PaidonDue Privacy Policy

Viya Consultants Pty Ltd (ACN 651 336 962), trading as PaidonDue ("PaidonDue", "we", "us") provides software that helps businesses collect payment of their invoices by direct debit and card, under authorities their customers give them. This policy explains what personal information we collect, why, and how we handle it, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy covers

(a) Visitors and waitlist members - people who use our website or leave their details on our waitlist before PaidonDue opens.

(b) Merchants - businesses that use PaidonDue, and their staff.

(c) Payers - customers of those businesses, whose payment authorities and acceptance of terms are captured and stored through PaidonDue. If you are a payer, PaidonDue handles your information as a service provider to the business you deal with. That business is responsible for the arrangement with you; we are responsible for handling your information as this policy describes.

2. Website visitors and the waitlist

PaidonDue is not open to the public yet. Our website invites businesses to join a waitlist.

What we collect. When you join the waitlist we collect your name, email address, business name (if you give it), country, the accounting software you use, and any message you write. We also record the language of the page you used and, where you arrived through a campaign link, the campaign details in that link. If you tick the separate box asking us to email you when PaidonDue launches, we record that you ticked it, the date and time, and your IP address, as evidence of your consent. Like most websites, we also keep a web server access log and measure how the website is used. That is described in the section "Cookies and analytics" below.

Why we collect it. To record your interest in PaidonDue, to understand which accounting software and countries matter most to prospective customers, to reply to your message, and, only if you ticked the box, to email you when PaidonDue launches. We do not use waitlist details for anything else, we do not sell them, and we do not send you marketing unless you have given that consent.

If you do not give it. Your name, email address, country and accounting software are needed to add you to the list. Everything else is optional, and the launch email box is optional.

Who sees it. Our staff who run the waitlist, and the service providers that host our website and deliver our email (section 5). Each sign-up is sent to us as an email through our email delivery provider (United States) and is kept in the mailbox of the person who runs the waitlist. Sign-ups are also stored in our database, and are kept for up to 24 months or until you ask us to delete them. We do not give waitlist details to anyone else unless the law requires it.

How long we keep it. We keep waitlist details (the email in our mailbox, and the copy in our database) until you ask us to delete them, or 24 months after you joined, whichever is first, unless you have become a customer (in which case sections 3 and 8 describe retention of the information you then give us). If you gave launch-email consent, we also keep the record of that consent for as long as we hold your email address.

Withdrawing consent, access and deletion. You can withdraw launch-email consent at any time, by emailing support@paidondue.com or using the unsubscribe link in any email we send you. You can ask to see, correct or delete your waitlist details at the same address, and we will act on a deletion request within 30 days.

Display currency. On our pricing and similar pages we send your IP address to ipinfo (ipinfo.io, United States) so that it can tell us your country, which we use only to show prices in a suitable currency. ipinfo receives the address only to answer that question. We do not store your IP address for this purpose (it is kept only in the web server access log described in the section "Cookies and analytics" below, like every request to the website); the country result is held briefly in the memory of our server, for at most 24 hours. You can choose a currency yourself, and we remember your choice in the currency cookie below.

We do not sell personal information. We do not use payer information for marketing.

Cookies and analytics

Where our website runs. Our website (paidondue.com) runs on our own server at DigitalOcean (section 5), which is already one of our hosting providers. It is moving there from a third-party website host, and the notes below apply to the website once it runs on our own server. The PaidonDue app (app.paidondue.com), the payment pages that payers use and our admin pages are not part of this section: they are not measured by the analytics below and they have no website access log.

Website analytics. On the marketing website only, we use Umami, open-source analytics software that we run ourselves on our own server. No analytics data goes to Umami the company or to any other third party. Umami uses no cookies and stores nothing on your device. It records which pages you view, and the time and order of those views; the site you came from; any campaign (UTM) tags in the link; your browser, operating system, device type, screen size and language; and your approximate location (country, region and city), worked out from your IP address at the time of the visit. It also records clicks on buttons such as joining the waitlist, choosing a ledger, pricing and language, and that a waitlist sign-up happened. It does not record your email address or name. Umami does not keep your IP address. It groups the views of one visit under a rotating anonymous identifier that changes regularly, and we do not link it to your waitlist details. We keep analytics data for 24 months.

Website access log. Our web server for the marketing website keeps an access log. For each request it records your IP address, the date and time, the page requested (any token in a link is removed), your browser's user agent and the page that referred you. We keep the access log for 12 months. We use it to keep the website secure (to detect and stop abuse and attacks), to measure and improve the website, and to understand which pages and sources bring interest in PaidonDue (marketing). Only our staff and the people who run our server can see it.

