Skip to document
slipr
SupportBack to slipr
Your information

Privacy Policy

A clear account of the information slipr processes, the services involved and the choices available to you under POPIA.

Effective 1 September 2026South Africa only

This Privacy Policy explains how slipr collects, uses, shares, stores, and protects personal information when you use the slipr website, account, receipt-scanning tools, shared bills, token wallet, support, and related services (the Service).

1. Responsible party

The responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) is Johannes Christiaan Myburgh, a South African sole proprietor trading as slipr.

slipr is offered only in South Africa. Although users and supported restaurant slips are limited to South Africa, some service providers process information in other countries as explained in section 8.

2. Personal information we process

Depending on how you use slipr, we may process:

  • Account information: name, display name, email address, profile image, Google account identifier, authentication provider, and account timestamps.
  • Session and technical information: session tokens, IP address, browser or device user agent, security events, error information, and approximate timestamps of activity.
  • Receipt information: photographs or uploaded images of restaurant slips; merchant name; receipt date; line items; quantities; prices; taxes; gratuities; totals; tax identifiers printed on a slip; OCR text and coordinates; corrections; and processing results.
  • Shared-bill information: share tokens or links, participant display names, claimed items, selected tips, paid or unpaid markers, bill status, and account-to-bill membership.
  • Token and service-use information: token balance, free or purchased allocations, successful scan and rerun usage, token deficits, adjustments, refund entries, and related technical usage such as image count and AI-processing token count.
  • Payment information: token bundle, amount, currency, payment status, transaction reference, refund status, and limited customer or payment-method information returned by Paystack. Full card details and security codes are intended to be handled by Paystack and the relevant financial institutions rather than stored in the slipr application database.
  • Communications: support requests, complaints, refund requests, privacy requests, emails, and any information you include in them.
  • Browser-stored information: a guest browser identifier, guest display name, recently joined share links, and recent receipt identifiers stored in local storage on your device.

A restaurant slip may incidentally contain personal information about staff, diners, loyalty members, or other people. Do not upload information that is unnecessary for splitting the bill, and do not upload a document unless you are entitled to process and share it.

3. Where information comes from

We collect information:

  • directly from you when you create an account, scan a slip, edit a bill, buy tokens, or contact support;
  • from another user when they create or share a bill involving you;
  • from your browser or device when you use the Service;
  • from Google when you choose Google authentication;
  • from Paystack and participating financial institutions in relation to a payment or refund; and
  • from our service providers when they return OCR, AI extraction, email-delivery, hosting, security, or diagnostic results.

4. Why we process information

We process personal information where reasonably necessary to:

  • create and secure accounts and sessions;
  • scan, extract, store, edit, publish, and close restaurant bills;
  • allow participants to join a bill, claim items, select tips, and mark payment status;
  • calculate token usage, maintain balances, deliver purchases, and keep transaction records;
  • process and reconcile Paystack payments, refunds, reversals, disputes, and suspected fraud;
  • provide support and respond to complaints, privacy requests, and legal notices;
  • detect abuse, protect users, troubleshoot failures, and improve reliability;
  • send authentication, security, support, and service communications;
  • maintain financial, consumer, and compliance records; and
  • establish, exercise, or defend legal rights and comply with law.

Our processing is based, as applicable, on performing our agreement with you, your consent, compliance with legal obligations, protecting your or another person’s legitimate interests, or pursuing slipr’s legitimate interests where your rights do not override those interests.

5. Information you must provide

Information needed to create an account, authenticate, process a receipt, maintain a token balance, or complete a payment is mandatory for that function. If you do not provide it, the relevant function may not work.

A guest display name is needed to identify a participant within a shared bill but does not need to be a full legal name. Optional profile information may be left blank where the interface permits.

6. Automated processing and AI

slipr uses automated OCR and AI systems to convert receipt images and text into proposed bill data. These systems can be inaccurate. The bill owner must review the result before publishing or relying on it.

Automated systems also calculate token usage from recorded processing activity. The resulting deduction appears in token history and may be queried through support@slipr.co.za. slipr does not use receipt extraction to make decisions that have legal or similarly significant effects about a person.

Paystack and participating financial institutions may separately use automated fraud, identity, and payment-authorisation controls under their own policies.

7. Service providers and disclosures

slipr is currently a solo project built, maintained, and operated by its proprietor. It has no employees, internal departments, or support contractors with access to personal information.

We send information only to the external systems needed to provide the Service:

  • Convex for application hosting, database functions, authentication components, and file storage;
  • Google for Google account authentication and Google Cloud Vision OCR. Receipt-image bytes are sent to Google Cloud Vision for document-text detection;
  • OpenAI for structured receipt extraction from OCR-derived evidence. slipr sends API requests with response storage disabled (store: false), but slipr stores returned extraction results and supporting processing records in its own Convex database;
  • Resend for transactional email delivery where email functionality is used;
  • Paystack South Africa Proprietary Limited, banks, card schemes, and payment-method providers to initialise, verify, reconcile, refund, and dispute token purchases.

We may also disclose information where South African law requires us to do so.

We do not sell personal information. We do not currently use personal information for third-party behavioural advertising.

8. Cross-border processing

Some providers may process or store information in South Africa and in other countries. In particular, Paystack states that payment and personal information may be processed outside South Africa, and our cloud, authentication, OCR, AI, and email providers may use international infrastructure.

Where POPIA applies, we will use providers, contracts, consent, or other lawful safeguards intended to ensure an adequate level of protection for cross-border transfers. Foreign laws may permit authorities in another country to access information in circumstances allowed by that country’s law.

10. Cookies and local storage

slipr uses authentication and security technologies needed to maintain sessions. The browser application also uses local storage to remember a guest identifier, display name, recently joined shared bills, and recent receipt identifiers on that device.

These technologies are used to provide the Service rather than for third-party advertising. You can clear local storage or site data in your browser, although doing so may sign you out or cause the browser to lose access to guest bill history. Paystack and Google may use their own cookies or similar technologies under their policies when you use their flows.

11. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, a compatible purpose, or a lawful obligation. The applicable period depends on the record:

  • account and profile data is generally kept while the account is active and while reasonably needed to resolve closure or security matters;
  • receipt images, OCR data, extracted bills, and shared-bill records are kept while needed to provide bill history and collaboration, until deletion or de-identification is appropriate, or while a dispute or lawful retention need continues;
  • guest identifiers and recent history remain in the guest’s browser until cleared, and server-side participation records remain with the associated bill while required for that bill;
  • token purchase dates, payment, refund, complaint, fraud-prevention, tax, and transaction records may be retained for the periods required by applicable law and legitimate record-keeping needs; purchase dates are retained for allocation history and do not create an automatic token-expiry date; and
  • service providers retain information under their own contracts, legal duties, backup cycles, and published policies.

The current product does not promise immediate or automatic deletion of the complete receipt and shared-bill record when an account closes. A deletion request will be assessed under POPIA, taking account of other participants’ information, legal obligations, transaction integrity, backups, disputes, and whether deletion, restriction, or de-identification is appropriate.

12. Security

We use reasonable technical and organisational measures intended to protect personal information against loss, misuse, unauthorised access, alteration, or disclosure. Measures include access controls, authenticated accounts, non-public application functions for sensitive operations, restricted provider credentials, encrypted network connections, and use of specialist service providers.

No internet service is completely secure. You are responsible for protecting your device, authentication account, and shared-bill links.

13. Your POPIA rights

Subject to POPIA and other applicable law, you may ask us to:

  • confirm whether we hold personal information about you;
  • provide access to that information;
  • correct or update inaccurate or incomplete information;
  • delete or destroy information that we are no longer authorised to retain;
  • restrict or object to certain processing;
  • explain or review an automated token deduction; or
  • withdraw consent where processing depends on consent, without affecting earlier lawful processing.

Send a request to support@slipr.co.za. Describe the right you want to exercise and the relevant account, payment, or bill. We may request proportionate proof of identity and may refuse or limit a request where the law permits or requires it. We will explain the applicable reason.

14. Security compromises

If there are reasonable grounds to believe that an unauthorised person accessed or acquired personal information, we will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires, subject to lawful delays and directions.

15. Children

slipr accounts and token purchases are for people aged 18 or older. A guest who lacks full legal capacity should use a shared bill only with appropriate parent or guardian involvement. We do not knowingly invite children to create accounts or purchase tokens.

16. Changes to this policy

We may update this policy to reflect changes in the Service, providers, law, or our processing. We will post the revised effective date and give reasonable notice of material changes where required. A new purpose that is materially incompatible with the original purpose will be handled in accordance with POPIA.