Privacy Policy

DBM Webengineers (Pty) Ltd ("we", "us", "our") operates the EnveloPay mobile application and this website (together, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, and the rights you have. We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) of the Republic of South Africa.

By using EnveloPay, you agree to the collection and use of information in accordance with this policy.

1. Information we collect

Information you provide

• Account information — your name, email address and password when you register.
• Business information — business name, contact details and payroll settings you enter.
• Worker information — the names, ID numbers, contact details, pay rates, attendance, leave and payment records you capture about the workers you manage. Worker ID numbers are stored encrypted at rest. You are responsible for having a lawful basis to provide this information to us, and you have the option to withhold workers' personally identifiable information.
• Payment information — subscription and billing details, processed by our payment partner (see Third parties).

Information collected automatically

• Usage data — how you interact with the Service, including device type, operating system, app version and feature usage.
• Log data — technical records such as access times and error reports, used to keep the Service reliable and secure.

2. How we use your information

We use personal information only for legitimate, lawful purposes, including to:

• provide, operate and maintain the Service, including roll call, wage calculations and payslips;
• create and manage your account and subscription;
• process payments and send billing notices;
• respond to your support requests;
• improve, troubleshoot and secure the Service;
• comply with our legal and regulatory obligations.

We do not sell your personal information, and we do not use worker payroll data for advertising.

3. Storage and security

Your data is hosted on secure cloud infrastructure provided by Supabase. Data is encrypted in transit and at rest, and access is restricted through row-level security so that you can only access data belonging to your own account and businesses.

We retain personal information for as long as your account is active or as needed to provide the Service. EnveloPay uses soft deletion — records are marked as deleted and removed from view rather than erased immediately — and we will permanently delete or anonymise data when it is no longer required, or on valid request, subject to any legal retention obligations.

While we take reasonable technical and organisational measures to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Account deletion

You can delete your EnveloPay account at any time from Settings → Account → Delete account in the mobile app. When you delete your account, we immediately disable your login and remove your personal profile information. Payroll and employment records that you are required to keep under South African law (for example, under the Basic Conditions of Employment Act) are retained for the legally required period and then permanently deleted. Please export anything you need before deleting your account.

4. Third-party service providers

We share personal information only with trusted providers who help us deliver the Service, and only to the extent necessary:

• Supabase — database, authentication and hosting. Used to store and secure your account, business and payroll data.
• PayFast — payment processing for subscriptions. Your card details are handled directly by PayFast and are not stored on our servers.

These providers are bound by their own privacy and security obligations. We do not authorise them to use your information for any purpose other than providing services to us.

5. Your rights under POPIA

As a data subject, you have the right to:

• be notified that we collect your personal information;
• request access to the personal information we hold about you;
• request correction or deletion of inaccurate or outdated information;
• object to the processing of your personal information in certain circumstances;
• lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at hello@envelopay.co.za. You may also contact the Information Regulator (South Africa) at inforegulator.org.za.

6. Cookies and similar technologies

This website uses only essential cookies and similar technologies needed for the site to function and to remember basic preferences. We do not use third-party advertising or tracking cookies. The EnveloPay mobile app uses local storage on your device to keep you signed in and to operate the app. You can clear this data at any time through your device or browser settings.

7. Updates to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you through the Service. Your continued use of EnveloPay after changes take effect constitutes acceptance of the revised policy.

8. Contact us

If you have questions about this Privacy Policy or how we handle your personal information, contact:

DBM Webengineers (Pty) Ltd
Email: hello@envelopay.co.za