Why, and our legal basis. We use the analytics and the access log for the three purposes above. If the UK GDPR or EU GDPR applies to you, our legal basis is our legitimate interests (Article 6(1)(f)): keeping the website secure, and understanding and improving it and our marketing. We have weighed this against your rights: the data is used only by us, is not shared, is not used to profile you for advertising and is kept for a limited time. If you are in Australia, this section is also our collection notice under the Australian Privacy Principles: we collect this information to run, secure and improve the website; you can use the website without giving it, but your IP address is sent to us with every request, so it cannot be avoided if you visit; it is stored on our own server in Singapore (section 5) and we do not disclose it to anyone else; and section 9 explains how to ask for access or correction and how to complain.

How to object. You can object to the analytics and the access log at any time by emailing support@paidondue.com. Because the analytics uses no cookies and stores nothing on your device, we do not show a cookie banner for it. You can also stop the analytics yourself by using a content blocker that blocks analytics scripts. If you object, we will exclude your visits from the analytics and delete the access log entries we can match to your IP address, as far as we reasonably can and within 30 days.

Cookies and similar storage. The website itself uses a small number of cookies. Some are strictly necessary: when a merchant signs in we set a sign-in cookie that keeps the session going (up to 7 days, renewed each time you use PaidonDue, and removed when you sign out); when a PaidonDue administrator signs in to our admin console we set a separate admin sign-in cookie (up to 30 days, and removed when they sign out); and when a merchant connects an accounting platform we set a short-lived security cookie (10 minutes) that protects that connection step. Others only remember choices you make: a language preference cookie (12 months) and, on the pricing page, a currency preference cookie (12 months). The preference cookies do not identify you to us. We use no advertising or marketing cookies, no third-party trackers, and no analytics cookies.

3. What we collect from merchants and payers

From merchants: business name, ABN or equivalent business identifier, business country, contact details of authorised users, connection credentials for the accounting platform you link (held as revocable OAuth tokens, never your accounting password), invoice and customer data your accounting platform shares with us, billing details for your subscription, and the IP address and device details of sign-ins and sessions, which we keep for security. Your business's country is used to determine which payment rails and consent wording apply to your account (for example, whether you can offer bank debit at all, and to which payer countries) - see section 7.

About payers, on the merchant's behalf: name and contact details as they appear on the merchant's invoices, including a phone number where the merchant's accounting platform or the merchant provides one; and when a payer accepts an agreement or authorises a direct debit, the evidence of that acceptance - the exact text shown, its digital fingerprint (hash), the typed name given as an electronic signature, the date and time, the IP address and browser details of the device used, and the acknowledgements ticked.

Electronic records and e-signature consent, captured separately: in addition to the direct debit authority, we separately capture and store the payer's agreement to conduct the transaction using electronic records and electronic signatures - its own text, hash, timestamp, IP address and device or browser details. This is a distinct consent, captured for a different purpose: demonstrating, independently, that the payer agreed to receive records and sign electronically.

Bank account verification evidence: when a payer sets up a direct debit in a market where the bank account is verified before it can be used (currently US ACH), verification happens either through an instant, secure bank-login flow in which the payer's bank credentials go to our payment processor and never to PaidonDue, or through a microdeposit flow in which a small deposit is sent and the payer confirms a code from their bank statement. Either way, we record that verification happened, which method was used, and the payer's own IP address and browser or device information when they completed it, as evidence that the account belongs to them. We do not receive or store the bank account number or login credentials in either flow.

Payment links - one-off payments: a payer can pay an invoice directly, without a recurring authority, through a link sent by the merchant. Card or bank details entered to complete that payment are entered directly on our payment processor's own hosted checkout page and go straight to the processor. We issue the link, redirect the payer to the processor, and afterwards ask the processor whether the payment succeeded; we do not receive or handle the payment details. The link itself is a durable, unguessable access token tied to that invoice, which we treat as sensitive access-control information.

What we deliberately do not hold: payer bank account numbers and card numbers are captured directly into the systems of our regulated payment processor and are stored by them, not by PaidonDue. We hold references (tokens) that cannot be used to derive the underlying account or card number. We also never hold or control payment funds - money moves from the payer to the merchant through the processor's regulated settlement process.

Referral program: if you refer a business to us, we collect your name, email, whether you are an accountant or an existing user, and the details of the referred business, to attribute and apply referral credits. If you take part in a partner programme we run, you also give us payout account details (held by our payment provider, not by us), your ABN or tax number and GST status, so we can pay you and issue the tax documents the law requires.

