Privacy Policy
Debtorbird is operated by Resilia Tech (Pty) Ltd, a company registered in South Africa (registration number 2026/715754/07), of 120 Munyaka South, Midrand, Johannesburg, Gauteng, 2055, South Africa ("we", "us"). Contact: info@debtorbird.com.
This policy explains what personal information Debtorbird handles and why. We act as the responsible party (controller) for your account information, and as an operator (processor) for the Xero data we handle on your behalf.
What we collect
- Account details from Xero sign-in: your name, email address and Xero user ID.
- Xero organisation data, read-only: organisation details, contacts (names, email addresses), invoices, payments, attachments and tracking categories, read when needed to produce statements, receipts, invoices and checks.
- Settings and logs: schedules, sender name, reply-to address, email wording, logos you upload, and a record of which emails were sent, skipped or failed.
- Billing: handled by Dodo Payments as Merchant of Record. We receive your subscription status and billing contact, never your full card details.
- Emails to us and basic server logs (IP address, time, pages requested) kept for security.
How we use it
- To provide the Service: generate PDFs and send emails to your customers on your instructions.
- To secure and maintain the Service, and to answer your support requests.
- To bill you, and to tell you about important changes. We do not sell personal information or use Xero data for advertising or to train AI models.
Where it is stored and who processes it
- Hosting: Amazon Web Services. Xero access tokens are encrypted at rest.
- Email delivery: our email sending provider, which receives the recipient address and message content.
- Payments: Dodo Payments.
- Xero: we read data through Xero's API under your authorisation.
Some of these providers process data outside South Africa. We use providers that commit to appropriate safeguards for such transfers.
How long we keep it
We keep account data while your account is open. Xero data is read when needed and not copied beyond what is required to send and log emails. Send logs are kept for up to 24 months. When you remove an organisation or close your account, we delete its stored data and tokens within 30 days, except records we must keep by law (for example billing records).
Your rights
Depending on where you live (including under South Africa's POPIA, the UK GDPR and EU GDPR), you can ask to access, correct or delete your personal information, object to or restrict its use, or receive a copy. Email info@debtorbird.com. You may also complain to your data protection authority; in South Africa, the Information Regulator.
If you are a customer of one of our users and received a statement or receipt through Debtorbird, the business that sent it controls your information; please contact them first. We will help them respond.
Cookies
We use one essential sign-in cookie on app.debtorbird.com. We do not use advertising or tracking cookies.
Changes
We will post updates here and email account holders about material changes.