Privacy Policy

Pencil & Pay is operated by Yarrum Apps (Australia). We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what information we collect, how we use it, and your rights.

1. Information we collect

We collect information you provide directly:

• Account information — name, email address, and password when you sign up.
• Business information — business name, address, phone, website, and logo uploaded in your profile.
• Client data — names, companies, and contact details of clients you add to the app.
• Financial data — proposal and invoice amounts, line items, and tax details you create. We do not store credit card numbers — payments are handled by Stripe.
• Usage data — pages visited, features used, and device/browser information collected automatically.

2. How we use your information

• To provide and operate the Pencil & Pay service.
• To send transactional emails such as proposal and invoice notifications (via Resend).
• To process subscription payments and manage your plan (via Stripe).
• To respond to support requests and communicate service updates.
• To improve the product through aggregate, anonymised usage analysis.

We do not sell your personal information to third parties or use it for advertising.

3. Third-party services

We rely on the following trusted third parties to operate our service:

• Supabase — database and authentication hosting. Your data is stored on Supabase infrastructure.
• Stripe — payment processing for your clients and your Pro subscription. Stripe's privacy policy governs payment data.
• Resend — transactional email delivery for proposal and invoice notifications.
• Vercel — hosting for our web application and marketing site.

Each service provider is contractually bound to protect your data and may only use it to provide services to us.

4. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or financial compliance purposes.

5. Your rights

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Export your data in a portable format.

To exercise any of these rights, contact us at hello@pencilandpay.com.

6. Security

We use industry-standard security measures including encrypted data storage, HTTPS, and row-level security policies. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

8. Mobile app (iOS & iPadOS)

The Pencil & Pay iOS and iPadOS app connects to our servers to sync your data. In addition to the information described above:

• No location data — we do not collect or request access to your device location.
• No contacts access — client data is entered manually; we do not access your device contacts.
• No camera or microphone — we do not access your camera or microphone.
• Network access — the app requires an internet connection to sync proposals, invoices, and client data with our servers.
• Authentication tokens — a secure session token is stored locally on your device to keep you signed in.

The app does not collect any data for tracking or advertising purposes. We do not share your data with data brokers or advertising networks.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email or via an in-app notice. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or complaints, please contact us at hello@pencilandpay.com. If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner.