Privacy Policy

1. Who we are

Crosspost is operated by Gainly, a South African business. Crosspost automatically posts your Zapper settlement data into your Xero accounting. We handle information in line with the Protection of Personal Information Act, 2013 (POPIA). This policy covers the Crosspost product; the Gainly marketing site has its own privacy policy.

2. Our role

For the financial data we process on your behalf, you are the responsible party and Crosspost is the operator. We process it only on your instruction, to run the service. For your own account information, we are the responsible party. The detail is set out in our Operator (Data-Processing) Terms.

3. What we collect

Your account details (name, email); the connection credentials needed to read your Zapper settlements and write to your Xero; your settings (such as which bank account your payouts land in and your VAT status); and summaries of the activity we perform for you. Billing details are handled by our payment provider. We do not collect or store your customers’ card data, your bank login, or a copy of your Xero ledger.

One cookie. When you sign in, Crosspost sets a single first-party cookie named cp_session so you stay signed in. It is cryptographically signed, lasts up to 30 days, and is strictly necessary to run the service. It does not track you, and we set no analytics or advertising cookies.

4. Why we process it

To provide and bill the service (performance of our contract with you), to comply with legal obligations, and for legitimate interests in operating, securing and supporting it. Where any processing relies on your consent, you may withdraw that consent at any time.

5. Sub-processors

We use trusted third-party providers for cloud hosting and infrastructure, and a payment provider (Paystack) for billing; your Xero is your own system that we write to. Each processes only what it needs. A current list of sub-processors is available on request via our contact form.

6. Where your data is processed

We use reputable global cloud infrastructure. Your information may be processed or stored outside South Africa; where it is, we rely on providers that maintain appropriate, recognised data-protection safeguards (POPIA section 72).

7. Retention

We keep your data while your account is active. After cancellation we delete or anonymise your account data within a reasonable period (typically 30 days), except records we are required to keep by law (such as billing and tax records, kept for the period South African law requires).

8. Your rights

You have the right to access, correction, deletion (subject to legally-required records), objection, and complaint. Make any request through our contact form. You may also complain to the Information Regulator (South Africa): inforegulator.org.za. Much of your data is under your direct control (see section 10).

9. Security

We protect your information with strong, industry-standard encryption and appropriate technical and organisational measures. Connection credentials are encrypted and never stored in plain text. We request only the minimum Xero permissions we need, and never store card data or bank logins. No system is perfectly secure, but we take the reasonable, appropriate measures POPIA requires.

10. How to disconnect

You can revoke Crosspost’s Xero access at any time from Xero’s connected-apps settings, and cancel your subscription in-app at any time. On disconnect we stop processing and your data follows section 7. Your Xero ledger is left exactly as it is.

11. Children

Crosspost is a business tool and is not intended for use by anyone under 18.

12. Changes

We may update this policy. We will post the new version and its “Last updated” date, and we will communicate material changes to you.

13. Contact & Information Officer

All requests (support, privacy, and Information Officer matters) should be made through our contact form.