Privacy Policy

1. Who we are

Zeroed provides accounts receivable and collections software for South African businesses. Our website is at www.zeroed.co.za. Our application is at app.zeroed.co.za.

For privacy questions or data-subject requests relating to Zeroed as a service provider, contact us at privacy@zeroed.co.za.

2. Two roles: you, your customers, and us

Zeroed is a first-partytool. A business using Zeroed collects its own overdue accounts in its own name. Zeroed does not collect debt on behalf of customers as a third party, and customer payments go directly to the business's own PayFast account, not through Zeroed.

Under POPIA, roles usually work like this:

• Your business (the customer) is typically the responsible party for personal information about your debtors (patients, parents, clients, and similar), because you decide why that information is processed and you have the direct relationship with them.
• Zeroed acts as an operator when we process debtor information on your instructions, for example to send reminders, record promises, or generate payment links.
• For information about your staff users, billing contacts, and account holders, Zeroed is typically the responsible party.

If you are a debtor who received a message from a business using Zeroed, contact that business first. They control your account and can answer questions about what they owe and how your data is used. You can also use their opt-out or contact-preference links in the message.

3. Information we collect

When you visit our website

• Basic technical data such as browser type, device, and pages viewed.
• Information you submit voluntarily, for example if you contact us or start a trial.
• Cookie and analytics data as described in section 9, if you have not disabled non-essential cookies where applicable.

When your business uses Zeroed

• Account and user data: names, email addresses, roles, practice or business details, timezone, business hours, and settings.
• Debtor and account data you import or enter: names, contact details (WhatsApp, mobile, email), invoice references, amounts, due dates, aging, medical-aid or similar fields where relevant, notes, and communication history.
• Payment and integration data: PayFast connection status and encrypted credentials stored server-side only; payment confirmations received via webhooks; we do not receive or hold debtor funds.
• Communications metadata and content: outbound and inbound messages across WhatsApp, SMS, and email, including delivery status, timestamps, and message bodies, as required to run the service and maintain an audit trail.
• Compliance and operational records: consent records, opt-outs, promises-to-pay, payment plans, disputes, hardship requests, and event logs.
• Billing data: subscription tier, usage meters, and invoicing details where applicable.

4. How we use information

We use personal information to:

• Provide, operate, and improve the Zeroed service.
• Send and log collection reminders on your configured channels, subject to consent, contact hours, and fatigue limits.
• Generate payment links that settle directly to your PayFast account.
• Support payment plans, promise-to-pay tracking, disputes, and hardship flows.
• Enforce tenant isolation, security, and compliance guardrails.
• Bill you and provide support.
• Meet legal and regulatory obligations.

We do not sell personal information. We do not use debtor data to build advertising profiles.

5. Lawful basis

Depending on the context, we rely on one or more of the following:

• Contract: to provide the service you signed up for.
• Consent: where required, including marketing to prospects, certain cookies, and debtor contact where your business has captured a valid consent basis.
• Legitimate interest: for security, fraud prevention, service improvement, and limited business analytics, balanced against your rights.
• Legal obligation: where we must retain or disclose information by law.

Your business is responsible for having a lawful basis to upload debtor data and to contact debtors. Zeroed provides tools to record consent and honour opt-outs, but you must use them correctly.

6. How we share information

We share information only as needed to run the service:

• Channel providers such as WhatsApp (Meta), SMS providers, and email providers, to deliver messages you authorise.
• PayFast, so debtors can pay your business directly.
• Infrastructure providers such as hosting and database providers that store and process data on our behalf under contract.
• Professional advisers where required (for example lawyers or auditors), under confidentiality.
• Authorities if required by law or to protect rights and safety.

Operators that process personal information on our behalf are required to protect it and use it only for the purposes we specify.

7. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access, tenant isolation at the database layer, server-side storage of sensitive credentials such as PayFast keys, and immutable logging of messages and material state changes.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact hello@zeroed.co.za promptly.

8. Retention

We retain personal information for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. Retention settings for debtor and communication data can be configured within the product where applicable.

When a business cancels, we retain data for a defined window so they can export or reactivate, then delete it in line with our retention rules and POPIA. Businesses should export records they need before closure.

9. Cookies and analytics

Our marketing site may use essential cookies required for basic operation. We aim to use privacy-friendly analytics where possible and avoid heavy third-party advertising trackers.

You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.

10. Your rights

Under POPIA, you may have the right to request access, correction, deletion, restriction, or objection to certain processing, and to lodge a complaint with the Information Regulator.

• Zeroed account holders and staff users: email privacy@zeroed.co.za.
• Debtors: contact the business that sent you the message. They are usually the responsible party for your account data.

We may need to verify your identity before responding. We will respond within a reasonable time and as required by law.

See also our POPIA notice for more detail on data-subject rights and complaints.

11. International transfers

Zeroed is built for South Africa. Some infrastructure or channel providers may process data outside South Africa. Where that happens, we take steps required by POPIA to ensure appropriate safeguards are in place.

12. Children and schools

Zeroed may be used by schools and practices that deal with family accounts. Businesses must not use learner exclusion or report withholding as enforcement for parental debt. Where processing involves minors, additional care and lawful basis are required. Schools remain responsible for exemption processes where applicable.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date. For material changes, we will provide notice through the service or by email where appropriate.

14. Contact

Privacy enquiries: privacy@zeroed.co.za
General support: hello@zeroed.co.za