Terms of Service

Acceptance of Terms

By registering for an account, accessing the Sorae platform, or making any call to the Sorae API, you (the Client) agree to be bound by these Terms of Service (Terms), our Privacy Policy, and our PAIA Manual, all of which are incorporated into these Terms by reference.

If you are entering into these Terms on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind that entity to these Terms. In that case, references to you and Client refer to that entity.

If you do not agree to these Terms, you must not access or use the Sorae platform.

Who May Use Sorae

Sorae is a business-to-business (B2B) service. Access is limited to registered legal entities and sole proprietors conducting lawful commercial activities in the Republic of South Africa or in jurisdictions where use of the service is not prohibited. To register, you must:

• Be a duly registered company, close corporation, trust, or other legal entity, or a natural person acting in a commercial capacity
• Have a valid South African business email address
• Have the legal authority to accept these Terms on behalf of your entity
• Be at least 18 years of age if registering as a natural person
• Not be subject to any sanction, restriction, or prohibition that would make your use of the service unlawful

Sorae is not a consumer-facing service. It is not intended for use by individuals seeking to analyse their own financial affairs. Individual consumers whose bank statements are submitted via the API by a Client remain third-party data subjects — they are not Clients under these Terms.

The Service

Sorae provides an API-based financial intelligence platform that accepts South African bank statement PDFs and returns structured analytical output. The core capabilities of the service include:

• Automated parsing of Capitec bank statements, with FNB, ABSA, Standard Bank, and Nedbank in active development
• Verified income detection including salary date, consistency scoring, and income source classification
• Expense categorisation across rent, debt repayments, groceries, transport, utilities, insurance, subscriptions, and other categories
• Affordability scoring and grade with a recommended maximum monthly instalment aligned to NCR guidelines
• Behavioural risk flag detection covering returned debit orders, pre-payday cash withdrawals, negative balances, gambling activity, and multiple active loans
• Plain-language summary narrative for decision-makers

3.1 Service Availability

Sorae is provided on a commercially reasonable efforts basis. We do not guarantee uninterrupted or error-free access. Planned maintenance will be communicated in advance where reasonably practicable. We reserve the right to modify, suspend, or discontinue any feature of the service at any time with reasonable notice.

3.2 Beta Features

Features labelled as beta, preview, or experimental are provided without warranty and may be changed, limited, or withdrawn at any time without notice. Parser support for banks other than Capitec is currently in development and is not covered by any service level commitment.

Account Registration

To access the Sorae API you must create an account. You agree to provide accurate, complete, and current information during registration and to keep that information updated. You are responsible for all activity that occurs under your account.

4.1 Email Verification

Account activation requires email verification. Unverified accounts are inactive and may not make API calls. Verification tokens expire after 10 minutes for security reasons.

4.2 Data Processing Agreement

Before your account is fully activated, you must accept our Data Processing Agreement (DPA). The DPA governs the processing of personal information of third-party data subjects whose bank statements you submit via the API. Acceptance is recorded with a timestamp and a one-way hash of your IP address in accordance with POPIA. You may not use the API without a valid DPA acceptance on record.

4.3 One Account Per Entity

Each legal entity may maintain one active account. Creating duplicate accounts to circumvent credit limits, suspensions, or any other restriction is a material breach of these Terms and will result in immediate termination of all accounts associated with that entity.

API Keys & Security

API keys are the sole authentication mechanism for the Sorae API. Each key is generated by you from the dashboard and is scoped to your account.

• API keys are shown in full only once at creation — store them securely immediately
• Keys are stored as one-way cryptographic hashes in our database; we cannot recover a lost key
• You may create multiple keys and revoke any key at any time from the dashboard
• You must revoke any key that you believe has been compromised without delay
• Do not embed API keys in client-side code, public repositories, or any environment accessible to unauthorised parties
• All API calls must be made over HTTPS — calls over HTTP are rejected

API calls are logged as metadata only (timestamp, response code, processing time, reference field). No statement content is included in any log. You are responsible for all API calls made using your keys regardless of whether you authorised them.

Credits & Billing

Sorae operates on a prepaid credit model. All API calls consume credits from your account balance. You must maintain a positive balance to make API calls.

6.1 Pricing

The current price per API call is published on the pricing page of the Sorae website and within the dashboard. Pricing is displayed inclusive of VAT at the applicable rate. We reserve the right to change pricing with 30 days advance written notice to your registered email address.

