Privacy Policy

• We never see or store card numbers, bank passwords or your customers' money.
• Your customers' details belong to you. We hold them to run the service for you.
• We do not sell data, and we do not use it to advertise to anybody.
• You can export everything, or ask us to delete it.

• Your email address and password, or your Google sign-in if you use it.
• Your business details: name, contact information, currency, timezone, logo, and the payment details you choose to show customers.
• Which plan you are on, and a record of changes made in your account.

Whatever you enter: names, email addresses, phone numbers, what they owe, when it is due, what they have paid, and any receipt images they upload. We hold this on your behalf so the service can do its job. You decide what goes in and what comes out.

Your customers never have an account with us and are never asked for a password. They open a private link, see what they owe, and can press one button to say they have paid.

• Card numbers, CVVs, bank logins or PINs. Nowhere in the service asks for them, from you or from your customers.
• Your customers' money. They pay you directly. We record that it happened.

Connecting your Google account lets PayList send reminders from your own address. We ask only for permission to send mail, and for your email address and name so we can show you which account is connected.

We cannot read your inbox. The permission we request does not allow it. The access token that lets us send is encrypted before it is stored, and you can withdraw it at any time in Settings, or from your own Google account, and we delete our copy.

We use a small number of services to run PayList, and only the ones we need:

• Supabase — the database and sign-in, where your records are stored.
• Vercel — hosting, which serves the pages and runs the reminder job.
• Google, or an email provider — only to deliver the reminders you send.

We do not sell or rent information to anybody, and we do not use it for advertising. We share it only where the law requires, or where you have asked us to.

For as long as your account is open. If you delete your account we remove your data within 30 days, other than records we must keep for tax or accounting. Downgrading to the Free plan deletes nothing.

Under the Data Privacy Act of 2012 you may ask to see the information we hold about you, correct it, have it deleted, or object to how it is used. Email us and we will act within 30 days.

You can export your customers, subscriptions and payments to CSV at any time, on any plan, without asking us.

Where you enter your customers' details, you are the one responsible for them under that Act, and we handle them on your instructions.

Every account's data is separated in the database itself, not merely filtered in the app, so one business cannot reach another's records. Connections are encrypted, and credentials such as Google access tokens are encrypted before storage.

No system is perfect. If information is exposed, we will tell affected users and the National Privacy Commission as the law requires.

PAYLIST SOFTWARE PUBLISHING, Philippines. Email ahmadoo.rajeh@gmail.com about anything on this page.