Privacy notice
Operator: J Live Solutions, 178 Currie Road, Durban, South Africa · info@jlivesolutions.co.za
Effective date: 15 October 2026
Who we are: QuoteKit is run by J Live Solutions, 178 Currie Road, Durban, South Africa ("QuoteKit", "we", "us").
Contact for privacy questions: info@jlivesolutions.co.za
Information Officer: Rene Tambwe, info@jlivesolutions.co.za
This notice explains, in plain language, what personal information QuoteKit collects, why we collect it, who we share it with, how long we keep it, and what your rights are under the Protection of Personal Information Act, 2013 (POPIA).
1. Two kinds of information, two different roles
- Your account information (you, the QuoteKit user). For this information we are the responsible party under POPIA: we decide why and how it is used.
- Your clients' information (the people and businesses you add to QuoteKit and send quotes and invoices to). You decide what you add and why. For this information you are the responsible party and QuoteKit acts as your operator: we store and process it only to provide the service to you, we keep it confidential and secure, and we do not use it for any other purpose. You are responsible for having a lawful reason to hold your clients' details.
2. What we collect
When you sign up and use your account
- Your name, email address and password. We store your password only as a one-way scrambled value (a bcrypt hash), never in readable form.
- Optional business details you add in Settings: business name, VAT number, address and phone number. These print on your quotes and invoices.
What you create in QuoteKit
- Client records: name, email, phone, company, address and VAT number (all optional except the name).
- Quotations and invoices: numbers, dates, line items, quantities, prices, VAT, totals, notes, and whether an invoice is marked paid or unpaid.
- Share links you create for a quotation.
If you join the Pro waitlist
- Your email address, optionally your name, and which page you signed up from.
When you pay for Pro (once card payments are switched on)
- Payments are handled by Paystack. You enter your card or bank details on Paystack's checkout, not on QuoteKit. QuoteKit does not receive or store your full card number, expiry date or CVV.
- From Paystack we receive and store your plan, subscription status, a Paystack customer and subscription reference, and the payment notifications Paystack sends us (which include the amount, date, reference and the email address used to pay).
Technical information
- A single login cookie (
quotekit_session) that keeps you signed in for up to 14 days. It is needed for the service to work. We do not use advertising or analytics cookies, tracking pixels or chat widgets. - Our server keeps technical logs (such as error messages and, where recorded, IP address, browser type, the page requested and the time) for security and fault-finding.
When you email us
- Your email address and whatever you write to us.
We do not collect special personal information (such as health, religion or biometric data), and QuoteKit is not meant for anyone under 18.
3. Why we use it and our lawful basis
| What we do | Information used | Lawful basis under POPIA (s11) |
|---|---|---|
| Create and run your account, let you make quotes, invoices and PDFs | Account details, business details, client records, quote and invoice content | Needed to carry out our agreement with you (s11(1)(b)) |
| Bill you for Pro, manage your subscription, handle failed payments and refunds | Plan, payment references and status from Paystack, email | Needed to carry out our agreement (s11(1)(b)) |
| Keep tax and accounting records of what we charged you | Billing records for payments you made to us | Legal obligation (s11(1)(c)), including SARS record-keeping rules |
| Keep the service secure, prevent abuse and fix faults | Login cookie, server logs, account details | Our legitimate interest in running a safe service (s11(1)(f)) |
| Reply to your questions and support requests | Email address and message | Agreement (s11(1)(b)) or legitimate interest (s11(1)(f)) |
| Tell you about Pro when you joined the waitlist | Waitlist email and name | Your consent (s11(1)(a)). You can withdraw it at any time. |
| Send service messages (billing, security, changes to these terms or prices) | Agreement (s11(1)(b)) | |
| Send marketing about other products or offers | Only with your consent, or to existing customers about similar services with an easy opt-out in every message (POPIA s69) |
We do not sell your personal information, and we do not use your clients' information for our own marketing.