6.2 Top-Ups

Credits are purchased by topping up your account balance via the billing section of the dashboard. Payments are processed by PayFast, a South African payment gateway. By completing a top-up you agree to PayFast's terms and conditions in addition to these Terms. Credits are added to your balance upon confirmed receipt of payment.

6.3 No Refunds

All credit purchases are final and non-refundable except where required by applicable South African law. Credits have no cash value and are not transferable to another account. Unused credits are forfeited upon account termination unless otherwise agreed in writing.

6.4 Failed Calls

Credits are only deducted for API calls that return a successful analysis result. Calls that fail due to an unsupported bank, an unreadable PDF, a server error, or any other error on our side are not charged. Calls that fail due to an invalid request, an expired key, or an insufficient balance are not charged.

6.5 VAT

Sinneo Financial Technologies (Pty) Ltd is a registered VAT vendor in the Republic of South Africa. VAT at the applicable rate is included in all pricing. A valid tax invoice will be issued for each credit purchase.

Acceptable Use

You may use Sorae only for lawful purposes and only in accordance with these Terms. You agree that you will not, and will not permit any third party to:

• Submit bank statements without the prior, explicit, informed consent of the individual to whom the statement belongs, as required by POPIA
• Use analysis results to make credit, rental, or employment decisions in a manner that violates the National Credit Act 34 of 2005, the Rental Housing Act 50 of 1999, or the Employment Equity Act 55 of 1998
• Submit fraudulent, altered, or fabricated bank statements to the API
• Attempt to reverse-engineer, decompile, or extract the parsing logic, scoring models, or any other proprietary component of the service
• Use the service to build a competing product or to assist a third party in building a competing product
• Probe, scan, or test the vulnerability of any Sorae system or network
• Attempt to circumvent any rate limit, authentication mechanism, or access control
• Resell, sublicense, or otherwise make the API available to third parties without our prior written consent
• Use the service in any way that could damage, disable, or impair the service or its infrastructure
• Submit any content that infringes any intellectual property right, or that is defamatory, fraudulent, or unlawful

You are solely responsible for ensuring that your use of Sorae complies with all applicable laws and regulations, including but not limited to the National Credit Act, POPIA, PAIA, and any applicable sectoral regulations issued by the National Credit Regulator or the Financial Sector Conduct Authority.

Data & Privacy

8.1 Your Obligations as Responsible Party

When you submit a bank statement to the Sorae API, you are the Responsible Party in terms of POPIA in respect of the personal information of the individual whose statement you are submitting. Sinneo Financial Technologies acts as the Operator. This means you are responsible for:

• Obtaining the data subject's prior, explicit consent to submit their bank statement for automated processing
• Informing the data subject of the purpose for which their statement is being processed
• Ensuring that your collection and use of the statement complies with all eight conditions for lawful processing under POPIA
• Responding to any access, correction, or deletion requests from the data subject in respect of analysis results you hold

8.2 Our Zero Retention Commitment

Sorae processes bank statement content exclusively in server memory. No statement data — raw or parsed — is written to disk, stored in a database, or retained in any form after the API response is returned. This is a core technical and contractual commitment, not merely a policy. For full details, see our Privacy Policy.

8.3 Analysis Results

The structured analysis result returned by the API is your property. We do not retain copies of analysis results. You are responsible for storing, securing, and managing access to results in accordance with POPIA and any other applicable law.

8.4 Data Processing Agreement

Your DPA acceptance on registration constitutes the operator agreement required by section 21 of POPIA. The DPA is incorporated into these Terms by reference. If you require a signed, standalone DPA for your internal compliance requirements, contact us at legal@sorae.co.za.

Intellectual Property

All intellectual property rights in and to the Sorae platform, including the API, the bank statement parsers, the scoring models, the risk detection logic, the dashboard, and all associated software and documentation, are owned exclusively by Sinneo Financial Technologies (Pty) Ltd or its licensors.

Nothing in these Terms grants you any right, title, or interest in or to our intellectual property except the limited right to use the service as expressly set out in these Terms. The Sorae name, logo, and all associated marks are trademarks of Sinneo Financial Technologies (Pty) Ltd. You may not use any of our marks without our prior written consent.

9.1 Feedback

If you submit feedback, suggestions, or ideas about the service, you grant us a perpetual, irrevocable, royalty-free licence to use that feedback for any purpose without restriction or obligation to you.

