Privacy Policy
Last updated: 11 August 2026
This policy explains what information MUPAY collects, how it's used, and how it's protected when you use the app to manage your invoices, quotations, contracts, expenses, and clients.
1. Who this applies to
MUPAY is a business management tool built for freelancers and small businesses in Mauritius. This policy covers anyone who creates a MUPAY account ("you") and, where relevant, the information you store about your own clients and customers within the app.
2. Information we collect
To provide the service, MUPAY stores:
- Account information — your email address and authentication details, handled via Firebase Authentication.
- Business records — invoices, quotations, contracts, payments, and expenses you create in the app.
- Client details — names and contact information for your own clients, which you enter yourself to generate documents.
- File attachments — receipts, documents, or other files you upload and attach to invoices or expenses.
We don't collect any of this information beyond what you actively enter into the app to use its features.
3. How your information is used
Your data is used solely to provide MUPAY's core functionality: generating invoices and quotations, tracking payments and expenses, and keeping your business records organised. It is not used for advertising, and it is not sold or shared with third parties for marketing purposes.
4. Where your data is stored
MUPAY is built on Google Firebase. Your account data, business records, and uploaded files are stored using Firebase Authentication, Cloud Firestore, and Firebase Storage — Google Cloud infrastructure. As a result, data may be stored and processed on servers located outside Mauritius, in Google's data centres. Google acts as our data processor for this purpose; we don't share your data with any other third party beyond what's needed to run these core services. This transfer is necessary to perform our contract with you as a MUPAY user — you can't use the app without your data being processed through Firebase — which is one of the lawful grounds for transferring personal data outside Mauritius under Part VI of the Data Protection Act 2017. Access is protected by Firebase security rules and App Check, which verifies that requests come from the genuine MUPAY app before any data is read or written.
Each account's data is private by default — your invoices, clients, and financial records are only accessible to you when signed in to your own account.
5. Security
Data is encrypted in transit (HTTPS/TLS) and at rest, in line with Google Cloud's standard infrastructure protections. Access to your account requires authentication, and all requests to our database and file storage are verified before being processed. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information appropriate to its sensitivity.
6. Cookies and local storage
MUPAY uses browser local storage and cookies set by Firebase Authentication to keep you signed in and to remember display preferences such as light/dark mode. We don't use cookies for advertising or third-party tracking.
7. Data retention
We retain your account and business data for as long as your account remains active. If you'd like your account and associated data deleted, contact us and we'll process the request.
8. Registration status
Under section 14 of the Data Protection Act 2017, anyone acting as a controller or processor of personal data in Mauritius is required to register with the Data Protection Commissioner. We are addressing this requirement as part of preparing MUPAY for commercial use. If you have questions about our registration status, contact us using the details below.
9. Your rights
You can access, update, or delete the records you've entered directly within the app at any time. You may also request a full export or deletion of your account data by contacting us directly. Under the Data Protection Act 2017, you have the right to be informed about how your data is processed (s.23), the right to access the personal data we hold about you, free of charge (s.37), the right to have inaccurate data corrected or erased (s.39), and the right to object to certain processing (s.40). You can lodge a complaint with the Data Protection Office (dataprotection.govmu.org) if you believe your data has been mishandled.
10. Data breach notification
In the unlikely event of a data breach affecting your personal information, we'll notify affected users and, where required, the Data Protection Office, without undue delay, in line with our obligations under sections 25 and 26 of the Data Protection Act 2017.
11. Governing law
This policy is governed by the laws of Mauritius, including the Data Protection Act 2017 (Act No. 20 of 2017), which is enforced by the Data Protection Office under the Ministry of Technology, Communication and Innovation. This policy is provided in good faith to describe our practices clearly. It has not been reviewed by a licensed advocate, and isn't a substitute for independent legal advice.
12. Changes to this policy
We may update this policy as MUPAY evolves. Material changes will be reflected here with an updated date at the top of the page.