Legal

Privacy Policy

Last updated: 20 October 2026

1. Introduction

This Privacy Policy explains how Blaize Digital (Pty) Ltd ("we", "us", "our"), the developer of InvoiceZen ("the App"), collects, uses, stores, and protects your personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African legislation.

By using the App, you consent to the collection and processing of your personal information as described in this policy.

2. Responsible Party

Blaize Digital (Pty) Ltd
Email: support@blaizedigital.co.za
Website: blaizedigital.co.za

3. Personal Information We Collect

We collect the following categories of personal information when you use the App:

  • Account information: Email address (used for authentication via one-time password)
  • Business profile: Business name, address, phone number, email, VAT number, invoice number prefix, and business logo
  • Client information: Client names, email addresses, phone numbers, and billing addresses that you enter into the App
  • Invoice and quote data: Invoice numbers, line items, amounts, dates, and statuses
  • Payment records: Payment amounts, dates, methods, and PayFast transaction references
  • Device information: Device type and operating system (for app functionality and support purposes)

4. Purpose of Collection

We collect and process your personal information for the following purposes:

  • To provide the invoicing, quoting, and client management services of the App
  • To authenticate your identity and secure your account
  • To generate PDF invoices, quotes, and statements
  • To facilitate payment processing through PayFast
  • To synchronise your data across devices
  • To provide customer support
  • To improve the App and develop new features

5. Legal Basis for Processing

We process your personal information on the following legal grounds under POPIA:

  • Consent: You provide consent when creating an account and using the App
  • Contract: Processing is necessary to provide the services you have requested
  • Legitimate interest: To improve our services and ensure security

6. Data Storage and Security

Your data is stored in two locations:

  • On your device: The App stores data locally using an encrypted database, enabling offline functionality. Local data is protected by optional PIN and biometric authentication.
  • In the cloud: When online, data is synchronised to our cloud infrastructure hosted by Supabase (PostgreSQL database). Data is encrypted in transit (TLS) and at rest.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

7. Third-Party Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

  • PayFast: When you enable payment collection, invoice details (amount, reference) are shared with PayFast (Pty) Ltd to process payments. PayFast's privacy policy applies to their handling of payment data.
  • Supabase: Our cloud infrastructure provider processes and stores your data on our behalf. Supabase acts as an operator under POPIA.
  • Apple and Google: If you buy a subscription, the purchase is processed entirely by the app store you downloaded the App from. We never see or store your card details.
  • RevenueCat: We use RevenueCat, Inc. to manage subscription status across your devices. RevenueCat receives your account identifier — a random internal ID that means nothing outside our systems — together with which plan you bought and when it renews. It receives no name, email address, phone number, client details, or invoice contents.
  • Sentry: If the App crashes, a diagnostic report is sent to Functional Software, Inc. (Sentry) so we can fix the fault. Reports carry your account identifier and technical details of the crash. Email addresses, phone numbers and web addresses are automatically removed before the report leaves your device.
  • Google Fonts: This website (not the App) loads its typefaces from Google Fonts, so when you visit invoicezen.co.za your browser requests the font files from Google and Google sees your IP address and the page you are on, as it would for any web font. The App itself bundles its fonts and makes no such request.
  • Google Analytics: This website (not the App) uses Google Analytics 4 to count visits and see which pages and buttons are used. Google sets cookies in your browser (named _ga and _ga_*) to tell a returning visitor from a new one, and receives the pages you view, the links you follow, your browser and device type and a truncated IP address, from which it estimates your city. It is configured without Google’s advertising features, so this data is not used to show you adverts and is not linked to your InvoiceZen account. You can block it with a browser extension such as Google’s opt-out add-on or any content blocker; the website works the same without it.
  • Legal requirements: We may disclose information if required by law, regulation, or legal process.

The App itself sends nothing to any analytics or advertising provider, and we do not sell your data to anyone.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the App's services. When you delete your account:

  • All your data (business profile, clients, invoices, quotes, payment records) is permanently deleted from our servers
  • Local data on your device is cleared
  • This process is irreversible

We may retain anonymised, aggregated data for analytical purposes that cannot be used to identify you.

9. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

  • Right of access: Request confirmation of what personal information we hold about you
  • Right to correction: Request correction of inaccurate personal information
  • Right to deletion: Request deletion of your personal information (available via the in-app account deletion feature)
  • Right to object: Object to the processing of your personal information
  • Right to data portability: Request a copy of your data in a portable format
  • Right to withdraw consent: Withdraw your consent at any time by deleting your account

To exercise any of these rights, please contact us at support@blaizedigital.co.za.

10. Children's Privacy

The App is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Cross-Border Data Transfers

Your data may be processed and stored on servers located outside of South Africa (Supabase infrastructure). We ensure that any such transfers comply with POPIA's requirements for cross-border transfers, including ensuring adequate levels of protection for your personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy in the App and on our website. Your continued use of the App after such changes constitutes acceptance of the updated policy.

13. Complaints

If you believe your privacy rights have been infringed, you have the right to lodge a complaint with the Information Regulator (South Africa):

Information Regulator (South Africa)
Email: complaints.IR@justice.gov.za
Website: inforegulator.org.za

14. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, please contact us:

Blaize Digital (Pty) Ltd
Email: support@blaizedigital.co.za