Privacy Notice (POPIA)

Version: Rev 00, 15 November 2026

1. Who is responsible

Jonathan Kruger, trading as Overbilled, is the "responsible party" under the Protection of Personal Information Act 4 of 2013 (POPIA).

• Address: 419 Vale Avenue, Ferndale, Randburg, 2194
• Email: hello@overbilled.co.za
• Information Officer: Jonathan Kruger, hello@overbilled.co.za

2. The free checker

It runs in your browser. We do not receive or save what you enter.

We count visits to the site, and each time a Check button is used, with Cloudflare Web Analytics (Cloudflare, USA), which loads on every page. Cloudflare says it "does not collect or use your visitors’ personal data". When a check runs, the page address changes to /check/ran/ so that it is counted; if you came from one of our tagged links in a post, it also names that post's site, for example /check/ran/fb/. Nothing you typed is in that address.

3. What we collect for a paid check

• Your name, email, payment confirmation and payment method, the City account number you give when you pay, and your answer to the agreement (all kept in your order record).
• Your municipal bills. They contain your name, address and account number, and sometimes an ID number.

We collect it from you. Giving it is voluntary, but we cannot do the check without it. Tax law requires us to keep the payment records (Tax Administration Act s29). Please hide any ID number before sending, if it is not needed.

Bills can also name other people, such as tenants or agents. Please cover their names; we need only the figures.

If we refund you by EFT (see the refund policy), the owner asks for your bank account details by email, from the refund address in the refund policy. The owner uses them only to pay that refund, and may enter them on Paystack's refund screen if Paystack asks for them. They are not given to the AI: please never send them to hello@overbilled.co.za; if they arrive there, we delete them and tell you. We delete your bank details once the refund is paid, except what accounting law requires us to keep.

If you ask to be told when paid checks open, we keep only your email address and the date you asked. We use it to send you that one email, then delete it. If paid checks have not opened within 90 days, we delete it anyway.

4. Why we use it

To do your check, send your report, take payment, give refunds, and keep records the law requires. Our basis is your consent and the contract between us (POPIA s11). We do not sell your information. We do not use it for marketing.

5. Who sees it

• Anthropic (USA). Two Claude AI models, made by Anthropic, each read your bills once and copy the figures into your case file. We use Anthropic's business service (its API) under its Commercial Terms, which say "Anthropic may not train models on Customer Content from Services", and its Data Processing Addendum, which says "Customer is the controller and Anthropic is Customer’s processor". So Anthropic processes your bills only for us, under a written contract, as POPIA s21 requires. We give the AI your bills, not your payment or bank details.
• Zoho (email, USA). Your bills, and any request to be told when paid checks open, arrive at hello@overbilled.co.za on Zoho Mail, and your report is sent from there. Zoho keeps this mailbox in its United States data centres. Zoho processes it for us under its Data Processing Addendum, signed on 13 November 2026.
• Cloudflare (USA): hosts this website, and counts visits (section 2). Its Data Processing Addendum, part of the agreement we accept to use it, says we are the controller and "Cloudflare is a Processor".
• The payment gateway: Paystack. It handles your card details. We do not.

Each provider handles your information under its own terms: Anthropic's Commercial Terms (https://www.anthropic.com/legal/commercial-terms) and Data Processing Addendum (https://www.anthropic.com/legal/data-processing-addendum); Zoho's privacy policy (https://www.zoho.com/privacy.html); Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/) and Cloudflare's Data Processing Addendum (https://www.cloudflare.com/cloudflare-customer-dpa/); Paystack's terms and privacy policy (https://paystack.com/terms). We don't claim more protection than those terms give.

6. Sending information outside South Africa

Anthropic is based in the United States and Zoho keeps this mailbox there, so your bills leave South Africa. POPIA asks us to tell you the level of protection there: the protection we can point to is those providers' terms, Anthropic's Data Processing Addendum and the retention rules in section 7, not a law like POPIA. We rely on your consent, given when you order (POPIA s72(1)(b)). If you don't agree, please don't order.

7. How long we keep it

We delete our copies of your bills and report, including the emails that carried them, 30 days after your case ends: when we deliver your report, or when your order closes without one (you cancel, we refund you, or we have no usable bills 30 days after you pay). Zoho's policy is to keep deleted emails on its servers for 30 days after they leave the trash, when they can still be restored, and then to remove them for good; our deletion empties them from the trash too (Zoho's "Mail deletion and retention policy", https://www.zoho.com/mail/help/data-deletion-policy.html). Anthropic's API documentation (https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) says: "Conversation content (your prompts and Claude’s outputs) is not retained by default". It also says Anthropic "may retain data where required by law or where it has been flagged by Anthropic’s automated trust and safety systems", and that "if a chat or session is flagged, Anthropic may retain inputs and outputs for up to 2 years". We keep payment and refund records, including your order record, for 5 years from the date we file the tax return that covers them, as the Tax Administration Act requires (s29), and longer only while a SARS audit, objection or appeal about them is open (s32).

8. Security

We use reasonable measures: our working files are on one computer whose disk is encrypted (FileVault), and that folder is left out of the computer's backup; your emails stay in our Zoho mailbox until we delete them, and your bills pass through Anthropic as section 5 explains; the keys and passwords our software uses (for the AI, for Paystack and for the mailbox) can be read only by the owner's account on that computer; signing in to our Zoho, Paystack and Cloudflare accounts, and to our Anthropic account (through Google sign-in), needs a second step as well as the password (two-step login), and our software signs in to the mailbox with its own app password, which the owner can cancel; and a tool lists each case when it is due, so its files and emails are deleted 30 days after the case ends. Email is not guaranteed to be encrypted end to end, so send only the bills we ask for. You pay on Paystack's screen and we never see your card details; Paystack says it has been audited by a PCI-certified auditor and is certified as a PCI Level 1 Service Provider. If your information is compromised, we will tell you and the Information Regulator as soon as reasonably possible (s22).

9. Your rights

You may ask:

• what we hold about you (s23);
• us to correct or delete it (s24);
• to withdraw your consent (this will stop the service, and does not affect past use);
• to object to our processing on reasonable grounds relating to your situation (s11(3)).

Email hello@overbilled.co.za. You may also complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg; 010 023 5200; enquiries@inforegulator.org.za; or its online POPIA complaints form at eservices.inforegulator.org.za/complaints/default.aspx.

10. Children

This service is not for people under 18.

11. Changes

We will update this page and the date above.