Effective date: May 2026 | Last updated: May 2026
1. Who We Are
Settlr is an invoicing and billing platform for small businesses, operated by [Your Full Legal Name / Entity Name], based in South Africa. Contact: privacy@settlr.co.za | settlr.co.za
2. What Information We Collect
We collect:
- Your name, email address, and phone number
- Your business name, address, VAT number, and registration number
- Your bank account details (stored for invoice display purposes only — never used to debit you)
- Information about your clients including names, contact details, ID numbers, and medical aid details where applicable
- Usage data including login timestamps and actions
- Country/region selection made during onboarding
3. Why We Collect It and the Lawful Basis
- To create and manage your account
- To generate, store, and send invoices, quotes, and statements
- To send transactional emails
- To calculate and display VAT where applicable
- To determine the appropriate payment provider and tax treatment
- To comply with legal obligations under South African law including the Companies Act and SARS requirements
We do not use your information for marketing without your separate, explicit consent.
4. Your Clients' Data — You Are the Responsible Party
When you enter your clients' personal information into Settlr, you are the Responsible Party under POPIA. Settlr acts as the Operator. You are responsible for ensuring:
- You have a lawful basis to process your clients' information
- Your clients are aware their details are held in a digital system
- You comply with applicable privacy obligations in your industry
5. Who We Share Data With
| Provider | Purpose |
|---|---|
| Neon | Database infrastructure — stores all platform data, hosted in EU West region |
| Vercel | Hosting and deployment — serves the Settlr web application |
| Resend | Transactional email — delivers emails sent through the platform |
| PayFast by Network | Payments — processes subscription billing for South African accounts |
| Stripe | Payments — processes subscription billing for international accounts |
We do not sell your data.
6. International Data Transfers
Settlr's database is hosted in the EU West region (Amazon Web Services). If you are based in South Africa, your data is transferred to the EU for storage. This transfer is lawful under Section 72 of POPIA because the EU operates under GDPR, which provides a comparable level of protection to POPIA.
7. How Long We Keep Your Data
- Account data: retained while account is active
- Financial records (invoices, quotes, statements): minimum five years as required by South African tax law and the Companies Act
- Non-financial personal data: removed within 30 days of account deletion
- Financial records after retention period: anonymised
8. Your Rights
Under POPIA and GDPR you have rights of: Access, Correction, Deletion, Objection, and Portability (EU users). Email privacy@settlr.co.za — we respond within 30 days. South African users may complain to the Information Regulator at inforegulator.org.za. EU users may complain to their national data protection authority.
9. Security
- All database connections are encrypted using SSL/TLS
- Passwords are hashed using bcrypt and never stored in plain text
- Access to data is restricted by role
- Card details are never stored in Settlr — handled by PayFast or Stripe (both PCI DSS Level 1 compliant)
- We will notify you and the Information Regulator if a data breach occurs, in accordance with POPIA's 2025 amendment regulations
10. Cookies
Settlr uses session cookies to keep you logged in. These are strictly necessary for the service to function. We do not use tracking, advertising, or analytics cookies.
11. Subscription and Payment Data
Payment is processed by PayFast (South African accounts) or Stripe (international accounts). Settlr does not store your card number, CVV, or full payment details. We store only:
- Subscription status and plan tier
- Billing date and payment history (amounts and dates only)
- Country/region selection
12. Children's Data
Settlr is a business tool not intended for use by persons under 18. We do not knowingly collect personal information from minors.
13. Changes to This Policy
We will notify you by email if we make material changes. The updated policy will always be available at settlr.co.za/privacy. Continued use after notification constitutes acceptance.
14. Information Officer
As required by POPIA, Settlr has appointed an Information Officer. Name: [Your Full Name]. Email: privacy@settlr.co.za. Registered with the Information Regulator of South Africa.