Privacy Policy
Effective date: 5 November 2026 Last updated: 5 November 2026
1. Who we are
QuoteBalance (quotebalance.co.za) is a quote, job and invoice app for trade and service businesses. It is operated by Ryan Bradley Roby trading as Silver Horizon Digital, a South African business, at 11 Balvicar Road, Blairgowrie, Randburg, 2194, Gauteng, South Africa.
Questions about privacy go to our Information Officer at privacy@quotebalance.co.za.
This policy explains how we handle personal information under the Protection of Personal Information Act, 2013 (POPIA).
2. Our two roles
- Responsible Party. We are responsible for the personal information of our subscribers and their users (the businesses that sign up, and the people who log in), and of website visitors and people who contact us.
- Operator. When a subscriber puts their own customers' details into QuoteBalance (for example, the homeowner a plumber is quoting), the subscriber is the Responsible Party and we are their Operator. We process that information only on the subscriber's instructions, under the data processing terms in section 10 of our Terms of Service.
If you received a quote or invoice through QuoteBalance, the business that sent it decides how your information is used. Contact them first. If you contact us, we'll pass your request on to them.
3. What we collect, why, and on what basis
| Whose | What | Why | Lawful basis (POPIA s11) |
|---|---|---|---|
| Subscribers and users | Name, business name, email, phone, password (stored only as a secure hash), role, business details (address, VAT number, logo, banking details shown on invoices) | To create and run your account and produce your documents | Needed to perform our contract with you |
| Subscribers | Plan, billing history, Paystack subscription reference. Card details are handled by Paystack; we don't receive or store them. | Billing, receipts and tax records | Contract; legal obligation (tax records) |
| Subscribers who connect PayFast | PayFast merchant credentials (stored encrypted, never shown again) | To create payment links for your invoices | Contract |
| Users | Sign-in records, IP address, device and browser type, security and audit logs | Security, fraud prevention and troubleshooting | Our legitimate interest in keeping the service secure; legal obligation (s19) |
| Subscribers' customers (we act as Operator) | Whatever the subscriber enters, typically name, contact person, phone, email, address, VAT number, job details and notes. When a customer views or accepts a quote: the time, IP address and typed name | To provide QuoteBalance to the subscriber, including the acceptance record | The subscriber's lawful basis; we process on their instructions |
| Anyone who contacts us | Name, email, message | To reply and give support | Legitimate interest; steps you asked for |
| Subscribers | Email address for product news | To tell you about QuoteBalance features and offers | Existing customer for similar services, with an opt-out in every message (POPIA s69). We'll ask for consent where the law requires it |
We don't sell personal information or use subscribers' customer data for our own marketing. We may use de-identified, aggregated statistics (for example, the number of quotes sent) to improve QuoteBalance.
You don't have to give us information, but without it we can't provide an account.
4. Cookies and analytics
We keep these to a minimum. - Essential cookies only in the app: a secure sign-in cookie that keeps you logged in and a related anti-forgery protection. These are needed for the service to work. - Analytics: we use Cloudflare Web Analytics on this website, which is cookieless and sets no tracking cookies, plus first-party product usage events inside the app (for example, "quote sent"). We don't use advertising or cross-site tracking cookies. - Public quote pages are not indexed by search engines.
If we ever add non-essential cookies, we'll update this policy and ask for your consent first where the law requires it.
5. Who we share it with
We share personal information only: - with service providers (sub-processors) that help us run QuoteBalance, under written terms that require them to protect it; - with the people a subscriber chooses to send documents to, for example a customer receiving a quote link by WhatsApp or email; - when the law requires it, or to protect our rights, users or the public; and - with a successor if the QuoteBalance business is transferred, for example to a company we form, under this policy.
Sub-processors
| Provider | What it does | Where data may be processed |
|---|---|---|
| Paystack | Billing for QuoteBalance subscriptions | As set out in Paystack's privacy policy |
| PayFast | Payments by a business's customers of that business's invoices, where the business chooses to connect its own PayFast account | As set out in PayFast's privacy policy |
| Google Cloud | App, API, database and file hosting | South Africa (Johannesburg region) |
| Cloudflare | Serving this website and the web app, security, DNS, email routing and cookieless website analytics | Global network |
If we use other providers that process personal information (for example for sending email, error monitoring or uptime checks), we will list them here.
