Privacy Policy

Last updated: 31 August 2026 · taxinvoice.co.za

This Privacy Policy explains how Tax Invoice SA collects, uses, stores, shares and protects personal information, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to https://www.taxinvoice.co.za and the invoicing and quoting Service.

Creating an account or using the Service means we will process information as described here. Where POPIA requires consent (for example Google sign-in), we ask for it separately. Most processing is necessary to perform our contract with you, not because of a blanket “use = consent”.

1. Who we are

Responsible party: Johann Beukes, a sole proprietor trading as Tax Invoice SA.

Information Officer: Johann Beukes · taxinvoicesa@gmail.com

Website: https://www.taxinvoice.co.za

Contact: Contact form (choose “Privacy / POPIA request” where applicable).

Physical address: South Africa. Provided on written request to the Information Officer (home-based sole proprietor).

Our PAIA manual is at paia-manual.html.

2. Personal information we collect

  • Account: email address, password (stored hashed by our auth provider), and Google account identifiers if you use Continue with Google.
  • Company profile: business name, address, VAT number, registration number, contact email and phone, company logo, invoice header colour and footer text.
  • Invoices and quotes: document numbers, dates, due/valid-until dates, line items, amounts, VAT flag, notes, payment status (paid/unpaid), and related metadata.
  • Clients: name, address, VAT/registration number, email and phone of people or businesses you invoice or quote — you type these in.
  • Saved items: names, descriptions, unit prices and default VAT rates of products or services you save to reuse on invoices and quotes.
  • Banking details: bank name, account holder, account number, branch code and account type, if you add them for EFT on invoices.
  • Payment-page URLs: Paystack, Yoco and/or PayPal links you paste so they can print on your documents.
  • Billing: subscription plan and status, Paystack customer and subscription references. We do not receive or store your full card number or CVV.
  • Contact form: name, email, subject, message, optional signed-in user id, browser user-agent and page URL.
  • Usage: aggregated PDF download counts (anonymous, free signed-in, or paid). We do not use advertising cookies or third-party analytics pixels.

You can generate a document without an account. Guest documents live in your browser until you download them; they are not stored in our database unless you sign in and save.

3. Why we process it (and lawful bases)

We process information to:

  • create, preview, save, duplicate and export invoices and quotes (contract — POPIA s 11(1)(b));
  • authenticate you and keep your data separate from other users (contract);
  • take and manage Starter subscriptions via Paystack (contract);
  • answer support and privacy requests (legitimate interest / legal obligation);
  • keep limited billing and security logs (legal obligation / legitimate interest);
  • count PDF downloads in aggregate to operate the product (legitimate interest);
  • use Google sign-in if you choose it (consent, given by completing Google’s flow).

We do not sell personal information. We do not send marketing newsletters unless we obtain separate consent.

4. Your clients’ information — you are the responsible party

When you store a client’s name, address, VAT number or email, you are generally the responsible party for that information. Tax Invoice SA is an operator processing it on your instructions to generate and store documents. You must only upload information you are allowed to process (for example because you are invoicing that client). We do not use client details for our own marketing.

5. Operators and other recipients

  • Supabase — hosting, database, authentication, and row-level security. Encryption in transit and at rest.
  • Paystack — subscription payments. Card data goes to Paystack’s PCI infrastructure, not our servers. We receive payment/subscription status via a signed webhook.
  • Google — optional sign-in (OAuth) and we load fonts from Google Fonts.
  • Resend — emails us when someone submits the contact form.
  • Content delivery networks — scripts and libraries (for example jsDelivr, Cloudflare/cdnjs) so the site can run in the browser.
  • PayPal / Yoco — only if you paste their payment URLs onto your invoices; those providers then process your clients’ payments under their own terms. We store the URL, not card data.

We may disclose information if required by South African law, a court, or SARS, or to protect the Service against fraud or abuse.

6. Trans-border processing

Some operators process information outside South Africa (including the European Union, the United Kingdom, the United States, and other countries where those providers host data). We rely on operator agreements and the fact that the transfer is necessary to perform the Service (POPIA s 72). By using Google sign-in or a payment provider you also accept that provider’s transfer of data under its own policy.

7. Cookies and local storage

We use essential storage only:

  • Supabase session tokens (so you stay signed in);
  • temporary session storage for quote-to-invoice conversion, client prefill, and header colour;
  • a small local flag for signed-in navigation on marketing pages.

These are required for the Service to work. We do not run advertising or tracking cookies. You can clear site data in your browser; you will need to sign in again.

8. How long we keep information

  • Account, invoices, quotes, clients, profile: while the account is active.
  • After you delete the account: we cancel any Paystack subscription, then delete those records. We may keep (a) Paystack webhook logs with the user id removed, for billing disputes and fraud prevention, typically up to 5 years; (b) contact-form messages with the user id removed, typically up to 24 months; (c) aggregated PDF counts that cannot identify you.
  • Legal holds: longer if South African law requires it (for example tax records relating to fees you paid us).

9. Your rights under POPIA

You may:

  • Access the personal information we hold — including Dashboard → Account → Download my data;
  • Correct inaccurate information in Dashboard → Profile / Settings / Account;
  • Delete your account and associated records via Dashboard → Account → Delete my account;
  • Object to or restrict processing where POPIA allows it;
  • Lodge a complaint with the Information Regulator of South Africa.

Information Regulator: inforegulator.org.za · POPIAComplaints@inforegulator.org.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · PO Box 31533, Braamfontein, Johannesburg, 2017.

10. Security

We use HTTPS, database row-level security so users only see their own rows, hashed passwords, and we never store card numbers. No system is completely secure. Use a strong unique password. Banking details you store are visible to you in the product — treat them as confidential.

11. Children

The Service is for persons 18 years or older. We do not knowingly collect personal information from children.

12. Changes

We will change the “Last updated” date when this policy changes. Material changes will be announced on the website and, where reasonably practicable, by email or an in-app notice to signed-in users.

13. Contact

Privacy requests: Contact Us or taxinvoicesa@gmail.com. See also the Terms of Service and FAQ.