Privacy policy

Last updated 12 November 2026

Who we are

Sandbox runs this payment reminder service for businesses. A business that uses it connects its own Xero account and decides whether reminders are sent. We handle its customers' details on the business's behalf, only to send payment reminders and show the business the results.

What we collect

From each business that signs up, we keep its name, the owner's name, the email address used to sign in, a scrambled version of the password, never the password itself, and the owner's mobile number, encrypted, which receives test messages before the business goes live. We also keep the business's payment reference and paid-until date, and, if the owner turns on two-step sign-in, the encrypted key of their authenticator app. When the business connects its own WhatsApp number, we keep that number and the ids Meta and Twilio give its WhatsApp account.

From the business's Xero account, we read sales invoices that are approved, unpaid and past their due date. For each one we keep the invoice number, amount owed, currency and due date, and the customer's name and mobile number. We never read supplier bills, bank details or any other part of the Xero account.

If the business uses marketing, we also read the names and mobile numbers of its Xero contacts and any groups the business puts them in. Only a contact Xero marks as the business's customer, someone it already does business with, is taken to have agreed to receive its WhatsApp marketing. Anyone else is only sent marketing once the business records that they agreed. A contact stops receiving marketing when they reply STOP or the business removes their agreement. Before each marketing send, the business confirms that its contacts agreed or were checked against Singapore's Do Not Call Registry. We record when and by whom an agreement was given or removed, and that confirmation.

For each reminder, we keep the exact message sent, when it was sent, and the delivery results reported by Twilio, such as delivered, read or not delivered. If a customer replies, we read the reply to act on it.

The only cookie we set keeps a business user signed in. We do not use advertising or tracking cookies. When a business connects its WhatsApp number, its dashboard loads Meta's sign-in, which may set Meta's own cookies under Meta's privacy policy. Nothing from Meta loads on any other page.

How we use it

To send payment reminders on WhatsApp for the business, to send the business's own marketing messages to its Xero contacts who agreed and have not replied STOP, to show the business what was sent and what happened, and to keep the service secure and working. We do not sell it, and we never use it for our own marketing.

Who we share it with

Twilio and WhatsApp, which is run by Meta, receive the customer's mobile number and the message, in order to deliver it. Railway hosts the service and its database in Singapore. Encrypted backups are kept on GitHub. When a customer replies with anything other than STOP or START, the first few replies each day are emailed to the business through Resend, an email service, so a person can read them. Some of these providers may process data outside Singapore.

How we protect it

Customer names, mobile numbers, messages and Xero access keys are encrypted with AES-256 before they leave the service for the database, so they stay encrypted inside the database and its backups. Connections between your browser and this service, and between this service and Xero, Twilio and Resend, use HTTPS. Backups are encrypted again with a separate key. Passwords are stored only as a one way hash. Only the business that owns the data can see it in the dashboard.

How long we keep it

Each reminder record, including the customer's name and number, is kept for one year after the reminder was sent, or for as long as the invoice is still overdue, whichever is longer, then deleted automatically. An invoice that is paid before any reminder is sent is deleted straight away. Encrypted backups are kept for 30 days, so deleted records can remain in a backup for up to 30 days. Xero, not this service, is the permanent record of invoices and payments. Marketing contacts are kept while they are in the business's Xero, and records of marketing messages for one year.

Enquiries and registering interest

On our company website you can register interest in our upcoming products, giving your name, email address, country and the products you chose. You can also send a custom solutions enquiry, giving your business name, industry, company size, location, how urgent it is, any notes, your email address and your phone number. We use these details only to tell you about the products you chose, or to reply to your enquiry. This is the only time we contact anyone about our own products, and only because they asked.

Names, email addresses, phone numbers, business names and notes are encrypted like everything else. We are told by email that one arrived, without your details in that email. Each registration or enquiry is deleted automatically two years after it last changed, or sooner if you ask us.

Replying STOP

A customer can reply STOP to stop receiving marketing messages, and START to receive them again. Marketing is never sent to a customer who replied STOP. Reminders about invoices they have not paid are held, and only sent if the business chooses to send them after reading WhatsApp's opt out warning. Only a scrambled code of the number is kept for this, not the number itself. A scrambled code is also kept for 7 days so a customer gets at most one automatic answer a day.

Your rights

Under Singapore's Personal Data Protection Act, you can ask what personal data we hold about you, how it has been used, and to correct it. If you received a reminder, you can ask the business that sent it, or contact us directly.

Contact

A contact email has not been set yet.

Changes

If this policy changes, the date at the top changes too.