Privacy Policy

1. Who is responsible for your information

Own Invoice is operated by [[ COMPLETE: registered legal entity name and registration number ]] of [[ COMPLETE: registered address ]]. This policy explains what we do with personal information, and it is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

Our Information Officer can be reached at [[ COMPLETE: information officer name and email ]].

2. Two kinds of information, two different roles

Your information. For your own account details we are the responsible party. We decide what we collect and why, and this policy tells you.

Your clients' information. When you save a client or issue an invoice, you decide what to record about that person. For that information you are the responsible party and we are your operator: we hold and process it on your instruction, and we do not use it for our own purposes.

That means your clients' privacy questions come to you, not to us, and it is your responsibility to have a lawful basis for the client information you record.

3. What we collect

Account information

• Your email address, which we verify before the account can be used
• Your business name and, if you upload one, your business logo
• A securely hashed version of your password — we never store the password itself
• Whether you have enabled two-factor sign-in

Billing information

• Your plan, its status and renewal date, and any invoice passes you hold
• A record of payments taken, including amount, currency and date
• An identifier linking you to your record at our payment provider. We never see or store your card details — those go directly to the payment provider.

Client and invoice information you enter

• Client name, email address, phone number and postal address
• Client tax or VAT registration numbers, which we store encrypted
• Invoice contents: line items, amounts, dates, notes and payment terms
• A record of which invoices were emailed, to whom and when

Technical information

• A session cookie so you stay signed in. We do not use advertising or tracking cookies.
• Server logs recording errors and requests, kept for security and diagnosis

4. Why we use it

• To provide the service: creating, storing, rendering and delivering your invoices
• To bill you, and to apply the allowances your plan includes
• To send service email: verification, sign-in links, and invoices you ask us to deliver
• To send payment reminders to your clients, where you have enabled that on an invoice
• To keep the service secure, and to detect and prevent abuse
• To meet our own legal and tax obligations

We do not sell personal information, and we do not use your invoice or client data to advertise to you or to anyone else.

5. Who else processes it

We use a small number of providers, each for one purpose:

• Our payment provider — to take payments and manage subscriptions. They receive your email address and payment details; we receive confirmation and a customer reference.
• Our email provider — to deliver verification email, sign-in links and the invoices you send.
• Our hosting provider — which runs the servers and database the service uses.

Some of these providers process information outside South Africa. Where that happens we rely on their contractual commitments to protect it to a standard comparable to POPIA.

We do not otherwise share your information, unless we are legally required to, or it is necessary to establish or defend a legal claim.

6. How we protect it

• Traffic to the service is encrypted in transit
• Tax and VAT numbers are encrypted before they are written to the database
• Passwords are stored only as a secure one-way hash
• Optional two-factor sign-in using a one-time code sent to your verified address
• Invoices carry an integrity seal, so a record altered outside the app can be detected

No service can promise perfect security. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

7. How long we keep it

We keep your account and invoice information for as long as your account is open. Deleting your account removes your account details, your saved clients and your invoice records. Deletion cannot be undone, so export anything you still need first.

We keep payment records for as long as tax and company law requires us to, even after an account closes. Server logs are kept for a short period and then discarded.

8. Your rights under POPIA

You have the right to:

• ask what personal information we hold about you, and to receive a copy;
• ask us to correct information that is wrong or incomplete;
• ask us to delete information we no longer have a reason to keep;
• object to processing in certain circumstances;
• complain to the Information Regulator.

To exercise any of these, contact our Information Officer at the address in clause 1. If your request is about information that one of our users recorded about you as their client, we will point you to that user, because they are the responsible party for it.

The Information Regulator of South Africa can be contacted at inforegulator.org.za.

9. Changes to this policy

We may update this policy. If a change materially affects how we handle your information, we will tell you by email or in the app. The date at the top shows when it last changed.

Our Terms of Service cover the rest of your relationship with us.