Privacy policy

1. Who we are

HeyBill (“HeyBill”, “we”, “us”) operates the website and web app at heybill.online, which helps South African businesses and households create invoices and quotes, get paid, split shared bills and collect money from groups.

This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer can be reached at hello@heybill.online.

2. Your data and your clients’ data

HeyBill handles two kinds of personal information, and our role is different for each:

• Your own information — your account, business profile and how you use HeyBill. For this, HeyBill is the responsible party.
• Information about the people you deal with — your clients, tenants, housemates or group members, and the invoices, payments and messages relating to them. You decide why this information is collected and how it is used, so you are the responsible party and HeyBill processes it on your behalf as an operator, only to provide the service to you.

If you are a client of a business that uses HeyBill and you have a question about your information, please contact that business first. We will help them respond.

3. What we collect

When you create and use an account

• Account details: your name, email address and password (stored only as a one-way hash — we can never see it).
• Business details: business name, address, phone, email, VAT and company registration numbers, logo, banking details, payment terms and document numbering.
• Ownership review: supporting documents and business or social profile links submitted when you claim an unverified business profile.
• Records you create: invoices, quotes, purchase orders, line items, payments you record, reminder and recurring-invoice schedules, properties and shared bills, groups and collections.
• Details of the people you deal with: names, email addresses, phone numbers, addresses, VAT numbers and notes, whether they have opted out of SMS or WhatsApp reminders, and details they submit themselves through your client sign-up form.
• Connected services: if you connect PayFast, Yoco, SMSPortal, Twilio or your own AI keys, we store those credentials encrypted. They are never shown back to you in full.
• Voice and AI input: what you say or type to the AI assistant when you ask it to draft an invoice, quote or collection.

When anyone visits the site

• Sign-in cookie: a session cookie that keeps you signed in. The public pages don’t set any cookies.
• Security data: a one-way hash of your IP address, kept for a short time to limit abuse (for example, repeated sign-in attempts). We don’t store your IP address itself for this.
• Error reports: technical details when something goes wrong, so we can fix it.

The free invoice generator and quote maker

What you type into the free tools is used to create your PDF and is not stored on our servers. If you tick “Remember on this device”, your business and banking details are saved only in your own browser’s local storage — untick it to remove them. Your client’s details are never remembered.

4. Quote requests (HeyBill Quotes)

When you ask a business for a quote through the HeyBill Quotes directory, we collect the job description, your area and timing, your name, email address and (optionally) mobile number, whether the business may contact you on WhatsApp, and your consent choices. We confirm your email with a one-time code.

• With your consent, we share your request and contact details only with the business you chose. From then on, that business is responsible for how it uses your details and may only use them to respond to your request.
• Some profiles are available before the business owner has verified ownership. After you confirm your email, we send your request and the contact details you agreed to share directly to the business email shown for that profile.
• When someone asks us to verify ownership of a profile, we review the supporting document or business/social profile link they submit. We keep those materials only for ownership review, security and resolving disputes.
• We never sell your details or pass them to other businesses. We only send you HeyBill news if you ticked the optional box, and you can opt out at any time.
• For businesses on the free plan, some contact details stay hidden until the business upgrades or unlocks the request — they are still only ever shared with that one business.

5. How we use it

We use personal information to:

• provide HeyBill — creating, sharing and downloading documents, client portals and sign-up forms, payment links, reminders, recurring invoices, shared bills and group collections;
• send the emails, SMS and WhatsApp messages that you send or schedule, and service emails such as sign-in codes and security notices;
• confirm online payments with your payment provider and mark invoices or shares as paid;
• keep HeyBill secure, prevent fraud and abuse, and fix problems;
• meet our legal obligations.

We process information because it is needed to provide the service you asked for, to protect our legitimate interests in running a secure service, to comply with the law, or — for optional features — because you chose to use them. We do not sell personal information and we do not use it for advertising.

6. Who we share it with

We share information only with these service providers, only for the purpose shown:

When you share an invoice “on WhatsApp” with the share button, the message is sent from your own WhatsApp app. We may also disclose information if the law requires it, or to protect the rights, safety or property of HeyBill, our users or others.

7. Information sent outside South Africa

Our hosting is in South Africa. Some optional features use providers that process data in other countries (Groq, Anthropic, ElevenLabs, Google, Twilio and Sentry). We use providers that are bound by data-protection terms offering protection comparable to POPIA, we send only what a feature needs, and these features are optional — by choosing to use them you agree to that transfer, as allowed by section 72 of POPIA.

8. How we protect it

• HTTPS everywhere, with strict security headers.
• Passwords stored as one-way hashes; payment-provider and messaging credentials encrypted.
• Invoice, portal, payment and sign-up links contain long, unguessable codes or signatures.
• Each account can only see its own records.
• Limits on sign-in attempts, sign-ups, emails and public forms to stop abuse.

No system can be guaranteed completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

9. How long we keep it

We keep your information for as long as your account is open. When you ask us to close your account, we delete your profile, documents, clients and related records within 30 days, except information we must keep by law or to resolve a dispute. Deleted information may stay in backup copies for a limited period until those copies are overwritten or deleted.

Please keep your own copies of your invoices and financial records: as a business you are generally required to keep tax records for at least five years, and HeyBill is not a record-keeping service for that purpose. You can download PDFs of your documents and export your VAT report at any time.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy of it;
• ask us to correct or delete it;
• object to it being processed;
• complain to the Information Regulator (inforegulator.org.za).

You can update most of your details yourself in Settings. For anything else — including closing your account — email hello@heybill.online. We may need to confirm your identity first, and we will respond within a reasonable time.

11. Cookies and local storage

HeyBill uses one essential cookie: the session cookie that keeps you signed in to the app. We don’t use advertising or tracking cookies. The free tools use your browser’s local storage only for “Remember on this device”.

12. Messages we send

We send service messages that are part of using HeyBill, such as sign-in codes, password and email-change notices. We don’t send you marketing messages unless you have agreed to receive them, and you can opt out at any time. Reminders and invoices that you send to your own clients through HeyBill are your messages — see our Terms of Service for your responsibilities.

13. Children

HeyBill is intended for people aged 18 or older. We don’t knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as HeyBill changes. We will post the new version on this page with a new “last updated” date and, for significant changes, let account holders know by email.

15. Contact us

Questions about this policy or your information: hello@heybill.online.