How we use and protect your information.

1. Who this notice covers

PayerPing is a business-to-business service operated by Right Cyber UK Limited, registered in England and Wales (company number 17307435), with a registered office at 41 Northampton Road, Bromham, Bedford, England, MK43 8PB. The subscribing business controls the payer and invoice information it adds. PayerPing processes that information to provide the service and acts as a processor where the subscribing business determines the purpose of processing.

Our data-processing terms form part of the service agreement and cover instructions, service providers, assistance, return and deletion, and audits.

This notice also covers people who book a call with us or whom we contact about trying PayerPing, for example in a free pilot. Section 8 explains that processing.

2. Information we process

• Account and authentication details for people using PayerPing.
• Business identity, reply address, payment instructions, and subscription status.
• Versioned legal acceptance records and the exact contract text accepted by an organisation owner.
• Sender-review status and hashed identity evidence used to approve, suspend, or restore outbound access.
• Payer names, company names, email addresses, notes, and suppression status.
• Invoice numbers, amounts, due dates, payment links, reminder schedules, and message content.
• Technical delivery records, provider message identifiers, audit events, and essential security logs.
• Connected mailbox identity and encrypted credentials used to send approved reminders.

The PayerPing mobile app uses the same account and service as the website. Clerk handles authentication and session security, including account identifiers and technical device/network information. The app stores its login credentials in the device's protected storage and requests business records from the service; it does not keep an offline copy of your payer or invoice lists.

The native app is for users aged 18 or over. This eligibility rule applies to app users, not to the ages of payers named in business records. To apply the rule, the app processes age-category, status and eligibility information supplied by Apple or Google on your device. PayerPing does not ask for your date of birth or identity documents. Age signals are not sent to PayerPing's servers, logs or analytics, or saved to your account. Any acknowledgement of the adult-only policy is held only in the current app session, rather than saved as a persistent setting. Apple and Google handle their own account and age-assurance information under their respective privacy notices.

3. Why we process it

We use the information to authenticate users, provide and secure the reminder service, direct payer replies to the business, enforce plan limits, manage PayerPing subscription billing, prevent duplicate or unwanted delivery, investigate failures, and meet legal obligations. We do not sell payer contact data.

We are the controller for our own account administration, subscription, support, security and legal records, and for contacting businesses about trying PayerPing (section 8). We rely on legitimate interests to administer a business customer's account, help its users, maintain a secure service and prevent abuse. Those interests are providing reliable business software and protecting customers and recipients. Where you personally enter a contract with us, processing necessary to provide it is based on that contract. Required tax and accounting records are processed to meet legal obligations. Where the law requires app age checks, we rely on that legal obligation; otherwise we rely on our legitimate interest in applying the app's adult-only eligibility policy. Optional website analytics and advertising measurement rely on your consent, which you can withdraw as explained below.

For payer and invoice data, the subscribing business determines the lawful basis and provides the relevant privacy information; we process that data on its instructions. We receive it from that business, rather than directly from the payer. Required account and invoice fields are needed to provide the requested service; without them we cannot perform the relevant action. We do not make decisions about your creditworthiness or use automated decision-making with legal or similarly significant effects.

4. Service providers

PayerPing relies on specialist providers for hosting and delivery, including Vercel (hosting), Neon (database), Clerk (authentication), Postmark (email), Stripe (PayerPing subscription billing), Inngest (scheduled work), Sentry (error and service monitoring), and Backblaze B2 (encrypted backup storage). Provider access is limited to the relevant function. Processing locations depend on the provider and service configuration and may be outside the UK. Restricted transfers require UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU standard contractual clauses, with any required assessment and supplementary measures. Contact us for the locations and safeguards applicable to your data and a copy of the relevant safeguards.

If you open the Help button, Zoho Desk loads our support form. Zoho receives connection information, such as your IP address, and any contact details, message or attachments you submit. The form does not automatically receive your PayerPing account, invoice or payer records.