Practice plan applicants: if you apply for the Practice plan (a reduced rate for accountants, bookkeepers and registered tax or BAS agents), we collect your practice name, website, ABN or local business number, country, professional body and membership or registration number, an optional membership certificate you upload, the approximate number of clients you have (as a range). We collect this to decide whether you are eligible for the plan, to guard against misuse of a reduced rate, and to contact you about the application. A person at PaidonDue checks it manually against public registers and business registries, in every country; no automatic decision is made. We keep the application and our review notes for as long as you hold the plan and for 24 months after it ends or the application is refused, then delete or de-identify them, unless we need them longer for a dispute or a legal obligation. You may ask us to delete an uploaded certificate once the review is complete.

4. Why we use it

(a) To operate the service: syncing invoices, capturing payment authorities, verifying bank accounts where required, sending advance notices of debits by email, initiating payment instructions on the merchant's behalf, and handling dishonours and retries.

(b) To maintain evidence of authority: proving, if ever disputed, exactly what a payer agreed to, when, and how - including that they agreed to transact electronically at all, and that they control the bank account being debited. This is a core function of the service, not an incidental record.

(c) To administer subscriptions, referral credits, partner programme payments and support.

(d) To review Practice plan applications.

(e) To meet legal and scheme obligations (direct debit rules, anti-fraud, record-keeping) in the jurisdictions we operate in.

(f) For website visitors: to keep our website secure, and to measure and improve it and understand which pages and sources bring interest (section "Cookies and analytics").

We do not sell personal information. We do not use payer information for marketing.

5. Who we share it with, and overseas disclosure

We share personal information only with the following recipients, and only as far as they need it to provide the service. Businesses that use PaidonDue can also see this list in their Merchant Terms and in their account.

Stripe - Payment processing, bank-debit mandates and saved payment methods. Held in: United States, and the country of the payment method used.

DigitalOcean - Hosting, database and file storage, and our website (including its website analytics and access log). Held in: Singapore (one server).

Backblaze - Encrypted off-provider backup copy. Held in: Netherlands (European Union).

Resend - Sending email notices. Held in: United States.

Microsoft 365 - Our own support and administration mailboxes. Held in: Not stated.

Hostinger - Hosting of our current waitlist website only, until the website moves to our own DigitalOcean server; it is not used after that. Held in: Not stated.

ipinfo - Working out a website visitor's country from their IP address, to choose a display currency (only while its token is in use). Held in: United States.

(a) Accounting software - the platform the merchant chose and connected, to read (and where the merchant enables it, write) invoice records. The platform is the merchant's own choice and its own privacy policy applies to what it holds.

(b) The merchant - payers' acceptance evidence is available to the business they deal with; that is its purpose.

(c) Regulators, banks, or courts where the law requires it.

All of these providers are bound by contracts that restrict their use of the information to providing their service to us. We do not sell personal information. We give merchants at least 30 days' notice before adding or replacing a provider that handles payer personal information.

Overseas transfers and safeguards. Some of these recipients hold information outside Australia, in the places stated above. In particular, the personal information we hold is stored overseas, on our server in Singapore, and the other recipients named above hold it in the places stated against their names. Under the Australian Privacy Principles we take reasonable steps to ensure they handle personal information consistently with the APPs, mainly through our contracts with them. Where the UK GDPR or EU GDPR applies and information goes to a country without an adequacy decision (this includes Singapore, Australia and the United States, unless a recipient is covered by an adequacy framework), we rely on the Standard Contractual Clauses approved by the European Commission and, for the UK, the UK International Data Transfer Agreement or the UK Addendum to those clauses.

6. Security

Information is encrypted in transit and at rest. Accounting connections use revocable OAuth tokens. Acceptance evidence - including the direct-debit consent, the electronic-records consent, and bank-account verification results - is stored append-only: it can be superseded by a newer record but never edited, which protects both the payer and the merchant from after-the-fact alteration. We never log full bank account numbers; we never hold them at all. We restrict access on a need-to-use basis and notify affected individuals and the OAIC of eligible data breaches under the Notifiable Data Breaches scheme.

7. Payers and merchants outside Australia (UK GDPR and EU GDPR)

PaidonDue serves merchants and payers in Australia, New Zealand, the United Kingdom, the United States, Canada, the European Economic Area, Switzerland and Liechtenstein, and a number of other countries. This policy is written against Australian law (the Privacy Act and the APPs). Where the UK GDPR or the EU GDPR applies to personal information we handle, this section applies as well.

