Privacy Policy

1. Introduction

SimplePayment ("SimplePayment," "we," "us," or "our") is an invoicing and payment-collection service. This Privacy Policy applies to the SimplePayment marketing website (simplepayment.io), the SimplePayment application, and the payment pages your clients use to pay an invoice. It explains what personal information we collect, why we collect it, how we use and protect it, and the choices and rights available to you.

2. Who We Are

SimplePayment is a service operated by RHOMTRIP OÜ, a company registered in Estonia (registration number 14554819, VAT number EE102120215), with its registered address at Linda tn 2 (Objekt), Narva, Ida-Viru County 20309, Estonia. Depending on the type of information involved, RHOMTRIP OÜ acts either as the data controller or as a data processor — see Section 3 below for exactly which role applies to which information.

3. Information We Collect

It matters, under data protection law, who is responsible for what information. We collect two distinct categories of personal information, and our role is different for each:

• Customer account data — your name, email address, password (stored as a hash, never in plain text), business details, and subscription/billing relationship with us. RHOMTRIP OÜ is the data controller for this category — we determine why and how it's processed.
• Invoice and client information — the details you enter about your own clients (name, email, billing details, amounts, and currency) in order to create and send invoices. For this category, you are the data controller and RHOMTRIP OÜ acts only as a data processor, handling it on your instructions to provide the service.
• Payment information — invoice amounts, currency, and payment status belong to the invoice/client information category above (you are the controller). Your own subscription payments to us are customer account data (RHOMTRIP OÜ is the controller). Either way, card numbers are entered directly into Stripe's hosted checkout and are never transmitted to or stored on SimplePayment's own servers.
• Technical information — standard log data such as IP address, browser type, device information, and access times, collected automatically when you use the website or application. This falls under customer account data, and RHOMTRIP OÜ is the controller.

If you're an invoice recipient rather than a SimplePayment customer, the business that sent you the invoice is the controller of your information, not RHOMTRIP OÜ — see Received an Invoice for more.

4. How We Use Personal Information

We use personal information to:

• Provide, operate, and maintain the SimplePayment application and payment pages;
• Create, send, and track invoices on behalf of business users;
• Process payments and record payment status;
• Authenticate accounts and keep them secure;
• Respond to support requests and communicate with you about your account;
• Meet legal, tax, and accounting obligations; and
• Maintain the security and integrity of the service.

5. Legal Bases for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we process personal information on the following legal bases: performance of a contract (to provide the service you've signed up for), legitimate interests (to keep the service secure and functioning properly), and compliance with a legal obligation (such as tax and accounting record-keeping). We do not rely on consent for any core part of the service described in this policy.

6. Cookies & Similar Technologies

The SimplePayment application uses a small number of strictly necessary cookies to keep you signed in and to maintain your session securely. The public marketing website (simplepayment.io) does not use advertising or tracking cookies.

7. Payment Processing

Card payments are processed by Stripe on a hosted checkout page. SimplePayment never receives or stores raw card numbers. Information you submit directly to Stripe during checkout is also governed by Stripe's own privacy policy. Bank transfer, cash, and check payments are recorded manually by the business you're paying, based on information they confirm on their end.

8. Data Retention

We retain account, invoice, and payment information for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and accounting obligations or to resolve disputes. If you close your account, you may request deletion of your personal information, subject to any records we're required to keep by law.

9. International Data Transfers

Our primary database infrastructure is hosted in the European Union (Stockholm, Sweden). Some of our third-party service providers, including Stripe and SendGrid, operate globally and may process information outside the EU. Where that happens, we rely on appropriate safeguards, such as standard contractual clauses, to protect your information.

10. Security Measures

Stored secrets, such as payment-provider API keys, are encrypted at rest (AES-256-GCM). Passwords are stored as salted hashes, never in plain text. We apply standard hardening practices, including rate limiting and secure HTTP headers, across the application. More detail is available on our Security page.

11. Third-Party Service Providers

We use a small number of third-party providers to operate SimplePayment:

• Stripe — card payment processing and hosted checkout.
• SendGrid — sending transactional emails, such as invoices and receipts.
• MongoDB Atlas — database hosting, in the European Union (Stockholm, Sweden).

Each provider processes information only as necessary to perform its function and is bound by its own privacy and security obligations.

12. User Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. For customer account data, contact us at support@simplepayment.io to exercise these rights. For invoice or client information, RHOMTRIP OÜ processes it only on behalf of the business that entered it — please contact that business directly, as they are the controller for that information. If you're located in the European Union, you also have the right to lodge a complaint with your local data protection authority, or with Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon).

13. Children's Privacy

SimplePayment is a business tool and is not directed at, or knowingly used to collect information from, individuals under the age of 16.

14. Contact Information

SimplePayment is a service operated by RHOMTRIP OÜ, Linda tn 2 (Objekt), Narva, Ida-Viru County 20309, Estonia (registration number 14554819, VAT EE102120215). For privacy questions or to exercise your rights, contact us at support@simplepayment.io or info@simplepayment.io.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you directly. We encourage you to review this page periodically.