Privacy Notice

• Account data — your name, email address, business name, VAT and registration numbers, contact details and login credentials.
• Business content you enter — clients, suppliers, quotes, invoices, payments, accounting records, bank data, employees, payroll, time, expenses, stock, jobs, contracts and operational records.
• Connected-service data — records retrieved from payment, e-commerce, website analytics and other providers when you authorise a connection.
• Migration and AI-assisted data — export files, attachments, mapping decisions, review comments, prompts and generated explanations used to provide requested features.
• Support data — the messages, attachments and enquiries you send us.
• Usage and technical data — pages viewed, actions taken, device and browser information, IP address and log data.

Card details are never collected or stored by us; payments are handled by Paddle, our Merchant of Record.

• To create your account and provide the Service — performance of our contract with you.
• To generate and deliver invoices, quotes, receipts, statements and reminders on your instruction — performance of our contract.
• To provide accounting, payroll, stock, task, migration, accountant and business-intelligence features you choose to use — performance of our contract.
• To keep the Service secure and prevent fraud or abuse — our legitimate interests.
• To provide customer support and respond to enquiries — performance of our contract and our legitimate interests.
• To improve and troubleshoot the product — our legitimate interests.
• To send product or marketing emails — consent, which you can withdraw at any time.
• To meet accounting, tax and other legal obligations — legal obligation.

• Service providers and subprocessors that host our infrastructure and database, deliver email, and provide AI-assisted document parsing or explanations for requested features.
• Accountants, advisers and team members you authorise to access a business workspace, subject to their assigned access.
• Payment, e-commerce, analytics and other connected providers when you initiate or authorise an integration.
• Paddle, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, tax compliance and invoicing.
• Professional advisers such as our accountants and lawyers, where necessary.
• Authorities, where we are required to disclose information by law.

We do not sell your personal information.

We keep your account and business records for as long as your account is active, and for a reasonable period afterwards so you can reactivate or export your data. After that we delete or anonymise the information, except where we must retain records to meet tax, accounting or other legal obligations.

We apply appropriate technical and organisational measures to protect your information, including encryption in transit, access controls, row-level database isolation between business accounts, and private storage for uploaded documents.

Connected services are used only after an authorised user configures or approves them. Integration credentials are handled server-side and protected in storage where supported. Disconnecting a service stops future synchronisation but does not automatically delete records already imported into OneBill.

AI may help read documents, map imported fields or explain system-generated results. These features can be incomplete or inaccurate and should be reviewed. OneBill does not use an AI response as authority to submit a tax return, make a payment or take a business decision without user action.

Some of our providers process data outside South Africa. Where that happens, we rely on appropriate safeguards such as standard contractual clauses or an equivalent lawful transfer mechanism.

Subject to applicable law (including POPIA and, where relevant, the GDPR), you may request access to your information, correct it, ask us to delete it, object to or restrict certain processing, request a portable copy, and withdraw consent to marketing at any time. We respond within one month. You may also lodge a complaint with the Information Regulator of South Africa or your local supervisory authority.

To exercise any right, email kenneth@4shaw.co.

We use essential cookies and local storage to keep you signed in and to remember your preferences. These are required for the Service to work. If we add analytics or marketing cookies in future, we will ask for your consent and provide a way to manage preferences.