Privacy Policy

This is a starter policy provided for completeness and is not legal advice; have it reviewed by qualified counsel before relying on it.

1. Introduction

PayTier ("PayTier", "we", "us", or "our") is an AI-powered invoicing platform operated by Limework Technologies Limited, with a registered address at 2852 Davenport House, 207 Regent St, London, W1B 3HH, United Kingdom. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data. It applies to merchants who use PayTier to create and send invoices, to the clients and contacts those merchants add, and to anyone who interacts with our services.

2. Information we collect

We collect the following categories of information:

• Account and business information: your name, email address, phone number, business name, country, and currency, along with the onboarding and KYC details you provide so that you can get paid.
• Client and contact data: details merchants add about their clients, including client name, email address, phone number, WhatsApp number, and address.
• Invoice and transaction data: amounts, line items, due dates, statuses, and payment links generated through the platform.
• WhatsApp content: the messages and voice notes you send to our WhatsApp number to create invoices, which we process to extract the relevant invoice details.
• Payment data: payments are handled by our payment processors. PayTier is non-custodial and does not store card or bank credentials, nor does it hold your funds.
• Identity verification data: before we turn payouts on, we check the person behind each merchant account with our identity verification partner. You photograph an ID document and take a short selfie, which the partner uses to confirm the document is genuine, that you are a real person present at the time (a liveness check), and that your face matches the photo on the document. The partner also checks your device and IP address. When your ID document expires, a renewal needs only the document photo, with no selfie. From the result we keep only: the decision, your verified name, the document type and issuing country, the document's expiry date, a keyed fingerprint of your date of birth (a one-way code that lets us confirm a later check is the same person without keeping the date itself), and the risk warnings and reasons the check returned (never images). We never keep images of your document or your face, or any ID or national number.
• Company register data: if your account is for a registered company, we look the company up on the official public company register: its registered name, number, status, and the names and roles of its current officers (such as directors). We use this to confirm that you are one of the company's officers. We do not keep officers' addresses or nationalities; where the register gives an officer's date of birth, we keep only a keyed fingerprint of it, never the date itself.
• Bank account name checks (Nigeria): before we accept a Nigerian payout account, we ask our payment processor for the name the bank holds the account under and compare it with your verified name or your company's registered name. We keep the name the bank returned, the last four digits, a one-way code of the account number, and the result of the check, never the full account number.
• Technical and usage data: your IP address, device and browser information, and log data generated when you use the service.

3. How we use your information

We use the information we collect to:

• provide and operate the invoicing platform;
• parse your text and voice input into structured invoices using AI;
• route payments through third-party payment gateways;
• verify the identity of merchants, and their link to the company they represent, before payouts are turned on, and set up their payout accounts;
• send notifications and reminders by email and WhatsApp;
• provide customer support;
• maintain security and prevent fraud; and
• comply with our legal and regulatory obligations.

4. AI processing

The text and voice you submit may be sent to AI providers solely to produce invoices and to answer invoice-related questions. We use OpenAI for text parsing and voice transcription, and Anthropic for assistant replies. We do not use your content to train these providers' models where this can be avoided.

5. Third parties and sub-processors

We rely on a set of trusted sub-processors to deliver the service. Each is used only for the purpose described:

• Stripe and Paystack — payment processing;
• Didit — identity and document checks, liveness and face match, device and IP checks, and company register lookups;
• Meta Platforms / WhatsApp — message delivery;
• OpenAI — text and voice parsing;
• Anthropic — assistant replies;
• Supabase — database and file storage;
• Resend — transactional email;
• DigitalOcean — hosting;
• Trigger.dev — background jobs; and
• Cloudflare — network and content delivery.

6. Legal bases and international transfers

Where data protection law (such as the GDPR) applies, we process personal data on one or more of the following legal bases: the performance of our contract with you; our legitimate interests in operating, securing, and improving the service; your consent (which you may withdraw at any time); and compliance with our legal obligations.

Some of our sub-processors operate outside your country. Where we transfer personal data internationally, we rely on appropriate safeguards, such as standard contractual clauses, to protect your information.

7. Data sharing

We do not sell your personal data. We share personal data only with the sub-processors listed above to operate the service, and where we are legally required to do so.

When you set up payouts, we pass your verified details to the payment processor that will hold your payout account (Stripe), so that you do not have to enter them again: your verified name and date of birth, your email address, your verified WhatsApp number, your country and account type and, for a company found on the register, its registered name and number, your business address and, where the processor asks for them, the names of its directors. Your date of birth is read from our identity verification partner at that moment and passed on; we do not store it. The processor then runs its own checks under its own privacy policy.

8. Data retention

We keep your information for as long as your account is active and for as long as we need it to meet our legal, financial, and tax record-keeping obligations. You can request deletion of your data at any time — see our Data Deletion Instructions.

When your account is deleted, we keep a minimal record of each identity check that reached a decision for five years, then delete it automatically. We also keep financial records (payments, refunds and the invoices they belong to) as the law requires. Neither stays linked to an account. Stored PDF copies of invoices are kept as issued for five years, then deleted automatically.

Our identity verification partner keeps its own copy of the check, including the document and selfie images, for the retention period of its service plan with us, and then deletes it.

9. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email [email protected] or follow our Data Deletion Instructions.

10. Cookies

We use essential cookies that are necessary for authentication and keeping you signed in to your session. These cookies are required for the platform to function.

11. Security

We protect your information using encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

12. Children

PayTier is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children.

13. Changes and contact

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. If you have any questions about this policy or how we handle your data, contact us at [email protected].