4. Who we share it with
We share personal information only with service providers who help us run QuoteKit, and only as far as they need it:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | Hosting: runs the app and stores the database and its backups | Server in the European Union |
| Paystack (once card payments are live) | Payment processing and subscriptions. Paystack collects card and bank details directly, under its own privacy policy on paystack.com. | South Africa and other countries where Paystack and its group operate |
| GitHub | Stores an encrypted copy of our database backups, off the hosting server. GitHub cannot read it; only we hold the key. | United States |
| Our domain email host | Delivers and stores email sent to and from info@jlivesolutions.co.za | Mail server in the European Union |
QuoteKit itself does not currently send automated emails, so no separate email-sending provider receives your information. We may also disclose information if the law requires it (for example to SARS or a court), or to protect our rights or someone's safety.
5. Information sent outside South Africa
Our hosting and email servers are in the European Union, our encrypted off-site backup copy is stored by GitHub in the United States, and Paystack and its group companies may process payment information outside South Africa. Under POPIA (s72) we only allow this where the recipient is bound by law, binding corporate rules or a contract that gives protection substantially similar to POPIA (EU providers are bound by the GDPR), or where the transfer is needed to carry out our agreement with you.
6. How long we keep it
| Information | How long |
|---|---|
| Your account, business details, clients, quotes and invoices | For as long as your account is open. When you delete your account in Settings, it is deleted straight away. If you ask us by email, we delete it within 30 days of your request. |
| Backups | Daily database backups are kept on the hosting server, and an encrypted copy is stored off the hosting server in a private GitHub repository. Both are overwritten within 35 days, so deleted information disappears from backups within 35 days of deletion. |
| Billing records for payments you made to us (amounts, dates, Paystack references) | 5 years, as SARS requires. These are kept even if you delete your account. |
| Request logs | 30 days |
| Security logs | 12 months |
| Login sessions | Up to 14 days, or until you log out or delete your account |
| Waitlist details | Until you ask us to remove them, or 6 months after Pro launches, whichever comes first. Deleting your account also removes them. |
| Support emails | Up to 24 months after the conversation ends, unless they form part of billing records |
Your own tax records are your responsibility. SARS expects you to keep your own invoices (usually for 5 years). QuoteKit is a tool, not an archive. Download PDFs of your invoices and keep your own copies, especially before you delete your account.
7. How we protect it
- Passwords are stored as bcrypt hashes, not in readable form.
- The login cookie is HTTP-only, so page scripts can't read it, and it is sent only over secure connections.
- Each user can see only their own clients, quotes and invoices.
- The site runs only over HTTPS, with strict security headers.
- Server access is limited to key-based logins, and configuration secrets are kept in files only the server administrator can read.
- Card details never reach our servers. Paystack handles them.
- Daily database backups, with an encrypted copy stored off the hosting server, all overwritten within 35 days.
No system is perfectly secure. If a breach puts your personal information at risk, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA s22 requires.
8. Your rights
Under POPIA you can:
- ask what personal information we hold about you and get a copy;
- ask us to correct information that is wrong or out of date (you can edit most of it yourself in Settings and in your client list);
- delete your account yourself in Settings, or ask us to delete your information, except where we must keep it by law (for example billing records SARS requires);
- object to us using your information on the basis of legitimate interest, and object to direct marketing at any time;
- withdraw consent where we rely on it (for example the waitlist);
- complain to the Information Regulator (see below).
To use any of these rights, email info@jlivesolutions.co.za from the email address on your account. We may need to confirm it is you. We reply within 30 days. There is no charge for simple requests.
If you are asking about your clients' information stored in your account, please contact the QuoteKit user (the business that sent you the quote or invoice). We will help them respond.
9. Complaining to the Information Regulator
If you're unhappy with how we handle your information, please contact us first so we can try to fix it. You also have the right to complain directly to the Information Regulator (South Africa):
- Website: https://inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za · 010 023 5200
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
10. Changes to this notice
We may update this notice; material changes will be notified by email at least 30 days before they take effect. The effective date at the top shows the latest version.