Privacy Policy | QuickBill - The Invoice Man

Who you are dealing with

QuickBill - The Invoice Man is a product of Kanvas Creative Solutions ("Kanvas", "we", "us"), a South African creative and technology company based in Rustenburg. Kanvas builds and operates QuickBill, and it is the company you contract with when you use it.

Kanvas is the merchant of record for QuickBill. Your subscription and AI credit are paid to Kanvas through its PayFast and Yoco merchant accounts, and your statement shows a Kanvas Creative Solutions or QuickBill reference. Payments your own customers make to you are different: they go through the payment accounts you connect, straight to you.

Registered nameKanvas Creative Solutions
Registration number2019/136304/07
ProductQuickBill · quickbill.co.za
Physical address42 Heystrek Street, Rustenburg, North West, South Africa
QuickBill supportsupport@quickbill.co.za
Legal and privacylegal@kanvas.co.za
Telephone and WhatsApp+27 81 788 0727
Office hoursMonday to Friday, 09:00 to 17:00 (SAST)
CurrencyAll prices are in South African Rand (ZAR)
Company termsknvs.co.za legal set

1. Scope, and who is responsible for what

This Policy covers quickbill.co.za, the QuickBill Android app, the public documents and catalogues QuickBill serves, the digital business cards at share.quickbill.co.za, Bill AI (in the app, by voice and on WhatsApp) and the payments for all of them.

Where Kanvas is the responsible party: your own account, sign-in, subscription, AI credit and support information. We decide why and how it is processed, under the Protection of Personal Information Act, 2013 (POPIA).

Where you, our customer, are the responsible party: the customers, leads, team members and contacts you load into QuickBill or collect through your business card, and the documents you send them. Kanvas processes that information on your instruction, as an operator, and does not use it for its own purposes.

2. What we collect

Your account

Name, email address, phone number, password (stored only as a salted hash), business name, address, VAT and registration numbers, logo, banking details you choose to print on your documents, team members you add, your settings, and sign-in records such as one-time PINs, WhatsApp sign-in confirmations and remembered devices. If you use Continue with Google, Google tells us the email address (and name) of the Google account you choose and confirms the address is verified; we never receive your Google password.

What you create

Invoices, quotations, statements, payments recorded, expenses, inventory and catalogue items with their pictures, your business card profile, the instructions and business details you give the AI assistants, and the conversations you have with Bill.

People you deal with

Your customers' and leads' names, email addresses, phone numbers, addresses and their document and order history - held for you, as described in section 1.

Payments

For your subscription and AI credit: amount, method, status and gateway reference. For your own gateway: the PayFast or Yoco keys you enter so that your customers can pay you, stored server-side and never shown in public pages. We do not receive or store full card numbers, expiry dates or CVV codes.

Usage and technical

AI credit and SMS usage, IP address, browser and device, app version, push-notification tokens, timestamps, pages and actions, error and security logs, and session identifiers.

3. Visitors to a business card, catalogue or public document

When someone opens a QuickBill business card, catalogue, invoice or quotation link, our server logs the request (time, page, IP address and browser) so we can keep the service secure and fix faults.

If a visitor chats to a card's assistant, the conversation is stored for the business that owns the card. If the visitor gives a name, phone number or email address in the chat, it is saved to that business's Leads so the business can reply. A visitor who places an order gives their details to that business through the catalogue checkout.

That business is the responsible party for what its visitors share. Questions about it should go to the business first; we will help where we can.

4. Why we use it

We process personal information where it is needed to perform our contract with you, to meet a legal duty, for legitimate interests that do not override your rights, or with your consent. In practice:

to create and run your account, your documents, your card and your catalogue;
to send documents, reminders and messages to your customers by email, SMS or WhatsApp when you ask us to;
to answer through Bill and the card assistant;
to take payment for your subscription and AI credit, and to measure and deduct AI and SMS usage;
to send transactional messages: sign-in PINs, payment confirmations, renewal and low-balance notices;
to keep QuickBill secure, prevent fraud and investigate faults;
to keep accounting, tax and other records the law requires; and
to improve QuickBill and our support.

Marketing is only sent where you have asked for it or where the law allows it for an existing customer, and every message carries a way to stop it.

