Privacy policy

Who we are

Semper Ubique Technologies, of Singapore, runs semperubiquetech.com and makes SemperFlow, a service that reminds a business's customers about overdue invoices on WhatsApp. A business that uses SemperFlow connects its own Xero account and WhatsApp number, and decides whether reminders are sent. We handle its customers' details on the business's behalf, only to send its reminders and its own marketing, and to show the business the results.

What we collect

From each business that signs up, we keep its name, the owner's name, the email address used to sign in, a scrambled version of the password, never the password itself, and the owner's mobile number, encrypted, which receives test messages before the business goes live. We also keep the business's payment reference and paid-until date, and, if the owner turns on two-step sign-in, the encrypted key of their authenticator app. When the business connects its own WhatsApp number, we keep that number and the ids Meta and Twilio give its WhatsApp account.

From the business's Xero account, we read sales invoices that are approved, unpaid and past their due date. For each one we keep the invoice number, amount owed, currency and due date, and the customer's name and mobile number. We never read supplier bills, bank details or any other part of the Xero account.

If the business uses marketing, we also read the names and mobile numbers of its Xero contacts and any groups the business puts them in. Only a contact Xero marks as the business's customer, someone it already does business with, is taken to have agreed to receive its WhatsApp marketing. Anyone else is only sent marketing once the business records that they agreed. A contact stops receiving marketing when they reply STOP or the business removes their agreement. Before each marketing send, the business confirms that its contacts agreed or were checked against Singapore's Do Not Call Registry. We record when and by whom an agreement was given or removed, and that confirmation.

For each reminder, we keep the exact message sent, when it was sent, and the delivery results reported by Twilio, such as delivered, read or not delivered. If a customer replies, we read the reply to act on it.

The only cookie we set keeps a business user signed in. We do not use advertising or tracking cookies, on the app or on semperubiquetech.com. When a business connects its WhatsApp number, its dashboard loads Meta's sign-in, which may set Meta's own cookies under Meta's privacy policy. Nothing from Meta loads on any other page.

Enquiries and registering interest

On semperubiquetech.com you can register interest in our upcoming products, giving your name, email address, country and the products you chose. You can also send a custom solutions enquiry, giving your business name, industry, company size, location, how urgent it is, any notes, your email address and your phone number. We use these details only to tell you about the products you chose, or to reply to your enquiry. This is the only time we contact anyone about our own products, and only because they asked.

Your details are stored encrypted, and only our team can read them. We are told by email that a registration or enquiry arrived, without your details in that email. Each is deleted automatically two years after it last changed, or sooner if you ask us.

How we use it

To send payment reminders on WhatsApp for the business, to send the business's own marketing messages to its Xero contacts who agreed and have not replied STOP, to show the business what was sent and what happened, to answer enquiries sent to us, and to keep the service secure and working. We do not sell personal data, and we never use a business's customers' details for our own marketing.

Who we share it with

• Twilio, and WhatsApp, which is run by Meta, receive a customer's mobile number and the message, to deliver it.
• Railway hosts SemperFlow and its database in Singapore.
• GitHub keeps our encrypted nightly backups.
• Resend sends our emails, such as account notices, and the first few customer replies each day, which are forwarded to the business so a person can read them.
• Cloudflare runs our domain's addresses, and forwards email sent to our @semperubiquetech.com addresses to our own inbox, which Google hosts.

Some of these providers may process data outside Singapore, under protections comparable to the PDPA.

How we protect it

Customer names, mobile numbers, messages, Xero access keys and the details sent through our website's forms are encrypted with AES-256 before they are stored, so they stay encrypted inside the database and its backups. Connections between your browser and our services, and between our services and Xero, Twilio and Resend, use HTTPS. Backups are encrypted again with a separate key. Passwords are stored only as a one-way hash. Only the business that owns the data can see it in the dashboard.

How long we keep it

Each reminder record, including the customer's name and number, is kept for one year after the reminder was sent, or for as long as the invoice is still overdue, whichever is longer, then deleted automatically. An invoice that is paid before any reminder is sent is deleted straight away. Encrypted backups are kept for 30 days, so deleted records can remain in a backup for up to 30 days. Xero, not this service, is the permanent record of invoices and payments. Marketing contacts are kept while they are in the business's Xero, and records of marketing messages for one year.

Replying STOP

A customer can reply STOP to stop receiving marketing messages, and START to receive them again. Marketing is never sent to a customer who replied STOP. Reminders about invoices they have not paid are held, and only sent if the business chooses to send them after reading WhatsApp's opt-out warning. Only a scrambled code of the number is kept for this, not the number itself. A scrambled code is also kept for 7 days so a customer gets at most one automatic answer a day.

Your rights

Under Singapore's Personal Data Protection Act, you can ask what personal data we hold about you, how it has been used, and to correct it. If you received a reminder, you can ask the business that sent it, or contact us directly. To have data deleted, see Deleting your data.

Contact

For any question about this policy or your data, email privacy@semperubiquetech.com.

Changes

If this policy changes, the date at the top changes too.