PAIA manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA). It explains which records Warren keeps and how you can ask for access to them. Warren is a budgeting app run by Martin Flischman, a sole proprietor based in South Africa, at warrenapp.app.

• Head of the business and person responsible for information requests: Martin Flischman
• Email: hello@warrenapp.app
• Website: https://warrenapp.app
• Postal address and phone number: available on request by email

The Information Regulator has published a guide in each official language on how to use PAIA and POPIA to ask for information. You can get it from the Regulator: inforegulator.org.za, enquiries@inforegulator.org.za, 010 023 5200, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

These are on the website for everyone: the Terms of Service, the Privacy Policy, this manual, the frequently asked questions and the list of updates (What's new).

• Customer records: accounts (email address and name), what each customer enters in the app (expenses, income, budgets, repeating expenses, category rules and settings), and purchase records (plan, status, dates and the payment provider's references).
• Communications: emails and messages sent to and from Warren.
• Security and technical records: encrypted backups (kept for 30 days) and the technical logs of the companies that run Warren.
• Business records: income and tax records, and agreements with the companies that help run Warren.

Some records are kept because other laws require it, for example the Income Tax Act, the Tax Administration Act, the Consumer Protection Act, the Electronic Communications and Transactions Act and POPIA.

• Why: to run Warren for its customers: sign-in, saving and showing their records, budgets and alerts, payments and refunds, support, and keeping the service secure.
• Whose: customers and people who buy a plan or write to us. The information is listed in section 5 and in the Privacy Policy.
• Who receives it: only the companies that help run Warren (Supabase, Cloudflare, Resend, Google, Creem, GitHub, Porkbun and Apple), and anyone the law requires.
• Other countries: data is stored in Switzerland, backups in the European Union, and some companies are based in the United States or use servers elsewhere, under the safeguards the Privacy Policy describes.
• Security: encrypted connections and storage, every record locked to its owner's login in the database, two-factor sign-in for the accounts that run Warren, a bot check, optional 2-Step Verification for customers, and encrypted nightly backups.

The Privacy Policy gives the full details and explains how to see, correct or delete your own information. You don't need a PAIA request for your own information: just write to us.

Fill in Form 2 (Request for access to a record), available from the Information Regulator's website, and email it to hello@warrenapp.app. Say which record you want, in which form, and, if you are asking on someone else's behalf, in what capacity. The fees are those set in the PAIA Regulations; there is no fee to ask for your own personal information. We'll answer within 30 days (the law allows one extension of up to 30 days, which we would explain). A request can be refused only on the grounds PAIA sets out, for example to protect someone else's privacy or confidential business information, and we would tell you why.

This manual is on the website at warrenapp.app/paia-manual. Email hello@warrenapp.app for a free copy.