Privacy policy

Last updated 11 October 2026

Who we are

Sandbox runs this payment reminder service for businesses. A business that uses it connects its own Xero account and decides whether reminders are sent. We handle its customers' details on the business's behalf, only to send payment reminders and show the business the results.

What we collect

From each business that uses the service, we keep the email address used to sign in and a scrambled version of the password, never the password itself.

From the business's Xero account, we read sales invoices that are approved, unpaid and past their due date. For each one we keep the invoice number, amount owed, currency and due date, and the customer's name and mobile number. We never read supplier bills, bank details or any other part of the Xero account.

For each reminder, we keep the exact message sent, when it was sent, and the delivery results reported by Twilio, such as delivered, read or not delivered. If a customer replies, we read the reply to act on it.

The only cookie we set keeps a business user signed in. We do not use advertising or tracking cookies.

How we use it

Only to send payment reminders on WhatsApp for the business, to show the business what was sent and what happened, and to keep the service secure and working. We do not sell it, and we do not use it for marketing.

Who we share it with

Twilio and WhatsApp, which is run by Meta, receive the customer's mobile number and the message, in order to deliver it. Railway hosts the service and its database in Singapore. Encrypted backups are kept on GitHub. When a customer replies with anything other than STOP or START, the first few replies each day are emailed to the business through Resend, an email service, so a person can read them. Some of these providers may process data outside Singapore.

How we protect it

Customer names, mobile numbers, messages and Xero access keys are encrypted with AES-256 before they leave the service for the database, so they stay encrypted inside the database and its backups. Connections between your browser and this service, and between this service and Xero, Twilio and Resend, use HTTPS. Backups are encrypted again with a separate key. Passwords are stored only as a one way hash. Only the business that owns the data can see it in the dashboard.

How long we keep it

Each reminder record, including the customer's name and number, is kept for one year after the reminder was sent, or for as long as the invoice is still overdue, whichever is longer, then deleted automatically. An invoice that is paid before any reminder is sent is deleted straight away. Encrypted backups are kept for 30 days, so deleted records can remain in a backup for up to 30 days. Xero, not this service, is the permanent record of invoices and payments.

Stopping reminders

A customer can reply STOP to any reminder to stop receiving them, and START to receive them again. Only a scrambled code of the number is kept for this, not the number itself. A scrambled code is also kept for 7 days so a customer gets at most one automatic answer a day.

Your rights

Under Singapore's Personal Data Protection Act, you can ask what personal data we hold about you, how it has been used, and to correct it. If you received a reminder, you can ask the business that sent it, or contact us directly.

Contact

A contact email has not been set yet.

Changes

If this policy changes, the date at the top changes too.