5. The AI features

Bill and the business card assistant are powered by AI models from Anthropic (Claude, for text). Bill voice uses OpenAI to turn your speech into text, and Smart Import uses Google (Gemini) to read a document you upload. To answer, QuickBill sends the provider the message, the recent conversation, and the business details the answer needs - for Bill, the documents, customers or figures relevant to your request; for the card assistant, the card's profile, services and catalogue and the instructions you gave it.

We do not send passwords, payment gateway keys or card details.
Our providers' business terms do not allow them to use this content to train their models. They may keep it for a short period for safety and abuse monitoring.
Conversations are stored in QuickBill so you can see them and so the assistant can keep context. Ask us and we will delete them.
The AI does not make decisions about people with legal or similar effect. It drafts, answers and acts on your instructions, and asks you to confirm before anything that cannot be undone.

These providers process information outside South Africa (section 6).

6. Who sees your information

We do not sell personal information. We share only what is needed, with:

the people you send to - the customer who receives your invoice, quotation or message;
payment gateways - PayFast and Yoco - and our bank, to take and settle subscription and credit payments;
AI providers - Anthropic, OpenAI and Google - as described in section 5;
Google - when you choose Continue with Google, to confirm which Google account you are signing in with;
messaging providers - Meta (WhatsApp Business), our SMS gateway and our email delivery service - to deliver what you send and your sign-in PINs;
hosting and app services - our web host, and Google Firebase for app push notifications;
advisers, regulators, courts or law enforcement where the law requires; and
a buyer of the business in a lawful reorganisation, with equivalent protection.

Some of these providers are outside South Africa. Section 72 of POPIA allows that where the recipient is bound by rules that give comparable protection, or where it is needed to perform our contract with you. We rely on our contracts with them and send no more than the feature needs.

7. Card and banking information

Card payments happen on the gateway's own page. Neither Kanvas nor QuickBill is in that path, and we hold no card number, expiry or CVV; we keep the amount, method, status and reference so a payment can be matched to an invoice, an order or a credit purchase.

Banking details are held only where you put them on your own documents or ask for a refund to be paid to an account. Every page that carries personal or payment information is served over HTTPS.

8. Cookies and storage

QuickBill uses essential cookies and browser storage to keep you signed in, remember a device you trust, protect forms against forgery, and hold short-lived state such as a catalogue cart or a draft. Blocking them breaks sign-in and checkout.

A business card saved to a phone's home screen keeps a copy of the card on that phone so it opens quickly. The login page loads Google's sign-in script for Continue with Google; Google's own cookies apply inside its sign-in window. QuickBill does not use advertising cookies or sell browsing data.

9. How long we keep it

What	How long	Why
Invoices, payments, credit purchases	At least 5 years	Tax and company law
Account, card and catalogue	While the account exists, then 14 days	So you can export or return
Customers and leads	Until you delete them or close the account	They are yours
AI conversations	While the account exists, or until you ask us to delete them	History and context
Security and error logs	Normally 12 months	Security and faults
Support messages	3 years	Follow-up and disputes

Copies can remain in restricted backups until they are overwritten in the ordinary cycle.

10. How we protect it

Hashed passwords, one-time sign-in PINs, protected sessions, account separation so one business never sees another's data, unguessable tokens on public document links, HTTPS everywhere, server-side calculation of anything financial, gateway verification of payment notifications, private directories the web server will not serve, and monitoring and logs.

Please help: use an email address only you can read, keep PINs private, remove team members who leave, and tell us at once if you suspect misuse. If a breach ever affects personal information, we will notify the people affected and the Information Regulator as POPIA requires.

11. Your rights

You may ask what we hold about you, ask for a copy, ask us to correct or delete it, object to processing, withdraw consent, and complain to the Information Regulator. You can correct most of your own details in Settings.

The full procedure, our response times and the Regulator's details are on the POPIA and PAIA page. Where the information was loaded by a QuickBill business - you are its customer, lead or card visitor - we will point you to that business, which is the responsible party for it, and help where we can.

QuickBill is for adults running a business. We do not knowingly collect information from children for our own purposes.

12. Contact and changes

Privacy questions and requests: legal@kanvas.co.za. Give us enough detail to find the right account, and never send passwords or full card numbers.

We may update this Policy as QuickBill or the law changes. The current version and its effective date stay on this page, and significant changes are announced by email or in QuickBill.