We'll keep this list up to date and tell subscribers before adding a new sub-processor, as our Terms of Service describe.
6. Transfers outside South Africa (POPIA s72)
QuoteBalance's main database and files are hosted in South Africa (Google Cloud, Johannesburg region). Some providers, such as email delivery, error monitoring and the content delivery network, may process personal information outside South Africa, including in the United States and Europe. We transfer it only as section 72 of POPIA allows: - the recipient is bound by a written data processing agreement that gives protection substantially similar to POPIA, including limits on onward transfer; or - the transfer is needed to perform our contract with you, or the subscriber's contract with their customer (for example, delivering a quote email the customer is expecting).
7. How long we keep it
We keep personal information only as long as we need it: - Account and subscriber customer data: while the account is active. After closure, there is a 30-day export window, then deletion from the live system. Backups roll off within 35 days. - Clients a subscriber deletes: a deleted client can be restored for 30 days. After that, the client record's personal details (name, contact person, email, phone, address, VAT number and notes) are removed. A client with no quotes or invoices is deleted completely; if quotes reference the client, the record is kept but anonymised so those quotes still open. Quotes, invoices and payment records are the subscriber's own business records: anything the subscriber typed into them (for example a quote's title, notes or line descriptions) stays until the subscriber deletes the quote or closes their account, and issued invoices keep the customer details shown on them for tax purposes. Deletions are re-applied if we ever restore from a backup. - Billing and tax records (our invoices to subscribers): at least five years after the relevant tax return, as South African tax law requires, then deleted. - Security and audit logs: 12 months. - Quote acceptance records: kept as part of the subscriber's records, for as long as the subscriber keeps the quote. - Support and enquiry emails that don't lead to a subscription: deleted within 12 months of our last contact. - Inactive Free accounts: we warn you after 18 months with no sign-in, and delete the account 30 days later.
We may keep information longer if the law requires it, or to establish or defend a legal claim. If you ask us to delete something sooner, we will, unless the law requires us to keep it.
8. How we protect it
We take reasonable technical and organisational measures to protect personal information, as POPIA section 19 requires. These include: - encrypted (HTTPS/TLS) connections; - passwords stored as secure hashes; - encryption of stored payment-provider credentials and banking details; - access limited to people who need it; - strict separation between businesses' data; - backups; and - monitoring.
No system is completely secure. If we have reasonable grounds to believe personal information has been accessed by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 requires. Where we're the Operator, we'll notify the subscriber so they can do this.
9. Your rights
Under POPIA you can: - ask whether we hold your information and request a copy (s23); - ask us to correct or delete it (s24); - object to processing based on our legitimate interests, and to direct marketing at any time (s11(3), s69); - withdraw consent where we rely on it; and - complain to the Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
Subscribers can view, export and delete their data in QuoteBalance. Otherwise, email the Information Officer. We may need to confirm your identity, and we'll reply within a reasonable time, and in any event within 30 days.
If you are a subscriber's customer, we'll forward your request to that business, as section 2 explains.
Requests for access to records can also be made under the Promotion of Access to Information Act (PAIA). Our PAIA manual is available on request from support@quotebalance.co.za.
10. Children
QuoteBalance is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's information for our own purposes. Subscribers should only add a child's details where needed for a job and lawful, for example when a parent is the customer.
11. Changes to this policy
We'll update this policy when our practices change. We'll show the new date at the top, and we'll tell subscribers by email or in the app before material changes take effect.
12. Contact
- Information Officer, Silver Horizon Digital: privacy@quotebalance.co.za
- Postal or physical address: 11 Balvicar Road, Blairgowrie, Randburg, 2194, Gauteng, South Africa
- Support: support@quotebalance.co.za
- Phone: 079 529 7545