Pilot draft, October 2026. To be reviewed by counsel before general availability.
DirectDue provides software that New Zealand businesses and property managers use to collect payments by bank transfer. For the people who pay them (customers and tenants) we act on behalf of that business or agency, which decides why their information is collected. Payments themselves are made through Volley, a regulated open banking payment provider, and your own bank.
Name, email, mobile and address from the invoices and tenancies our customers create or sync from Fergus; amounts due and paid; payment outcomes from Volley; the name of the bank a payment came from and the last digits of the account; and, where someone approves recurring payments, the limits they approved and whether the approval is active. We never receive bank logins, card numbers or full bank account numbers. The token that lets an approved payment be taken is stored encrypted and deleted when the approval ends.
Names, work emails, mobiles, sign-in and device records, second-factor settings, notification preferences and an audit log of actions taken.
To send pay links, receipts, reminders and approval invites; to take payments that a payer has approved, on the dates and within the limits they approved; to apply payments to invoices and rent; to keep the evidence record a property manager needs under the Residential Tenancies Act; to alert staff to problems; and to answer questions through Copilot.
Volley and the payer’s bank (to make payments); Twilio (to send text messages) and our email provider (to send email); Fergus and Xero, when the business connects them; our hosting providers Vercel and Supabase; Sentry, for error reports; and Anthropic, only when the business switches on the live Copilot and someone asks it a question. We do not sell personal information or use it for advertising.
Some of these providers store or process information outside New Zealand. We use providers whose privacy protections are comparable to the Privacy Act 2020, as information privacy principle 12 requires.
Payers receive messages about their own invoices, rent and approvals. Reply STOP to any text to stop texts from us; receipts and legally required notices may still be sent by email. A business can also mark a person as do-not-contact.
A payer approves recurring payments in their own bank app and can cancel at any time in that app or by asking the business. Before each invoice payment under a standing approval we send a notice at least three days ahead.
Payer contact details are cleared 12 months after the last invoice is closed or the tenancy ends. Message content is redacted after 12 months. Payment, evidence and audit records are kept for seven years for tax and dispute purposes.
Data is encrypted in transit; payment tokens and integration credentials are encrypted at rest. Staff accounts that can move money need a second factor. Access is limited to the organisation the information belongs to.
Under the Privacy Act 2020 you can ask to see or correct personal information about you. Payers can ask the business they pay, or email privacy@directdue.com and we will pass the request on or answer it. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).