MBMyBooks.Africa
AfricaAfrica
Africawww.mybooks.africaEU, UK & Switzerlandthewest.mybooks.africa

Each site has its own sign-in and its own books.

Privacy policy

Last updated 18.10.2026

This policy explains what personal information CT Sunrise Investments (Private) Limited (trading as MyBooks.Africa) collects, why, who we share it with, and the rights you have under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and its regulations.

1. Who is responsible

The data controller is CT Sunrise Investments (Private) Limited, Harare, Zimbabwe, Zimbabwe. Email admin@mybooks.africa.

Data Protection Officer: admin@mybooks.africa.

2. What we collect

  • Visiting the website: your IP address, browser type, the pages you open and the time, in our server logs. One session cookie keeps you signed in (see Cookies). We use no analytics, advertising or tracking tools.
  • Applying for an account: company name, country, VAT or tax number, registration number, website, your name, email and phone, your message, and the documents you upload: the certificate of incorporation and proof of identity (passport or national ID).
  • Free business planner: your name, email and country, the working name of your idea, the business plans you enter, sign-in times and, for an investor pack you send, the recipient's name and email and when the pack was opened. Your plans are visible only to you and to the people you send them to; our team has no screen that shows them. You can delete your planner account at any time at the bottom of your plans list: your plans and investor links are deleted at once and your sign-in is removed if you use it for nothing else.
  • Business directory (only if an owner lists your company): the name, description, categories, location and contact details the owner enters, shown to signed-in members, or also on our public website if the owner chooses "Public" (active members only). The listing email is confirmed by a link before anything is shown. We count views of your listing and clicks to contact you (website, phone, WhatsApp, messages), with the member and company who clicked, to show you and our team the traffic. Messages sent through the directory go by email to the address you listed; we do not keep their text. Remove the listing at any time under Business directory, My listing.
  • Using your account: the names and email addresses of the users of your company, sign-in times, and a log of important changes in your books (who changed what, and when).
  • Your books: everything you enter, including your customers' and suppliers' details. Here we act for you, as your processor (see our terms, section 5).
  • Payments: our payment provider tells us whether a payment succeeded, the amount and a reference. We never receive your full card details.
  • Contact form: your name, email, company, phone and message.
  • Newsletter: your email address, when and from which IP address you subscribed and confirmed, and the wording you agreed to.
  • Financing (only if an owner switches it on): when and by whom financing was switched on, and for every lender pack you share: the lender's name and email, the date, the amount and purpose you entered, when the pack was opened (time, IP address and browser of the person opening it) and, for partner lenders, the outcome and any referral fee. The pack itself is stored encrypted with a key that exists only in the link sent to the lender; we cannot read it.

3. Why we use it

  • To review applications, verify that a company and its representative are real, and prevent fraud.
  • To provide the service, sign you in, and send emails the service needs (sign-in links, payment and account notices).
  • To bill the subscription and keep the accounting and tax records we are legally required to keep.
  • To answer your messages.
  • To send the newsletter, only if you asked for it and confirmed your address.
  • To keep the service secure and find faults.
  • If you choose to share a lender pack: to deliver it to the lender you picked, show you when it is opened, and record referrals to partner lenders and their outcome so that referral fees can be settled.

We rely on the contract with your company, our legal obligations, your consent (newsletter, contact form), and our legitimate interest in running a secure service. We do not make automated decisions about you.

We do not sell or rent your data, we do not show advertising, and we do not use the contents of your books for our own purposes. Your company's figures leave MyBooks.Africa only when an owner sends a lender pack, and only to the lender chosen. We are paid by our customers through the subscription. Partner lenders may also pay us a referral fee when they finance a company that chose to apply through us; the company never pays us for this.

4. Who we share it with

  • Payrexx AG, Switzerland: card payments.
  • Resend, United States: delivery of our emails.
  • Anthropic, United States: only if your company switches on "AI reading" in its Inbox, the text or photo of the documents you upload there is sent to Anthropic's Claude to be read. Off by default; without it, documents are read in your own browser and on our server.
  • Our hosting provider, CH: the server that runs the website and stores the database and documents.
  • Lenders and investors you choose: only when an owner of your company sends a lender pack or an investor pack (business plan), the pack goes to the lender or investor named. What the lender does with it is governed by that lender's own terms and privacy policy.
  • Our professional advisers, and authorities such as ZIMRA, POTRAZ, courts or the police, when the law requires it.

Each provider receives only what it needs for its task and is bound to keep it confidential and secure.

5. Transfers outside Zimbabwe

Some of these providers are outside Zimbabwe (Switzerland, the United States and CH). We transfer personal information only where the Act allows it: to countries or recipients with adequate protection, under written agreements that require such protection, or where the transfer is needed to perform our contract with you. We notify POTRAZ of such transfers as the Act requires.

6. How long we keep it

  • Applications that we decline, with their documents: 6 months after the decision, then deleted automatically.
  • Access recovery requests: the documents are deleted automatically 6 months after the decision; the record that access was restored stays in your activity log.
  • Company documents for the validation every 2 years: for as long as the account exists, so we can compare them at the next validation or when you ask us to recover access.
  • Approved companies: for as long as the account exists, then account and billing records for at least six years, as Zimbabwean tax law requires.
  • Your books: see the terms, section 5.
  • Contact messages and our replies: 2 years. Messages whose sender never confirmed the email address: deleted after 7 days.
  • Newsletter: until you unsubscribe. We then keep only your email address and the date, so that we respect your choice.
  • Server logs: up to 90 days.

7. Security

The site uses HTTPS only. There are no passwords to steal: you sign in with one-time links that expire.

Your books are separated by company: only the users of your company can see them. Our admin tools show a company's name, status and subscription, but not the contents of its books, and admins cannot sign in as you. When support sends you a new sign-in link, it goes to your own email address; our team never sees it.

The identity and company documents you upload (when applying, or when asking to recover access) are locked in a document vault: each file is encrypted with its own key, which is sealed with a key that only our admins can unlock with a passphrase that is never stored on the server. Someone with access to the server, its files or its backups cannot open them. Technical access to the server and database is limited to the people who run the service, and only for operating and securing it.

If your company loses access (for example, the person who managed the account left), we restore it only after checking identity documents and your authority to act for the company against what we have on file. The sign-in link is emailed to the person, the other owners are informed, and the recovery is recorded in your activity log.

Every important change in your books is recorded in an activity log you can see and download.

If a security breach affects personal information, we report it to POTRAZ within 24 hours of becoming aware of it, and inform the people affected within 72 hours where there is a high risk to them.

8. Your rights

You may ask us at any time to:

  • tell you what personal information we hold about you and give you a copy;
  • correct information that is wrong or incomplete;
  • delete information we no longer need or are not allowed to keep;
  • stop using your information for direct marketing. Every newsletter has an unsubscribe link, and you can object at any time;
  • withdraw a consent you gave, without affecting what we did before;
  • receive your data in a common, machine-readable format to take to another provider. Owners can do this themselves at any time under Settings, Your data.

Write to admin@mybooks.africa. We reply within 30 days and may ask you to confirm your identity first. If you are not satisfied with our answer, you can complain to the Data Protection Authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

9. Children

MyBooks.Africa is a service for businesses and is not meant for anyone under 18.

10. Changes

When we change this policy, we update the date at the top. If a change materially affects how we use your information, we tell account owners and newsletter subscribers by email.