Disclaimers

The Sorae service is provided as is and as available, without warranty of any kind, express or implied. To the fullest extent permitted by South African law, Sinneo Financial Technologies expressly disclaims:

• Any warranty that the service will be uninterrupted, timely, secure, or error-free
• Any warranty as to the accuracy, completeness, or reliability of analysis results produced by the service
• Any warranty that the service will meet your specific requirements or produce any particular outcome
• Any implied warranty of merchantability, fitness for a particular purpose, or non-infringement

Limitation of Liability

To the fullest extent permitted by applicable law, and in no event will Sinneo Financial Technologies (Pty) Ltd, its directors, employees, or agents be liable to you for any:

• Indirect, incidental, special, consequential, or punitive damages
• Loss of profits, revenue, data, business, or goodwill
• Damages arising from your reliance on an analysis result that proves to be inaccurate
• Damages arising from service downtime, API errors, or parser failures
• Damages arising from unauthorised access to your account through no fault of ours

In any event, our total aggregate liability to you in respect of all claims arising from or relating to these Terms or your use of the service during any 12-month period shall not exceed the total amount of credits purchased by you during that same 12-month period.

Nothing in these Terms shall exclude or limit our liability for fraud, gross negligence, or wilful misconduct, or for death or personal injury caused by our negligence, or for any other liability that cannot be excluded or limited by South African law.

Indemnification

You agree to indemnify, defend, and hold harmless Sinneo Financial Technologies (Pty) Ltd and its directors, officers, employees, and agents from and against any and all claims, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or relating to:

• Your use of the service in violation of these Terms
• Your violation of any applicable law, including POPIA, the National Credit Act, or the ECT Act
• Your submission of a bank statement without the required consent of the data subject
• Any decision made by you based on a Sorae analysis result
• Any claim by a third party arising from your processing of their personal information
• Any infringement by you of any intellectual property or other right of any third party

Suspension & Termination

13.1 Termination by You

You may close your account at any time by contacting us at support@sorae.co.za. Account closure is effective within 5 business days of your written request. Unused credits are forfeited upon closure unless otherwise agreed. All API keys associated with your account are immediately revoked upon closure.

13.2 Termination or Suspension by Us

We may suspend or terminate your account immediately and without notice if:

• You breach any provision of these Terms, particularly the Acceptable Use provisions in Section 7
• We reasonably believe your account is being used fraudulently or in a manner that harms us, other clients, or third parties
• You fail to pay any outstanding amount owed to us
• We are required to do so by applicable law or a competent authority
• You become insolvent, are placed under business rescue, or are wound up

We may also terminate your account with 30 days' written notice for any other reason. In the event of a no-fault termination by us, we will refund the rand value of any unused credits calculated at the prevailing per-call rate.

13.3 Effect of Termination

Upon termination, your right to access the service ceases immediately. We will retain your account metadata in accordance with our data retention schedule as set out in our Privacy Policy. Sections 8, 9, 11, 12, 15, and this clause 13.3 survive termination of these Terms.

Changes to These Terms

We may update these Terms from time to time to reflect changes in the service, applicable law, or our business practices. When we make material changes we will:

• Update the "Last updated" date at the top of this page
• Send a notification to your registered email address at least 14 days before the changes take effect
• Display a notice in your dashboard for 30 days after the changes take effect

Your continued use of the service after the effective date of the updated Terms constitutes your acceptance of the changes. If you do not agree to the updated Terms, you must stop using the service and close your account before the effective date.

Governing Law & Disputes

These Terms are governed by and construed in accordance with the laws of the Republic of South Africa. You submit to the exclusive jurisdiction of the courts of South Africa for the resolution of any dispute arising from or relating to these Terms or your use of the service.

15.1 Dispute Resolution

Before instituting legal proceedings, both parties agree to attempt to resolve any dispute through good-faith negotiation for a period of 30 days after written notice of the dispute is given by either party. If the dispute is not resolved within that period, either party may refer the matter to a South African court of competent jurisdiction.

15.2 Online Dispute Resolution

In terms of section 69 of the ECT Act, Sorae subscribes to the following accredited alternative dispute resolution body, to which you may refer any unresolved complaint:

15.3 Severability

If any provision of these Terms is found to be invalid, unlawful, or unenforceable by a competent court, that provision shall be severed from these Terms and the remaining provisions shall continue in full force and effect.

Contact

For any questions or concerns regarding these Terms, contact us using the details below. We will respond to all written enquiries within 5 business days.

You also have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your personal information or a PAIA request in accordance with applicable law.