to - and so of systems whose data is covered by the deletion described in section 13 - is: Xero, QuickBooks Online, Sage, Sage (SA), Zoho Books, SYSPRO, Odoo, IQ Retail, PayFast, Ozow, SnapScan, Peach Payments, Paystack, Stripe, Yoco, Zapper, Stitch, Shopify, WooCommerce, HubSpot, Salesforce, Gmail, Microsoft 365, Slack and IMAP Mailbox. We list all of them here so that the deletion promise has a definite scope. Not every one is available to every customer - some are still in development, and some need a licence from the vendor - and your Data Sources page shows what you can connect today.
4.3 Files you upload
You can upload files - spreadsheets, PDFs, images and documents - to your Tennsa workspace. We store them so you can retrieve them and so the platform can answer questions about them. A file you upload may contain personal information about other people; section 5 covers this.
Nothing deletes an uploaded file on a timer - it stays for as long as your account does, because you chose to put it there. On the Files and Vault pages you can remove a file yourself at any time. A file attached to an Investigate conversation cannot yet be removed on its own; it stays with that conversation until you delete the conversation, and deleting your account removes every file. We would rather say this plainly than imply a delete button that is not there.
4.4 Usage information
We record what happens on your account: when you sign in, what you connect and disconnect, when briefings are sent, when tools are used. We use this to run the service, to investigate problems, and to understand what is used. We do not use tracking cookies or third-party analytics on the platform. Section 10 covers cookies.
4.5 Enquiries
If you contact us through our website, we keep your enquiry and our notes on it until it is resolved and for a short period afterwards, then delete them.
5. People who appear in your data
When you connect a mailbox or an accounting system, Tennsa processes information about people you do business with. Those people did not sign up for Tennsa and have not agreed to anything with us.
You remain responsible for that information under POPIA. By connecting a system or uploading a file, you confirm that you are entitled to share the information it contains with us, and that you have a lawful basis for the processing we do on your behalf.
What we do with it is limited to what you have asked us to do. We read it to produce your briefing, answer your questions, and build your reports. We do not contact those people, we do not build profiles of them for any other purpose, and we never sell or share their information.
We minimise what we keep. Email message bodies are deleted ninety days from first ingestion - that is, ninety days after Tennsa first reads a message, not ninety days after it was sent. The clock is set once and never restarts, so re-reading a message does not extend how long we keep it. Findings and reports refer to counterparties by name because that is what makes them useful to you, but we do not keep separate records about those people beyond what appears in your own connected data.
6. How we use your information
We use the information we collect to:
- Produce your daily briefing - reading your connected systems, finding what needs attention, and sending it to you by email each morning.
- Answer your questions - when you ask Tennsa something, it answers from your own records.
- Build your reports.
- Run and improve the service - keeping it working, investigating problems, and understanding which features are used.
- Communicate with you - about your account, your subscription, and changes to the service.
We do not use your data to train AI models. Tennsa uses Google's Gemini models to phrase findings and answer questions, through Google Cloud's Vertex AI. Google Cloud's terms say Google will not use the data we send to train or fine-tune any AI model without our permission, and we have not given it. The search index over your connected mail and chat is built with Gemini embeddings, and your questions are embedded the same way to search it, on the Gemini API's paid terms, under which Google does not train on the data we send either. Every figure Tennsa shows you is computed by our own code from your records; the AI narrates, it does not calculate.
We do not sell your data, share it with advertisers, or use it for any purpose other than providing the service to you.
7. Your own AI assistant
Tennsa can connect to AI assistants you already use, such as Claude, ChatGPT or Gemini, so you can ask about your business from within those tools. This is entirely at your instruction: you initiate the connection, you authorise it, and you can revoke it at any time.
When you do this, the AI provider you have chosen receives the information their assistant requests on your behalf. What it can ask for is: your findings, on their own or grouped by business area; your data coverage, meaning which systems you have connected and what state each of them is in; your recent account activity, such as when a briefing was sent or a source was connected; your own transaction records and the stock history we have recorded, for a period you name; and answers to the questions you ask, which Tennsa draws from your connected systems and the files you have uploaded. That provider then handles it under their own privacy terms. Email-derived information is never sent through this channel - not a message, not a sender or subject, not an attachment, not the address of the mailbox and not a count of your messages - because the terms under which we access Gmail do not permit it.
