Privacy Policy
Last updated: July 2026
1. Who we are
ShellRick Tech Pty Ltd is a South African business administration company operated at shellricktech.co.za. We are committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).
Information Officer: informationofficer@sortednexus.co.za
2. What personal information we collect
| Category | Data | Lawful basis |
|---|---|---|
| Account / profile | Name, email, business name, address, VAT number | Contract (account registration) |
| Invoice data | Line items, amounts, client details on invoices you create | Contract (service delivery) |
| Client data | Third-party client names, emails, addresses you enter | Legitimate interest (business record keeping) |
| IP address (hashed) | SHA-256 hash of your IP, not reversible | Legitimate interest (rate limiting, abuse prevention) |
| Advertising | Anonymous usage data via Google AdSense (anonymous users only) | Consent (cookie notice) |
3. IP address handling
We use IP addresses solely to enforce the 3 free invoices per month limit for anonymous users. We never store raw IP addresses. All IP addresses are hashed using SHA-256 with a cryptographic salt before storage. The original IP address cannot be recovered from the stored hash.
4. Banking details and sensitive data
Banking details, VAT numbers, and client contact information (email, phone, address) are encrypted at the application level using AES-256-GCM before being written to the database. This means the data is unreadable even if the database itself were compromised. Encryption keys are held separately from the data and never stored in the database.
Banking details are additionally never logged in application logs and are excluded from all API responses except the account settings page when you are authenticated.
5. Advertising
We display Google AdSense advertisements only to anonymous (non-registered) users on the free tier. Ads are never shown to registered users or paying subscribers. AdSense may use cookies to show relevant ads, and this is covered by our cookie consent notice.
6. Anonymous invoice generation
Invoices created without an account are generated entirely in your browser and are never stored on our servers. The PDF is created client-side. Only the hashed IP address is recorded to enforce monthly limits.
7. Where your data is stored
| Service | Data stored | Location | POPIA basis |
|---|---|---|---|
| Neon (PostgreSQL) | Business profiles, invoices, client data, banking details | European Union: Frankfurt, Germany (AWS eu-central-1) | Adequate protection: EU GDPR equivalent |
| AWS Cognito | Email address and authentication credentials only | South Africa: Cape Town (AWS af-south-1) | In-country storage |
| Vercel | Application code and edge cache (no personal data stored) | Global CDN, no personal data persisted | No personal data |
| PayFast | Payment and subscription details | South Africa | In-country, PCI-DSS compliant |
| Google AdSense | Anonymous ad interaction data (non-registered users only) | Google infrastructure | Consent |
The transfer of personal data to Neon in Frankfurt is lawful under POPIA Section 72. Germany operates under the EU General Data Protection Regulation (GDPR), which provides equivalent or greater protection to POPIA. Authentication credentials are stored exclusively in South Africa via AWS Cape Town.
8. Your rights under POPIA
- Right to access your personal information
- Right to correct inaccurate information
- Right to delete your account and data
- Right to data portability (export your invoices and client list)
- Right to object to processing
To exercise these rights: use the account settings page, or email us at contact@sortednexus.co.za.
Data export: Log in and visit your account settings, or request a copy via email.
Account deletion: Deletes your profile and client list. Your invoices are anonymised (sender details removed) rather than deleted, as they may be held by your clients as business records.
9. Data retention
- Account data: retained until account deletion
- Invoice data: retained for at least 5 years (SARS requirement for financial records)
- Anonymous IP hashes: reset monthly
10. Third-party processors
- Neon Inc.: database hosting (Frankfurt, Germany)
- Vercel Inc.: application hosting (global CDN, no personal data stored)
- Amazon Web Services (AWS): authentication via Cognito (Cape Town, South Africa)
- PayFast: payment processing for subscriptions (South Africa)
- Google LLC: advertising via AdSense (anonymous users only)
11. Contact
For privacy questions or to exercise your rights, email: contact@sortednexus.co.za
Information Officer: informationofficer@sortednexus.co.za