PaidonDue Privacy Policy

Viya Consultants Pty Ltd (ACN 651 336 962), trading as PaidonDue ("PaidonDue", "we", "us") provides software that helps businesses collect payment of their invoices by direct debit and card, under authorities their customers give them. This policy explains what personal information we collect, why, and how we handle it, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy covers

(a) Visitors and waitlist members - people who use our website or leave their details on our waitlist before PaidonDue opens.

(b) Merchants - businesses that use PaidonDue, and their staff.

(c) Payers - customers of those businesses, whose payment authorities and acceptance of terms are captured and stored through PaidonDue. If you are a payer, PaidonDue handles your information as a service provider to the business you deal with. That business is responsible for the arrangement with you; we are responsible for handling your information as this policy describes.

2. Website visitors and the waitlist

PaidonDue is not open to the public yet. Our website invites businesses to join a waitlist.

What we collect. When you join the waitlist we collect your name, email address, business name (if you give it), country, the accounting software you use, and any message you write. We also record the language of the page you used and, where you arrived through a campaign link, the campaign details in that link. If you tick the separate box asking us to email you when PaidonDue launches, we record that you ticked it, the date and time, and your IP address, as evidence of your consent. Like most websites, our servers also log technical information such as your IP address and browser type when you visit.

Why we collect it. To record your interest in PaidonDue, to understand which accounting software and countries matter most to prospective customers, to reply to your message, and, only if you ticked the box, to email you when PaidonDue launches. We do not use waitlist details for anything else, we do not sell them, and we do not send you marketing unless you have given that consent.

If you do not give it. Your name, email address, country and accounting software are needed to add you to the list. Everything else is optional, and the launch email box is optional.

Who sees it. Our staff who run the waitlist, and the service providers that host our website and deliver our email (section 5). Each sign-up is sent to us as an email through our email provider, Resend, in the United States, and is kept in the mailbox of the person who runs the waitlist; while PaidonDue is not open it is not held in a database. We do not give waitlist details to anyone else unless the law requires it.

How long we keep it. We keep waitlist details (the email in our mailbox, and any copy in our database) until you ask us to delete them, or 24 months after you joined, whichever is first, unless you have become a customer (in which case section 9 applies to the information you then give us). If you gave launch-email consent, we also keep the record of that consent for as long as we hold your email address.

Withdrawing consent, access and deletion. You can withdraw launch-email consent at any time, by emailing privacy@paidondue.com or using the unsubscribe link in any email we send you. You can ask to see, correct or delete your waitlist details at the same address, and we will act on a deletion request within 30 days.

Cookies. Our website uses a small number of cookies and similar storage only to remember choices you make, such as your language and, on the pricing page, your currency. They do not identify you to us and we do not use them for advertising.

3. What we collect from merchants and payers

From merchants: business name, ABN or equivalent business identifier, business country, contact details of authorised users, connection credentials for the accounting platform you link (held as revocable OAuth tokens, never your accounting password), invoice and customer data your accounting platform shares with us, and billing details for your subscription. Your business's country is used to determine which payment rails and consent wording apply to your account (for example, whether you can offer bank debit at all, and to which payer countries) - see section 7.

About payers, on the merchant's behalf: name and contact details as they appear on the merchant's invoices, including a phone number where the merchant's accounting platform or the merchant provides one; and when a payer accepts an agreement or authorises a direct debit, the evidence of that acceptance - the exact text shown, its digital fingerprint (hash), the typed name given as an electronic signature, the date and time, the IP address and browser details of the device used, and the acknowledgements ticked.

Electronic records and e-signature consent, captured separately: in addition to the direct debit authority, we separately capture and store the payer's agreement to conduct the transaction using electronic records and electronic signatures - its own text, hash, timestamp, IP address and device or browser details. This is a distinct consent, captured for a different purpose: demonstrating, independently, that the payer agreed to receive records and sign electronically.

Bank account verification evidence: when a payer sets up a direct debit in a market where the bank account is verified before it can be used (currently US ACH), verification happens either through an instant, secure bank-login flow in which the payer's bank credentials go to our payment processor and never to PaidonDue, or through a microdeposit flow in which a small deposit is sent and the payer confirms a code from their bank statement. Either way, we record that verification happened, which method was used, and the payer's own IP address and browser or device information when they completed it, as evidence that the account belongs to them. We do not receive or store the bank account number or login credentials in either flow.

Payment links - one-off payments: a payer can pay an invoice directly, without a recurring authority, through a link sent by the merchant. Card or bank details entered to complete that payment are entered directly on our payment processor's own hosted checkout page and go straight to the processor. We issue the link, redirect the payer to the processor, and afterwards ask the processor whether the payment succeeded; we do not receive or handle the payment details. The link itself is a durable, unguessable access token tied to that invoice, which we treat as sensitive access-control information.

SMS notifications: where a phone number is available for a payer, we may use it to send text messages relevant to setting up or verifying a bank debit (for example, a link to start setup, or an instruction to enter a microdeposit verification code), through a third-party SMS provider (currently Twilio; the provider may change). This is in addition to, not instead of, email notifications.

What we deliberately do not hold: payer bank account numbers and card numbers are captured directly into the systems of our regulated payment processor and are stored by them, not by PaidonDue. We hold references (tokens) that cannot be used to derive the underlying account or card number. We also never hold or control payment funds - money moves from the payer to the merchant through the processor's regulated settlement process.