Our call-booking links take you to Calendly. Calendly processes your name, email address, chosen meeting time and any information you enter in the booking form to arrange the call for us. It also receives technical information, such as your IP address and browser details. We receive your booking details and use them to arrange and follow up on the call, as explained in section 8. The transfer safeguards above also apply to this processing. Calendly's own website data handling and cookie choices are explained in its privacy notice.

When you connect a Microsoft or Google mailbox, that provider processes the approved messages sent from your account. We store encrypted mailbox credentials to maintain that connection. Microsoft access covers sending and basic account identity; Google access uses Gmail send permission and basic account identity. PayerPing does not request permission to read your inbox. Replies and invoice payments go directly to your business. Disconnecting in Settings stops use of the stored connection; you can also revoke PayerPing access in your mailbox provider's settings.

For information obtained through Google Workspace APIs, PayerPing follows the Google Workspace user data policy, including its Limited Use restrictions.

If you connect HubSpot, we receive the connected account and company record identity and store the account ID, account domain and an encrypted OAuth refresh token. Confirmed customer matches associate a PayerPing customer with a company record and include existing and future invoices currently assigned to that customer. Separate manual invoice links associate individual invoices with company records. Removing a customer match preserves manual invoice links and reminder schedules; matching or linking does not approve or send reminders. Owner verification stores a binding between your HubSpot user and PayerPing owner identity; short-lived verification challenges are stored as hashes. The verified owner’s card receives linked invoice and payer details, reminder history, sender and recipient addresses, and exact message previews, including any payment instructions in those messages. Owner actions can approve reminders, pause follow-up or record paid and disputed statuses in PayerPing. HubSpot adds the viewing user’s ID and email address to each card request; we use the signed account and user identifiers to check access and do not save the email address with your records. We do not import HubSpot invoices, write CRM records, read email replies or process payments through this connection. Disconnecting in PayerPing Settings stops future requests; a card already open can retain displayed details until refreshed or reloaded. You can revoke owner access or uninstall the app in HubSpot. Uninstalling in HubSpot does not notify us, so also disconnect in PayerPing Settings to delete the stored connection and token. Invoice, payer and reminder records remain subject to the retention and deletion rules below. The HubSpot setup guide at payerping.com/integrations/hubspot/setup explains access, customer matches, invoice links and removal.

Sentry helps us diagnose errors and monitor service reliability. Our application removes message content, user details, cookies, request payloads, query strings and other sensitive context before sending diagnostic events. Session replay is disabled.

5. Retention and deletion

Active account data is retained while the service is provided. Delivery, billing, suppression, and audit records may be retained afterwards where necessary for security, compliance, dispute handling, contract evidence, or to honour an unsubscribe. An organisation owner can download the organisation's current PayerPing records from the website's Settings. Use the Delete account page to request deletion of your login and associated business data. We aim to acknowledge the request within one business day and provide an outcome within 28 calendar days. You can also use the contact below if you cannot sign in. Pending reminders, mailbox access, subscription cancellation and provider copies are reconciled as part of the request; disabling access alone is not deletion.

Eligible payer, invoice and message content is removed. Minimum subscription accounting and contract records may be retained for applicable legal obligations; limited security, dispute and suppression evidence may need a documented retention period. We explain the categories, reason and expected expiry for any retained records or backup copies in the response to your request. A valid erasure request is not delayed by an optional export period.

6. Your choices and rights

To ask for reminders to stop, reply to the business shown in the reminder. The business must record your request in PayerPing; replying does not automatically stop the schedule because PayerPing does not read replies. Contact us if you cannot reach the business or want to report unwanted reminders. Stopping reminders does not determine whether an invoice is owed.

Depending on the circumstances, you have rights to access, correct, erase or restrict use of your personal data, and to receive portable data where processing is automated and based on consent or a contract. You can object to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. These rights have legal conditions and exceptions. Requests about a business's invoice records should normally go to that business first. We will assist it and pass on relevant requests; we handle requests about our own controller records directly. This notice does not limit additional rights or local-regulator complaint routes under the laws applicable to you.

