Privacy notice

Protection of Personal Information Act (POPIA) · last updated July 2026

Who we are

WhatInvoice is a South African invoicing service operated by SANDZ (www.sandz.co.za), the responsible party under POPIA. Contact: [email protected].

What we collect, and why

Your account: WhatsApp number, name, email — to identify you and deliver login codes and documents. Your number is your login; we never store passwords.
Your business vault: business name, address, VAT number, logo, and the banking details you choose to print on your invoices.
Your documents: the invoices and quotes you create, including your customers' names and contact details, which you provide as their responsible party.
Payments: subscription transactions via PayFast. We never see or store card numbers.

How it's protected

Each business's data lives in its own isolated vault. All traffic is encrypted (HTTPS via Cloudflare). Banking-detail changes require a fresh one-time code and trigger an alert to you. Access is by one-time code to your own WhatsApp or email — nothing to leak or reuse.

Who else touches it (operators)

Meta (WhatsApp Business API) — message delivery
Resend — email delivery of documents and codes
PayFast — subscription billing
Cloudflare — network security and delivery

Each processes only what's needed for its function. We don't sell or share your data with anyone else, and we don't send marketing without your consent.

Your rights

Access: download everything we hold — portal → Settings → Download my data (ZIP).
Correction: edit your details any time in Settings.
Erasure: portal → Settings → Delete my account — permanent, immediate, includes every document and vault file.
Complaints: the Information Regulator (South Africa) — [email protected].

Retention

We keep your data while your account is active. Deleted means deleted — vaults are removed as files, and backups roll off within 30 days.

WhatInvoice · a SANDZ product · www.sandz.co.za