Privacy policy

This explains what personal information Shwinx collects, why, and what you can do about it. Shwinx is run from South Africa. We aim to follow South Africa's Protection of Personal Information Act (POPIA), and the UK and EU GDPR for customers there. Questions or requests: hello@shwinx.com.

Two kinds of information

• Your account. You are a customer of Shwinx. For this information, Shwinx decides how it is used.
• Your clients' information. You upload names, email addresses, account numbers and fees for your own clients. You decide why that information is used. Shwinx only stores and processes it on your behalf, to provide the service, and does not use it for any other purpose.

What we collect

• Sign-in details: your email address and, if you use Google sign-in, your name and Google account identifier. We never see your Google password, and Shwinx has no passwords of its own.
• Business details you enter: company name, sender name, reply-to address, logo, signature, templates and settings.
• Client records you upload or type in: client name, contact name and email, account number, monthly fee, currency, dates, notice periods and notes.
• History: a log of changes (who changed what, when, and whether it came from the app, an import or a sync), fee changes with their reasons, and which notices were sent.
• Technical data: basic server logs such as IP address and browser type, used to keep the service secure and working.

How we use it

• To run Shwinx: sign you in, show your clients, calculate increases and send the notices you ask us to send.
• To keep the service safe, fix problems and prevent abuse.
• To contact you about your account, such as access changes or important service notices.

We do not sell personal information and we do not use it for advertising. Emails we send for you do not use open or click tracking.

Who else handles it

We use a small number of providers to run the service. They process data only to provide their part of it:

• Supabase: database and sign-in. Data is stored in Ireland (EU).
• Resend: sends emails, including the notices you send to your clients and sign-in emails. Email content and recipient addresses pass through Resend.
• Google: only if you choose to sign in with Google.
• Cloudflare: domain name and email forwarding for our own hello@ address.
• Netlify: serves the website and app, and the server code that sends your notices. Email content passes through it on the way to Resend; we do not keep it there. Netlify does not hold your database.
• Payment provider: when paid plans start, a payment provider will process payments. We will not store card details.

Resend, Netlify and Google are based in the United States (Resend also operates an EU region, which we use for sending), and Cloudflare is global. Where information is transferred outside South Africa, the UK or the EU, we rely on each provider's data-processing terms and standard contractual safeguards for international transfers.

How long we keep it

We keep your account and records while your account is open. The change history is append-only by design, so that you can prove what was sent and when. If you ask us to delete your account, we delete your organisation's records, including your clients' information and the history, within 30 days, except where the law requires us to keep something. Backups are overwritten on their normal cycle.

Your rights

You can ask us to give you a copy of your information, correct it, or delete it. You can download your data as a file from the profile menu in the app. If your information was uploaded by one of our customers (for example, you are a client of a Shwinx customer), please contact that business first; we will also help if you write to us. You may complain to your regulator: the Information Regulator in South Africa, the ICO in the UK, or your local EU authority.

Security

Data is encrypted in transit. Every record is tied to an organisation, and the database refuses to show one organisation's records to another. No system is perfectly secure. If we learn of a breach that affects your information, we will tell you promptly.

Changes

If we change this policy in a way that matters, we will tell account holders by email before it takes effect. The date at the top shows the latest version.