We record that a tool was used and how many results it returned. We do not record the content of what was sent.
8. Google user data
Tennsa reads Gmail through Google's API using the gmail.readonly scope, which Google classifies as a restricted scope. Google requires us to state plainly what we do with what we read, and you are entitled to know it, so this section says so in one place.
What we ask Google for. gmail.readonly, to read your messages; and openid, email and profile, to sign you in. Nothing else. We do not request access to Google Drive, or to any other Google service.
What we use it for. Three things: producing your daily briefing, grounding the answers Tennsa gives when you ask it a question, and detecting operational patterns across your connected systems.
What we do not do with it. We do not train AI models on it. We do not sell it, and we do not use it for advertising. We do not share it with anyone outside the service providers listed in section 11. We never send email-derived information to an AI assistant you have connected under section 7 - that channel excludes it by construction, not by policy.
How long we keep it. Message bodies are deleted ninety days from first ingestion. Metadata and embeddings persist for the life of the account.
Tennsa's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at developers.google.com/terms/api-services-user-data-policy.
9. Where your information is stored and processed
Tennsa runs on Google Cloud.
Your data is stored in Johannesburg, South Africa (Google Cloud region africa-south1): the database, the file storage, and the application itself.
Five things sit outside South Africa, and we would rather name them than describe them vaguely:
- Backups of the database are held in Google's European multi-region. The live database is in Johannesburg; its backup copies are not.
- The search index that lets Tennsa find relevant emails, Slack messages and documents runs in Google Cloud's europe-west4 region, in the Netherlands. It holds the numerical representations Tennsa searches on, not your message text.
- Document search over files you upload runs on a Google Cloud service configured as multi-region rather than pinned to one country.
- The Gemini models that phrase findings and answer your questions are reached through Google Cloud's Vertex AI on its global endpoint, which is not tied to a particular region, so we cannot tell you a country for it.
- The embeddings - the numerical representations the search index holds - are computed by Google's Gemini API from the text of the emails and Slack messages Tennsa indexes, and from the questions you ask, through its global endpoint, which is likewise not tied to a particular region.
Where information leaves South Africa it goes to Google, which is bound by contractual terms that provide substantially similar protection to POPIA, as section 72 of POPIA requires. It does not go to anyone else.
10. Cookies
Tennsa sets two cookies in total, and neither one tracks you.
The platform sets a session cookie that keeps you signed in. It is essential to the service and is deleted when you sign out or when it expires.
The public website sets one cookie when you dismiss our cookie notice, so that the notice is not shown to you again. It records nothing but the fact that you dismissed it.
We do not use analytics cookies, advertising cookies, or any third-party tracking, on the platform or on the website. The Cookie Policy at the end of this page has the detail.
11. Who else handles your information
We use a small number of service providers to run Tennsa. Each processes information only as we instruct and only to provide their service to us.
| Provider | What they do | Where |
|---|---|---|
| Google Cloud | Hosting, database, file storage, search index, AI models (Vertex AI), and the embeddings for the search index (the Gemini API) | Johannesburg (africa-south1) for the database, file storage and application; database backups in the European multi-region; the search index in europe-west4, Netherlands; document search multi-region; the Gemini models and the embeddings on global endpoints |
| Google Workspace | Email and internal documents | Google's data centres |
| Paystack | Subscription payments | South Africa |
| Cloudflare | Content delivery and web security | Global edge network |
When you connect an AI assistant under section 7, the provider of that assistant becomes a recipient of your information at your instruction. They are not our service provider; you have chosen them.
We do not otherwise share your information with any third party unless required by law.