Referral program: if you refer a business to us, we collect your name, email, whether you are an accountant or an existing user, and the details of the referred business, to attribute and pay referral bonuses. Accountant partners who earn a commission also give us payout account details (held by our payment provider, not by us), their ABN or tax number and GST status, so we can pay them and issue the tax documents the law requires.

Practice plan applicants: if you apply for the Practice plan (a reduced rate for accountants, bookkeepers and registered tax or BAS agents), we collect your practice name, website, ABN or local business number, country, professional body and membership or registration number, an optional membership certificate you upload, the approximate number of clients you have (as a range), and whether you wish to discuss the referral partner arrangement. We collect this to decide whether you are eligible for the plan, to guard against misuse of a reduced rate, and to contact you about the application. A person at PaidonDue checks it manually against public registers and business registries, in every country; no automatic decision is made. We keep the application and our review notes for as long as you hold the plan and for 24 months after it ends or the application is refused, then delete or de-identify them, unless we need them longer for a dispute or a legal obligation. You may ask us to delete an uploaded certificate once the review is complete.

4. Why we use it

(a) To operate the service: syncing invoices, capturing payment authorities, verifying bank accounts where required, sending advance notices of debits by email and, where a phone number is available, by text message, initiating payment instructions on the merchant's behalf, and handling dishonours and retries.

(b) To maintain evidence of authority: proving, if ever disputed, exactly what a payer agreed to, when, and how - including that they agreed to transact electronically at all, and that they control the bank account being debited. This is a core function of the service, not an incidental record.

(c) To administer subscriptions, referral bonuses and commissions, and support.

(d) To review Practice plan applications.

(e) To meet legal and scheme obligations (direct debit rules, anti-fraud, record-keeping) in the jurisdictions we operate in.

We do not sell personal information. We do not use payer information for marketing.

5. Who we share it with, and overseas disclosure

(a) Our payment processor, to set up mandates, verify bank accounts, and process payments, including through its own hosted checkout pages for payment links.

(b) Accounting platforms - the platform the merchant connected, to read (and where the merchant enables it, write) invoice records.

(c) Service providers - hosting, database and backup storage, email delivery, SMS delivery (currently Twilio), and support tooling, under contracts that restrict their use of the information to providing the service to us.

(d) The merchant - payers' acceptance evidence is available to the business they deal with; that is its purpose.

(e) Regulators, banks, or courts where the law requires it.

Where your information is held. While PaidonDue is not open, our website is hosted by Hostinger (server location [OWNER: Hostinger server location]) and does not hold a database. Waitlist sign-ups are sent by email through Resend (United States) to a mailbox held with Microsoft 365 (data location [OWNER: Microsoft 365 data location]). When PaidonDue opens, our website and database will be hosted in Sydney, Australia, with a cloud hosting provider, with encrypted backup copies held with the same provider in Singapore and with Backblaze, a separate storage provider (storage region [OWNER: Backblaze region]); if we then keep the waitlist in that database, it will be held there too. Our payment processor and some other service providers store information outside Australia (the payment processor: the United States, plus the country of the payment rail used for a given payer; Twilio, our SMS provider: the United States; Resend, our email delivery provider: the United States). We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

6. Security

Information is encrypted in transit and at rest. Accounting connections use revocable OAuth tokens. Acceptance evidence - including the direct-debit consent, the electronic-records consent, and bank-account verification results - is stored append-only: it can be superseded by a newer record but never edited, which protects both the payer and the merchant from after-the-fact alteration. We never log full bank account numbers; we never hold them at all. We restrict access on a need-to-use basis and notify affected individuals and the OAIC of eligible data breaches under the Notifiable Data Breaches scheme.

7. Payers and merchants outside Australia

PaidonDue serves merchants and payers in Australia, New Zealand, the United Kingdom, the United States, Canada, the European Economic Area, Switzerland and Liechtenstein, and a number of other countries. This policy is written against Australian law (the Privacy Act and the APPs). If the privacy law of your own country gives you additional rights, such as access, correction, erasure or objection rights, contact us at the address in section 10 and we will deal with your request under that law where it applies to us.

8. Retention

Evidence of payment authorities and agreement acceptances - including the electronic-records consent and bank-account verification evidence described in section 3 - is retained for as long as it may be needed to demonstrate the lawfulness of a payment, including after a merchant closes their account, because destroying it would strip both the merchant and the payer of the record of what was actually agreed. Waitlist details are kept as stated in section 2 and Practice plan application information as stated in section 3. Other personal information is de-identified or destroyed when no longer needed.

9. Access, correction, and complaints

You can request access to, or correction of, personal information we hold about you at privacy@paidondue.com. Payers can also exercise these rights through the business they deal with. If you believe we have mishandled your information, contact us first - we respond within 30 days. If unresolved, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Changes and contact

We update this policy from time to time; the current version is always at paidondue.com/legal/privacy. Material changes are notified to merchants. Changes never apply retrospectively to evidence already captured.

Contact: Viya Consultants Pty Ltd (ACN 651 336 962), trading as PaidonDue, 347 Anzac Highway, Plympton SA 5038, Australia, privacy@paidondue.com.