Privacy Policy

Last updated 21 October 2026

PaidFast is an invoicing app made by Spreeze (Pty) Ltd, a South African company ("we", "us"). This policy explains what information PaidFast handles, why, where it is kept and the choices you have. We follow the Protection of Personal Information Act, 2013 (POPIA).

The short version

Your business data lives on your phone. If you create an account, a backup is kept in our cloud database in London, United Kingdom.
When you send an invoice, or a quote that asks for a deposit, a read-only copy is stored so your client can open it from the pay link.
We never sell your data, we show no adverts, and PaidFast sends none of your data to any AI provider.
You can export everything, and deleting your account deletes your data from our servers.

1. What we collect

Your account: your email address, and a sign-in token if you use Sign in with Apple. Passwords are stored only as secure hashes by our authentication provider.
Your business details that you type in: business name, logo, address, phone, email, VAT or tax number, registration number, bank details, PayShap ID, PayPal email or link, and your settings.
Your clients' details that you add: names, phone numbers, email and postal addresses, tax numbers.
Your documents: quotes, invoices, receipts, payments you record, notes and job photos.
Subscription status: Apple handles payment. Our subscription provider (RevenueCat) receives an app user ID and Apple's purchase receipts so we know whether your subscription is active. We never see your card details.
Pay link activity: when someone opens a pay link we record that it was opened and when, so you can see "Viewed".

We do not collect your location, contacts you don't choose to import, or analytics about how you use the app.

2. Why we use it

To run the app: create, send and keep your quotes, invoices and receipts.
To back up your data and restore it on a new phone when you are signed in.
To show your client the invoice, your payment details and the PDF on the pay page.
To manage your subscription and answer support requests.

Reminders and tips are scheduled on your phone. We send no marketing messages.

3. Where it is stored

On your phone first. Your backup and pay-link copies are stored with our database provider, Supabase, in its London (United Kingdom) region, encrypted in transit and at rest. The pay page is served by Cloudflare. Storing information outside South Africa is a cross-border transfer under section 72 of POPIA: the United Kingdom has data protection law (UK GDPR) that gives protection substantially similar to POPIA, and our providers are bound by agreements to protect it.

4. Pay links

A pay link contains a long random code. Anyone who has the link can see that document, your business name and logo, and the payment details on it, so share it only with your client. When you edit or mark the document paid, the copy is updated. Deleting a draft, or your account, removes it.

5. Your clients' information

For your clients' details you are the responsible party under POPIA and we process them on your behalf, only to provide PaidFast to you. Please make sure you may share their details with us for that purpose.

6. Who we share it with

Only the service providers that run PaidFast: Supabase (database, sign-in and file storage), Cloudflare (pay page), Apple and RevenueCat (subscriptions), and Expo (app updates and notifications). We don't sell or rent information, and we share it with authorities only when the law requires it.

7. How long we keep it

As long as you have an account. When you delete your account in the app (Settings → Delete account) we delete your backup, pay links and files from our database. Copies in our providers' routine backups expire on their normal schedule.

8. Your rights

You may ask to see, correct or delete the personal information we hold, object to how it is used, or withdraw consent. Most of this you can do in the app: edit your details, export all data, or delete your account. For anything else, email us. You may also complain to the Information Regulator (complaints.IR@inforegulator.org.za).

9. Security

Data travels encrypted (HTTPS). Database tables are locked down so each account can only reach its own data. No system is perfectly secure; if a breach affects you we will tell you and the Information Regulator as POPIA requires.

10. Children

PaidFast is for businesses and is not meant for anyone under 18.

11. Changes and contact

We will update this page when our practices change and show the date at the top. Questions, requests or complaints: our Information Officer at support@spreeze.co.za, Spreeze (Pty) Ltd, South Africa, spreeze.co.za.