InvoiceRunner privacy policy

Last updated: 29 September 2026 · Version 1.1 · Effective 27 September 2026

1. Who we are

The responsible party for personal information processed through the InvoiceRunner app is:

Fortem Equity Holdings (Pty) Ltd t/a JobRunner · registration 2016/136337/07 · Registered office: Highveld, Centurion, Gauteng · Business address: Durbanville, Cape Town

Information Officer: support@jobrunner.co.za

This policy explains how we process personal information under the Protection of Personal Information Act, 2013 (POPIA).

2. What stays on your phone

InvoiceRunner is built so that your business records stay with you. These are stored only on your phone and are never sent to us, unless you share a document by link (section 4):

• your invoices, quotations, receipts and credit notes;
• your customers' names, contact details and addresses;
• the items and prices you save;
• your banking details;
• your document settings.

You can export all of this at any time (Settings → Export all data).

3. What we collect

When you sign in with Google and set up your business, we collect:

• Account: your Google account email address and a user id from our sign-in service. We do not receive your Google password.
• Business profile: business name, your name, trade, team size, phone number, email address, business address (address lines, town, province, postal code), whether you are registered for VAT, and your VAT number.
• Numbering: the last number used for each document type (for example INV-0007), so your numbers never repeat if you reinstall.
• Usage counters: the number of documents you have issued, the app version and the date you last opened the app. We do not collect what the documents contain, except a document you share by link (section 4).
• Marketing choice: whether you ticked the box for marketing messages when you set up your business (it is never ticked for you), any later change you make in Settings, the wording you saw, and when.
• Pro launch notice: if you tap "Email me when Pro is ready", that choice, the wording you saw and when (and, if you tap "Remove me", that too).

We do not collect your location, contacts, photos or device advertising ID. The app contains no advertising, analytics or crash-reporting tools.

4. Documents you share by link

When you tap Send via WhatsApp, Copy message and link or Share link on a document, you choose to share that document by link. We then store:

• the document's PDF, exactly as your customer receives it, including the details it shows about your customer;
• the business name, document number, amount and due date shown on the link page;
• when you shared it, when the link expires, whether you stopped sharing, how many times the link was opened and when it was first opened.

The link contains a long random code. Anyone who has the link can open the page and download the PDF while the link is active, so send it only to the person it is for. The page at invoicerunner.co.za uses no cookies, analytics or trackers and is not listed in search engines. Each download address it gives out works for 5 minutes.

• How long: a link stays active for 90 days after you last shared it. Sharing it again renews it.
• Stop sharing: open the document and tap ⋮ → Stop sharing. The link stops working straight away and the PDF is deleted.
• Deletion: the PDF and the link's record are deleted within 7 days after a link expires or is stopped, and straight away when you delete your account.

For your customers' personal information in a shared document, you are the responsible party and we act as your operator under POPIA: we process it only on your instruction (when you share), only to show it to people who have the link, we keep it secure, and we delete it as described above. We do not use it for anything else and we never sell it.

5. Why we use it

• to give you the app: sign-in, your business details on your documents, numbering that never repeats, and links to the documents you choose to share (contract and legitimate interest);
• to keep the service secure and working, and to understand in aggregate how the app is used (legitimate interest);
• to send you free tips on getting paid faster by email or WhatsApp, only if you ticked the box (consent). You can change this at any time in Settings → Marketing messages, or by replying to any message.
• to email you once when InvoiceRunner Pro launches, only if you asked us to (consent). That is the only email this choice allows. You can take it back in Settings → InvoiceRunner Pro → Remove me.

6. Who we share it with

We do not sell your personal information. We use service providers who process it for us under contract:

• Supabase (database, file storage for shared documents and sign-in hosting), with data stored in the United Kingdom (London region);
• Netlify (hosts the link page at invoicerunner.co.za; it does not store your documents);
• Google (Sign in with Google).

7. Cross-border transfer

Your profile and the documents you share by link are stored in the United Kingdom. We transfer them under section 72 of POPIA because the UK has laws that give adequate protection to personal information, and because the transfer is needed to provide the service you asked for. We also use binding agreements with our providers.

8. Android backup

If Android backup is on for your phone, Android may back up the app's on-phone data (documents, customers, items, banking and settings) to your own Google account. We cannot access that backup. The app's sign-in session is excluded from backup. You can turn backup off in your phone's settings.

9. How long we keep it

We keep your profile, numbering and usage counters while you have an account. Consent records are kept while you have an account, as proof of your choice. Shared documents are kept for 90 days after you last share them, or until you stop sharing, and are then deleted within 7 days (section 4). When you delete your account, all of these are deleted (see section 11). Backups of our database are overwritten within 30 days.

10. Security

Data is encrypted in transit (HTTPS). Access to each user's cloud records is restricted to that user by database rules. Shared documents are kept in private storage; they can be opened only with the link's random code, and never through a public address. Your on-phone data is protected by your phone's own security.

11. Deleting your account

• In the app: Settings → Delete account. This deletes your cloud profile, consent history, shared links and their PDFs, and account straight away, and erases the app's data from your phone.
• Without the app: email support@jobrunner.co.za from your account's email address with the subject "Delete my InvoiceRunner account". We complete it within 30 days. See invoicerunner.co.za/delete-account.

12. Your rights

Under POPIA you may ask to access, correct or delete your personal information, object to processing, and withdraw consent to marketing. Contact the Information Officer at support@jobrunner.co.za. You may also complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@inforegulator.org.za.

If you received a link to a document from a business that uses InvoiceRunner, that business is responsible for your information on it; you can ask them to stop sharing it, or contact us.

13. Children

InvoiceRunner is for businesses and is not meant for anyone under 18.

14. Changes

We will post any changes here and update the version and date. If a change affects how we use your information, we will tell you in the app.