Privacy Policy

1. Introduction

FlyerSupplier ("we", "us", "our") is an AI-powered invoice data extraction service operated in South Africa. We are committed to protecting your personal information and processing it lawfully, fairly and transparently in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have as a data subject.

By creating an account and accepting this Privacy Policy, you consent to the processing of your personal information as described here. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

We collect the following personal information:

• Account information: your name, email address and a password (stored in encrypted, hashed form). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Documents you upload: supplier invoices and related documents. These may contain personal information about third parties (for example supplier names, contact details and banking details). You confirm that you are entitled to process this information when you upload it.
• Extracted data: the structured invoice data produced by our AI extraction (vendor details, invoice numbers, dates, line items, amounts and VAT information), including any edits you make to it.
• Payment information: subscription and purchase records (plan, amount, currency, status). Card details are collected and processed directly by our payment provider, Paystack — we never see or store your full card number.
• Technical information: basic usage and log information needed to operate and secure the Service (for example authentication sessions and error logs).

3. Purpose of Processing

We process your personal information only for the following purposes:

• To create and manage your account and authenticate you.
• To provide the core service: extracting structured data from the invoices you upload, letting you review and edit it, and exporting it (for example to Excel or Sage Pastel format).
• To process payments and manage your subscription and credits.
• To respond to support requests you send us.
• To maintain the security and integrity of the Service and comply with legal obligations.

We do not use your personal information or your invoice data for advertising, and we do not sell or rent it to anyone.

4. How Your Information Is Processed (Operators)

To provide the Service we use a small number of trusted third-party service providers ("operators" under POPIA) who process information on our behalf:

• Cloud hosting and storage: your account data and uploaded documents are stored securely in cloud infrastructure (including AWS S3), encrypted in transit and at rest. Documents are only accessible from your account.
• AI processing: when you request an extraction, the uploaded document is sent to an AI language-model service to extract the invoice data. The document is processed solely to perform the extraction for you.
• Payments: payments are processed by Paystack, who handle your card details under their own security certifications and privacy policy.
• Sign-in with Google (optional): if you choose to sign in with Google, Google processes your authentication under its own privacy policy.

These operators process personal information only on our instructions and are required to keep it confidential and secure.

5. Cross-Border Transfers

Some of our service providers (including cloud hosting and AI processing providers) store or process information on servers located outside South Africa. Where personal information is transferred outside South Africa, we do so in accordance with section 72 of POPIA, using providers that are subject to laws, contracts or binding rules that provide an adequate level of protection substantially similar to POPIA. By accepting this policy, you consent to these transfers to the extent such consent is required.

6. Data Retention

• Invoices and extracted data are retained in your account so that you can access your extraction history. You can delete individual invoices at any time, which also deletes them from our systems.
• Account information is retained for as long as your account is active.
• When you delete your account, your profile, invoices, extracted data and uploaded documents are deleted from our systems. Payment records may be retained where we are legally required to keep them (for example for tax purposes).

7. Security Safeguards

In line with section 19 of POPIA, we apply appropriate, reasonable technical and organisational measures to protect your personal information, including encryption in transit (HTTPS) and at rest, hashed passwords, access controls that restrict every document and record to the account that owns it, and secured cloud infrastructure. Should a data breach occur that affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

8. Your Rights as a Data Subject

Under POPIA you have the right to:

• Access the personal information we hold about you. Your invoices and extracted data are visible in your account at all times.
• Correct your information. You can edit your profile and extracted invoice data directly in the app, or contact us for anything else.
• Delete your information. You can delete individual invoices or your entire account from the Settings page.
• Object to processing and withdraw consent at any time by closing your account.
• Complain to the Information Regulator (South Africa) if you believe your information has been processed unlawfully: inforegulator.org.za / [email protected].

9. Third-Party Information in Your Documents

The invoices you upload may contain personal information about other people or businesses (such as your suppliers). As the party uploading those documents, you are responsible for ensuring that you have a lawful basis to process that information. We process it only on your instructions, for the sole purpose of providing the extraction service to you.

10. Cookies and Sessions

We use only strictly necessary cookies to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

11. Children

The Service is intended for business use and is not directed at children under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact & Information Officer

For any privacy-related questions, requests to access, correct or delete your personal information, or to contact our Information Officer, please email [email protected] or use the message button available in the application dashboard.