Your information,
handled with care.

Who is responsible

PaidNow is responsible for owner account, support, security and service administration information. When a business uses PaidNow for its customers, that business is the responsible party for those customer records and PaidNow processes them to provide the service.

Contact our Information Officer for business correspondence details.

Information Officer: Information Officer. Contact: epaidnow@gmail.com.

Information we collect and its sources

We receive information from you, the business that invoices you, authorised workspace users, service providers and your use of the service. This includes names, email addresses, phone numbers, business addresses and tax details; customer and supplier billing details; quotes, invoices, credit notes and uploaded logos; subscription, payment and refund records, provider references, encrypted payment-connection credentials and reusable billing authorisation tokens; WhatsApp messages and delivery records; AI conversations and proposals; support correspondence; and login, device, request and audit records.

Payment providers collect payment credentials through their hosted services and may collect identity documents and bank details for their own merchant verification. PaidNow does not collect or store card numbers or security codes. This invoicing service does not currently provide earned wage access or collect payroll, shift records or South African ID numbers for its own KYC process.

How and why we use information

We use information to administer accounts and subscriptions, create and retain financial documents, facilitate payments and refunds, reconcile transactions, deliver approved invoice messages and reminders, provide support, secure and improve the service, prevent fraud and comply with applicable legal obligations. Required account and transaction fields enable these features; without them we may be unable to provide the relevant service. Optional profile details are voluntary.

AI features produce proposals for human review; they do not independently approve financial writes. We do not use these proposals to make solely automated decisions with legal or similarly significant effects on you.

Lawful grounds and consent

Depending on the purpose, we rely on consent, steps necessary to enter into or perform a contract, applicable legal obligations, or legitimate interests such as service security and fraud prevention, subject to your rights under POPIA. Acknowledging this notice is not blanket consent to every use of information.

You may withdraw consent where processing relies on it. Withdrawal does not invalidate earlier lawful processing or prevent processing justified on another lawful ground. New uses must be compatible with the original purpose or separately justified under POPIA, with further notice where required. Electronic direct marketing, if introduced, must meet POPIA section 69 and include a way to opt out.

Sharing information

We do not sell personal information. We share only what is needed with the business responsible for your invoice and its authorised users; hosting and database providers; email providers such as Resend; the payment provider used for a transaction; Meta/WhatsApp when messaging is enabled; and professional advisers or authorities where lawfully necessary. A lawful business transfer may also require limited disclosure with appropriate safeguards.

Providers acting as our operators must process information under appropriate written confidentiality and security terms. Providers acting as independent responsible parties, including payment services conducting their own verification, also explain their processing in their own privacy notices. We do not routinely share information with your employer for payroll reconciliation.

Storage and international processing

PaidNow uses cloud infrastructure, including Northflank. Hosting, support, email, payment and messaging services may store or process information outside South Africa; we do not promise exclusively South African storage. Overseas transfers must meet POPIA section 72, for example through adequate protection under applicable law or a binding agreement, or another permitted ground. Contact our Information Officer for information about the providers, processing locations and safeguards relevant to your data.

Security

We use HTTPS for the deployed service, password hashing, access controls, tenant isolation, encryption for authentication secrets, verified provider callbacks and audit records. Access is limited according to operational responsibilities. We assess safeguards against the risks of the processing; no system can guarantee absolute security. Where required by POPIA, we will notify the Information Regulator and affected people of a security compromise as soon as reasonably possible, subject to lawful delays.

Retention and deletion

We keep information for the service and other authorised purposes, and delete, restrict or de-identify it when it is no longer needed. Expired authentication records are removed by scheduled cleanup. WhatsApp messages and inactive AI conversations are normally removed after one year; provider webhook and audit records normally after five years, unless a retention hold applies. AI action records associated with a workspace may remain until workspace deletion.

Issued invoices, credit notes, archived PDFs and settled transaction records have a default minimum retention period of five years in the service. This is not a universal statutory deadline: SARS periods can run from submission of the relevant return, and company accounting records can require longer retention. Unfiled returns, audits, disputes and other legal requirements can extend the period. Businesses should retain their own required records and contact us before deletion or expiry to arrange any longer retention hold.

Account deletion revokes access and removes unnecessary active data. Required financial snapshots may still contain names and billing details and remain restricted until the applicable retention period and holds expire. Backup copies, where maintained, are subject to their separate expiry schedules and restricted access; deletion does not mean immediate removal from every backup.

Your rights and requests

You may ask whether we hold your information, request access or correction, request deletion of information we are no longer entitled to retain, object to processing where POPIA allows it, and withdraw consent where applicable. Owners can export workspace data and request account deletion in account settings. You can also contact our Information Officer without an account; we may reasonably verify your identity and authority before disclosing or changing records.

If a business supplied your information, you can approach that business or contact us to help direct your request. Access, deletion and objection rights are subject to applicable legal grounds and exceptions. If a request cannot be fulfilled, we will explain the reason and available steps.

You may complain directly to the South African Information Regulator without first completing our internal process: complaint instructions and forms, POPIAComplaints@inforegulator.org.za, or telephone 010 023 5200.

Cookies and device storage

The current PaidNow web app does not use analytics or advertising cookies and does not load Fontshare fonts. It uses browser session storage to maintain your signed-in session and local storage to remember a Business ID associated with your email on that device. You can clear these through your browser; doing so may sign you out or remove remembered settings. External checkout and messaging services have their own cookie and privacy practices.

Changes to this policy

We publish changes here with a revised date and provide additional notice where required. This notice covers the current invoicing service; new services or materially different processing require an updated notice before they are introduced.