(a) Our role. For payers, the business they deal with (the merchant) is the controller and PaidonDue is its processor: we handle the information on the merchant's instructions to provide the service, under the data processing terms in clause 26 of the Merchant Terms. For merchant account information (a merchant's business details, its users, sign-ins, billing and support), and for website visitors and waitlist members, PaidonDue is the controller. We are also a controller for the security records and evidence we keep to prevent fraud, meet our legal obligations and establish or defend legal claims.

(b) Legal bases. For information we control, we rely on: performing our contract with the merchant (operating the service and subscriptions); our legitimate interests (security, fraud prevention, keeping evidence of what was agreed, and improving the service), where your rights do not outweigh them; your consent where we ask for it (for example the launch email); and legal obligation (tax, scheme and record-keeping rules). For payers, the merchant's basis is normally its contract with you and your authorisation of the payment.

(c) International transfers. Information is held in Singapore and in the other places stated in section 5. Where information subject to the UK GDPR or EU GDPR goes to a country without an adequacy decision, we rely on the Standard Contractual Clauses approved by the European Commission and, for the UK, the UK International Data Transfer Agreement or the UK Addendum to those clauses.

(d) Your rights and complaints. Section 9 describes your rights and how to use them. If the UK GDPR or EU GDPR applies you may also complain to your local supervisory authority (for example the Information Commissioner's Office in the United Kingdom, or the data protection authority of your own country in the European Economic Area).

8. Retention

We keep personal information only as long as we need it for the purposes in section 4 and for the law. The main periods are:

(a) Consent evidence and payment notices - the evidence of payment authorities and agreement acceptances (including the electronic-records consent and bank-account verification evidence described in section 3) and the notices we send before a debit are kept for 7 years, or for longer while a dispute or legal claim about them is open, because destroying them would strip both the merchant and the payer of the record of what was actually agreed. A request to erase personal information does not remove this evidence, which we keep to establish, exercise or defend legal claims.

(b) Payment processor event messages (webhook payloads) - 90 days.

(c) Sign-in and session records (IP address and device details) - 12 months, except for the staff security audit log described in (g).

(d) When a merchant's business closes - 60 days after closing we delete the invoice, customer and contact data copied from the merchant's accounting software, its quotes and its connection tokens (an invoice or contact that a retained transaction, mandate or notice record refers to is kept with the payer's name, contact details and free text removed), except that an accepted quote is reduced to a minimal acceptance record (time, typed name, IP address, device, e-signature consent, amount and currency) with its contact details, line items and links removed. We keep the merchant's business details, its transaction records, its mandates and consent evidence, the notices we sent, its audit trail and its tax-registration answers.

(e) Free-trial records - to stop repeat free trials we keep a record of each trial claim (a fingerprint of the card and the business number). It is kept for fraud prevention, for as long as needed to prevent repeat trials, and is not deleted when a merchant's business closes.

(f) Waitlist details and Practice plan applications - as stated in sections 2 and 3.

(g) Staff security audit log - this applies to PaidonDue staff (operators) only, not to merchants or payers. When a PaidonDue staff member signs in to or changes something in our internal admin console, we record who did it, what was done and the IP address it came from, in a security audit log. That log cannot be edited or deleted once written, so that it can be used to investigate security incidents and to prove who did what. The IP address in this log is therefore not removed after 12 months: it is kept for as long as the log is kept, which is for the life of the service and afterwards for the period the law requires.

(h) Website access log (IP address, date and time, page, browser and referring page) - 12 months. Website analytics data (Umami, no IP address kept) - 24 months. Both are described in the section "Cookies and analytics".

Other personal information is de-identified or destroyed when no longer needed.

9. Your rights: access, correction, deletion and copies

You can ask for access to, correction of, deletion of, or a copy (in a portable format) of the personal information we hold about you, and you can object to or ask us to restrict how we use it, by emailing support@paidondue.com. This includes the right to object to the website analytics and the access log (see "Cookies and analytics"). Payers can also make these requests to the business they deal with. We respond within the time the law allows, and in any case within 30 days. We will delete or anonymise your personal information on request, except consent and payment evidence, which we must keep for legal reasons (section 8). If you believe we have mishandled your information, contact us first. If unresolved, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, where section 7 applies, to your local supervisory authority.

10. Changes and contact

We update this policy from time to time; the current version is always at paidondue.com/legal/privacy. Material changes are notified to merchants. Changes never apply retrospectively to evidence already captured.

Contact: Viya Consultants Pty Ltd (ACN 651 336 962), trading as PaidonDue, 347 Anzac Highway, Plympton SA 5038, Australia, support@paidondue.com.