12. How long we keep it
| Information | Retention |
|---|---|
| Account information | Life of your account, then deleted |
| Connected source data (accounting, inventory, payments, commerce, CRM, calendar) | Life of your account, or until you disconnect that source in Tennsa, when what we hold from it, including the history we recorded from it, is deleted |
| Email message bodies | Ninety days from first ingestion, then deleted |
| Email metadata and search index | Metadata and embeddings persist for the life of the account, or until you disconnect that mailbox in Tennsa |
| Slack message text | Ninety days from first ingestion, then deleted |
| Slack message metadata and search index | Metadata and embeddings persist for the life of the account, or until you disconnect Slack in Tennsa, your workspace removes the Tennsa app from Slack, or the channel they came from is made private |
| Investigate conversations (your questions and Tennsa's answers, which can quote an email or a Slack message) | Life of your account, or until you delete the conversation |
| Findings and briefings | Life of your account |
| Files you upload | Life of your account, or until you delete the file where the page you uploaded it from offers that, or delete the Investigate conversation you attached it to |
| Usage records | Life of your account |
| Enquiries you send us through our website, and our notes on them | Until the enquiry is resolved, then for ninety days, then deleted |
If cancelling your subscription with our payment provider fails during account deletion, we keep only the subscription reference, and only until the cancellation succeeds, so that you are not billed after your account is gone. Nothing else about you is retained for this.
If we change what we keep, we will change this policy first and tell you.
13. Deleting your account
You can delete your account at any time from your account settings. When you do:
- Every connection is closed. Where the provider supports it, we revoke our access at the provider itself. Some connections use a key or password you issued to us, which no provider lets us revoke - for those we delete the credential, so we can no longer reach the system, and you should also cancel the key in that system.
- All connected data, cached data, email content, search index entries, uploaded files, findings and usage records are deleted.
- We keep a record that deletion happened, with no personal information in it, so we can confirm it was completed.
Deletion is checked by an automated process that re-runs until nothing remains. If any part fails, it retries; we do not mark an account as deleted until every part has succeeded.
14. How we protect your information
- All connections to Tennsa use TLS encryption.
- Credentials for connected systems are encrypted at rest.
- Email and Slack message content is encrypted at rest.
- Access to production systems is limited to the people who operate the service.
- We keep audit records of sign-ins, password changes and connection events.
- Every part of the platform is covered by automated tests, including tests that prove connections are read-only and that deletion is complete.
No system is perfectly secure. If we become aware of a breach affecting your information, we will tell you and the Information Regulator as POPIA requires.
15. Your rights
Under POPIA you have the right to:
- Know what we hold about you and to receive a copy.
- Correct information that is wrong.
- Delete your information, subject to any legal obligation to keep it.
- Object to processing in certain circumstances.
- Withdraw consent where processing is based on consent.
- Complain to the Information Regulator if you believe we have not handled your information properly.
To exercise any of these, write to info@tennsa.com. We will respond within thirty days.
If you are a person who appears in a customer's data and you have a question about how your information is being handled, you should first contact the business you have a relationship with, as they are the responsible party. If you cannot resolve it with them, you may contact us and we will help.
16. Children
Tennsa is a business tool and is not intended for anyone under eighteen. We do not knowingly collect information from children.
17. Changes to this policy
When we change this policy we will update the date at the top and, for material changes, tell you by email. The current version is always at tennsa.com/privacy.
18. Contact and complaints
Tennsa (Pty) Ltd
51 Gogosoa Street, Observatory, Cape Town, Western Cape 7925
South Africa
info@tennsa.com
Information Officer: Rivar Maharaj, info@tennsa.com
Information Regulator of South Africa
JD House, 27 Stiemens Street, Braamfontein, Johannesburg
complaints.IR@justice.gov.za
inforegulator.org.za
Cookie Policy
This is short, because Tennsa uses very few cookies. Everything - the public pages and the signed-in product alike - runs on tennsa.com, so there is one site and the two cookies below are all of them.
What a cookie is
A cookie is a small text file a website places on your device. Some are essential for a site to work; others track behaviour or serve advertising. We only use the first kind.
The cookies we use
When you are signed in
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in as you move between pages | Until you sign out, or expiry |
This is the only cookie the platform sets. It is essential - without it you cannot stay signed in - so it does not require your consent and cannot be switched off while using the service.
On the public pages
| Cookie | Purpose | Duration |
|---|---|---|
| Cookie preference | Remembers whether you have seen and acknowledged this notice | Twelve months |
What we do not use
We do not use analytics cookies, advertising cookies, social media pixels, or any third-party tracking on the platform or the public website. We removed Google Analytics in September 2026 and have not replaced it.
We use Cloudflare to deliver the website. Cloudflare may set a cookie to protect against automated abuse; this contains no personal information and is used only for security.
Managing cookies
You can block or delete cookies in your browser settings. If you block the session cookie, you will not be able to sign in to Tennsa.