Legal
Privacy & POPIA
What personal information QuoteFlow holds, why we hold it, how it is protected, and the rights you and your clients have over it.
Who we are
QuoteFlow provides quoting, invoicing and payment collection software to businesses in South Africa. For the information you enter about your own clients, you are the responsible party and QuoteFlow acts as an operator on your behalf, as those terms are used in POPIA.
Information we collect
Account information such as your name, email address, business details, VAT and registration numbers. Content you create, including clients, contacts, quotes, invoices, expenses and uploaded files. Technical information such as IP address, browser type and timestamps, used for security and troubleshooting.
Why we process it
To provide the service you subscribed to, to send transactional email on your behalf, to process your subscription payment, to secure the platform against abuse, and to comply with legal obligations.
Payment information
We do not store your clients' card details. Payments are handled entirely by the gateway you connect. Your own gateway API credentials are stored encrypted and are only decrypted server-side when creating a payment or verifying a webhook.
Sharing
We share personal information only with the infrastructure and communication providers needed to run the service, and only to the extent required. We never sell personal information, and we do not use your business data to train AI models.
Security
Data is encrypted in transit and at rest. Access is restricted per business account and enforced at the database level, so one business can never read another's records. Access to production systems is limited and logged.
Retention
We retain your data while your account is active and for a reasonable period afterwards to allow reactivation and to meet legal obligations. You can request earlier deletion at any time.
Your rights
Under POPIA you may request access to the personal information we hold about you, ask for corrections, object to processing, or request deletion. Your clients may direct the same requests to you as the responsible party, and we will support you in answering them.
Cross-border processing
Some infrastructure providers may process data outside South Africa. Where that happens we only use providers offering protections comparable to those required by POPIA.
Contact
Privacy questions and POPIA requests can be sent to hello@quoteflow.co.za and we will respond within 30 days.