7. Cookies, optional analytics and advertising

Authentication and security features use necessary browser storage. Separately, you can allow or reject Google Analytics, loaded through Google Tag Manager, and Vercel Analytics. These optional tools measure page visits, device and browser information, referral information and completed signups. Google Analytics may use analytics cookies. Our signup event contains the event name and signup method, not your email address, payer details or invoice content.

If you choose Allow all, we also use the Meta Pixel from Meta Platforms Ireland Limited to measure our Facebook and Instagram adverts. On our home, pricing, how it works, blog and support pages it tells Meta about page visits and clicks on sign-up buttons, together with your IP address and browser information. After you sign up, your browser sends Meta one completed-signup event. The pixel does not run inside your PayerPing account, and we do not send Meta your email address, payer details or invoice content. Meta may set cookies such as _fbp and may link these events to a Facebook or Instagram account you use, so we and Meta are jointly responsible for collecting them. Meta's use of the information it receives is explained in its Privacy Policy.

Optional analytics and advertising stay off until you choose Analytics only or Allow all. Rejecting them does not restrict the service. The Analytics preferences control at the bottom of every page lets you change your choice or withdraw permission. Your choice is stored in this browser until you change it or clear site storage. Withdrawing stops future optional measurement and removes this site's Google Analytics and Meta cookies; it does not delete information already received by analytics or advertising providers.

8. People we contact about trying PayerPing

You can book a walkthrough or other call with us. We also sometimes contact businesses to invite them to try PayerPing, for example in a free pilot, and to ask how they deal with late payments. We are the controller for this information.

We hold your name, business name, work email address or phone number, booking details, the company details we checked, how we came to contact you, notes from any call or pilot check-in (such as how you chase invoices and what you think of PayerPing), and any request not to be contacted. We get this from you, from someone who introduced you, from public sources such as Companies House and your business website, or from your reply to a public post. We do not buy contact lists, we do not note the names of your customers, and we do not record calls.

We rely on legitimate interests: arranging and following up on calls you request, finding businesses that PayerPing could help and learning whether it meets their needs. We email limited companies and limited liability partnerships (LLPs) at work addresses. We message sole traders and partnerships only where they have asked us to or agreed. Where you agreed to hear from us, we rely on that consent instead; you can withdraw it at any time by replying or using the contact below, without affecting contact before you withdrew it. Every message says who we are and how to stop further contact.

We contact you by email from a Microsoft 365 business mailbox, or by phone, text, WhatsApp or LinkedIn if that is how you asked to hear from us; Microsoft, Meta (for WhatsApp) and LinkedIn process those messages. Our email and office software providers also process our notes for us, and the transfer safeguards in section 4 apply. We may share this information with professional advisers or where the law requires. We do not sell it or share it for other companies' marketing.

We keep this information for up to 12 months after our last contact with you. If you sign up to PayerPing, including for a free pilot, your account is covered by the rest of this notice, and we keep our notes from pilot calls and check-ins for up to 12 months after the pilot ends. We share pilot results only in anonymised form, and only with your agreement. If we look up a business and then decide not to contact it, we delete what we noted within a month. If you ask us not to contact you, we keep your name, contact details and that request for as long as we contact businesses about PayerPing, so that we can honour it.

You can ask us to stop at any time by replying to our message or using the contact below. If you object to us contacting you about PayerPing, we will always stop. You also have the rights described in section 6, and you can complain as explained in section 9.

9. Contact

For privacy or data-rights questions, contact info@payerping.com. Include the relevant business name and invoice reference, but do not send bank credentials or passwords by email. You can make a data protection complaint to the same address without signing in or using a particular form. Tell us what happened and the outcome you seek. We will acknowledge a complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken.

You also have the right to complain to the Information Commission, the UK data protection regulator, which took over from the Information Commissioner on 30 September 2026 and still uses the name ICO. Visit ico.org.uk/make-a-complaint. Contacting us first can help resolve the issue, but does not remove your right to contact the Information Commission or seek a judicial remedy.