Privacy Policy

This policy explains how ILIOS Trading (PTY) Ltd, the responsible party for the Towify platform, including Towify Collections and the Towify Pulse owner app, handles personal information under the Protection of Personal Information Act (POPIA).

1. What we collect

• Account information — names, email addresses and roles of the people in your organisation, and your organisation’s billing details.
• Operational data you enter — jobs, customer records, vehicle details, invoices, and vehicle-storage records. This includes personal information about your own customers, which you enter as the operator.
• Connected services — when you connect accounting software or a collections mailbox, we store the connection details and access credentials needed to provide that service. Collections may also store correspondence and attachments used for invoice follow-ups.
• Field capture — photos, signatures and job locations recorded by drivers in the course of a job. Photos are compressed on the device before upload, and this processing strips embedded camera metadata (including GPS coordinates) from the image file.
• Driver location while on duty — the Towify Driver app shares the truck’s position with the driver’s own towing company only while the driver is online (on a job or available for dispatch), including when the app is closed or not in use, so dispatch can send the nearest truck. A notification is visible the whole time background tracking runs, and going offline in the app stops it immediately. No location is collected while the driver is offline or signed out. The location trail is deleted after 90 days. Maps are provided by Mapbox, which receives location and device information when maps are shown.
• Crash reports — the mobile apps send crash and performance reports (device type, app version and your account ID) to our error-monitoring provider so we can fix problems.

2. What we use it for

Only to provide the platform: running dispatch and job workflows, generating invoices and statements, sending operational notifications and billing correspondence, and keeping the service secure. We do not sell personal information or use it for third-party advertising.

2a. Google accounts and collections email

Connecting Google is optional. An authorised organisation member signs in with Google and consents to the permissions shown by Google. Towify uses the account identity and email address to identify the connected mailbox, and access tokens to keep the connection working. We do not receive your Google password.

• Read access: Gmail read-only permission allows us to retrieve email content and metadata, including senders, recipients, subjects, message text, dates and conversation identifiers. Imported messages are stored in your organisation’s Collections inbox so authorised members can review them and link them to invoices. This permission covers the connected mailbox, not only messages already matched to an invoice. Use a dedicated collections mailbox to avoid importing unrelated correspondence.
• Sending: where sending is enabled, we request separate Gmail sending permission to send collection reminders and replies on your behalf, including invoice PDFs. Connecting read-only access does not enable sending. Your organisation controls review mode, automatic sending and follow-up settings.
• Purpose: we use this data to display correspondence, match it to collection cases, interpret responses, prepare replies and manage follow-ups. A customer email does not itself mark an invoice as paid.

When an authorised user requests AI analysis or the organisation enables AI agent processing, we send the email text, relevant earlier messages in the conversation and related invoice context to OpenAI through its API. This may include names, email addresses, invoice and claim references, balances and payment statements. The purpose is to classify the reply and prepare an appropriate response. Analysis and drafts are saved in Towify for the organisation’s workflow and review.

Towify does not use Google mailbox data to train general-purpose AI models. OpenAI states that API data is not used for model training by default. Our Collections requests disable response storage; this is not a promise of zero retention, as OpenAI may retain data for abuse monitoring under its API data controls.

Google data is processed by our hosting and database providers, Vercel and Supabase, and by OpenAI when AI processing is used. Outgoing email is shared with your email provider and the addressed recipients. We do not sell Google user data, use it for advertising, or use it to determine creditworthiness. Access within Towify is limited by organisation permissions. Our staff may access message content only with your affirmative agreement for specific content, where necessary for security investigations, or where required by law.

Towify’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data and developer policy.

3. Payments

Card payments are processed by Paystack. Your card number is entered on Paystack’s secure page and never touches our servers; we store only a payment token, the card brand and its last four digits, so we can charge your subscription and show you which card is on file.

4. Where data lives and who processes it

Towify uses Vercel for application hosting and Supabase for database and file storage. We also use processors for email delivery, AI processing, payments and error monitoring. These services may process personal information outside South Africa, including in the European Union and United States; connecting a mailbox or using AI does not mean all processing stays in a single region. Cross-border processing is subject to applicable data-protection obligations and the providers’ contractual safeguards.

5. Security and encryption

We use several layers of protection for information handled by Towify:

• Secure connections — our hosted website and application use HTTPS with TLS to encrypt information travelling between your browser and the service. IMAP and SMTP mailbox connections require TLS or STARTTLS, with server-certificate checks, to protect the connection to your email provider.
• Encrypted storage — our hosting and database providers, Vercel and Supabase, report AES-256 encryption for customer data stored on their infrastructure. This protects stored data at the infrastructure level, including our hosted database and file storage. See the published security information from Vercel and Supabase.
• Additional protection for connection credentials — Towify encrypts saved accounting credentials, mailbox access tokens and IMAP/SMTP connection settings, including passwords, using AES-256-GCM before storing them in the database. Encryption keys are kept in server configuration separately from the encrypted database values.
• Controlled access — organisation permissions and server-side access checks restrict who can view information and manage connections. Saved connection passwords and access tokens are not returned to the settings screen.

Our authorised systems decrypt information when needed to provide the service, for example to synchronise invoices or read and send collections email. Towify is therefore not an end-to-end encrypted service. Ordinary records and connection metadata, such as the mailbox email address, do not each receive the additional credential encryption described above. Email delivery beyond the connection to your provider depends on the email services involved.

6. Retention, disconnecting and deletion

Operational records are kept for as long as your organisation uses the platform — they are your business records, and towing and tax rules require some of them (such as invoices) to be kept for years. Nothing is deleted because of non-payment. If you close your account, you may request export or deletion of your organisation’s data, subject to what we must lawfully retain.

Imported email, AI analysis, drafts and collection history remain stored with your organisation’s records until deleted through a data-deletion request, subject to lawful retention requirements. Disconnecting a mailbox is not a deletion request and does not automatically erase correspondence already imported.

To stop mailbox access, use Settings › Integrations › Collections mailbox › Disconnect. This removes the saved access credentials and pauses affected active collection cases. You can also revoke Towify’s permission in your Google Account connections. Revoking access in Google does not delete copies already held by Towify.

To request deletion of imported Google email and derived analysis, or export or deletion of your organisation’s data, email info@towify.co.za. Include your organisation and connected email address; do not send passwords or access tokens. We verify your authority before acting and explain any records we must retain. Copies in infrastructure backups expire under the providers’ backup retention schedules.

7. Your rights

You may request access to, correction of, or deletion of personal information we hold about you by writing to info@towify.co.za. If you believe we have processed personal information unlawfully, you may lodge a complaint with the Information Regulator of South Africa.

8. Cookies

The application uses cookies only to keep you signed in and remember your active organisation. This marketing site sets no tracking cookies.

9. Contact

ILIOS Trading (PTY) Ltd · info@towify.co.za