Privacy Policy

This Privacy Policy explains how FieldPay (Pty) Ltd ("FieldPay", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use the FieldPay platform. We comply with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information We Collect

Information you provide directly:

• Name, email address, phone number
• Business name and trade type
• Banking details (account number, branch code, account type) — stored for pre-filling your invoices only
• VAT number (if VAT-registered)
• Client names, phone numbers, and addresses you add to your address book
• Invoice content — job descriptions, labour rates, materials, amounts

Information collected automatically:

• Login timestamps and session data
• Device type (for PWA compatibility)
• IP address (used for rate limiting and security only — not stored long-term)

We do not collect payment card numbers. All payments are processed by PayFast, who have their own privacy policy. We receive only a payment confirmation token.

2. How We Use Your Information

• To provide the invoicing and job management service
• To pre-fill your banking details and business information on invoices
• To send transactional emails (welcome, password reset, subscription confirmation)
• To enforce plan limits and process subscription billing
• To detect and prevent fraud and abuse
• To improve the Service based on aggregated, anonymised usage patterns

We do not use your information for advertising. We do not sell your data to third parties.

3. Your Client Data

Client names, phone numbers, and addresses you store in FieldPay belong to you. We process this data only on your behalf to provide the Service. You are the "responsible party" under POPIA for any personal information you collect from your clients. You must ensure your clients are aware that their contact details may be stored in your FieldPay account.

4. Who We Share Data With

We share your data only with the following third parties, strictly for operating the Service:

• Render (render.com) — cloud hosting and database provider. Servers in the United States. Data is encrypted at rest and in transit.
• Resend (resend.com) — transactional email delivery. We pass your email address to send you system emails.
• PayFast (payfast.co.za) — South African payment processor. We share your name and email with PayFast to process subscription payments.

We do not share your data with any other third parties without your explicit consent.

5. Data Storage and Security

• Your data is stored on a managed PostgreSQL database hosted by Render in the United States.
• All data in transit is encrypted via HTTPS/TLS.
• Passwords are hashed using bcrypt (12 rounds) — we cannot recover your password.
• Banking details are stored in our database solely for pre-filling your invoices. They are never shared with third parties beyond what appears on a PDF invoice you choose to send.
• We apply rate limiting and access controls to prevent unauthorised access.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account (Settings → Delete Account), all your personal information, invoices, clients, and rates are permanently deleted from our systems within 30 days. Some anonymised aggregate statistics may be retained.

We may retain records of payments and subscription history for up to 5 years for financial compliance purposes.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — update or correct your information (you can do this directly in Settings)
• Deletion — delete your account and all associated data at any time
• Objection — object to the processing of your personal information
• Complaint — lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za

To exercise any of these rights, contact us at privacy@fieldpay.co.za.

8. Cookies and Local Storage

FieldPay does not use tracking cookies or advertising cookies. We use browser localStorage to store your login session and display preferences (e.g. dark/light mode). This data stays on your device and is not transmitted to us.

9. Children's Privacy

The Service is not directed at persons under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email or in-app notice at least 14 days before material changes take effect. Continued use of the Service after changes constitutes acceptance.

11. Information Officer

As required by POPIA, our Information Officer is responsible for ensuring compliance with this policy. For any privacy-related queries:

FieldPay (Pty) Ltd
Queenstown, Eastern Cape, South Africa
Email: privacy@fieldpay.co.za