Privacy notice

This notice is published under the Nigeria Data Protection Act 2023 (NDPA). It describes what AfriBizOS does with your data — and, deliberately, only what the software actually does. Where a feature is still being finished, we say so instead of describing the future tense as the present.

1. Who is responsible

AfriBizOS (Lagos, Nigeria) is the data controller of the workspace data described below. Our Data Protection Officer can be reached at dpo@afribizos.com.

2. What we collect

• Account data: name, work email, phone number (optional), hashed password, organization profile (name, TIN, CAC RC number, registered address) and team memberships. Session cookies carry an opaque token; only its SHA-256 hash is stored.
• Your books: journal entries, invoices, bills, receipts, payroll runs, and the documents you capture. The ledger is append-only with a hash-chained audit log.
• Bank transaction data: parsed alert fields (amount, date, counterparty, balance) — never the raw SMS text. We store a SHA-256 hash of the original message for deduplication and dispute-trail purposes only. If you link a bank account through Mono, consent and fetching happen read-only between you, Mono and your bank; we never see or store your bank login.
• Receipts: images you upload (or forward over WhatsApp) and the fields our OCR extracts from them.
• AI processing: when an AI agent drafts a proposal or narrative, the input is your own ledger figures. AI actors are structurally barred from writing to your ledger — every write needs a human approval, enforced in the ledger engine.

3. Why we process it (lawful bases)

• Contract: running the accounting service you signed up for.
• Legal obligation: statutory computations (PAYE, VAT, CIT, WHT, NSITF/ITF), e-invoicing under the NRS e-invoicing rules, and tax records you may be required to keep.
• Consent (NDPA §24-style, logged): bank-connection consents, WhatsApp capture, and marketing messages. Every consent is written to a consent log you can inspect, and can be revoked any time.
• Legitimate interest: security logging, fraud prevention and product analytics (event-level, not content-level).

4. What we do NOT do

• We do not sell your data or share it with advertisers.
• We do not move money — any payment instruction is yours, explicit and approved.
• We do not store raw bank SMS text — only the extracted fields and a hash.
• We do not let AI post to your ledger — the engine rejects agent actors on every write.

5. Your rights

Under the NDPA you can request access, correction, portability (open-format export is self-service in-app, anytime) and erasure. Erasure requests are handled on a 72-hour SLA — the request flow is live in Settings → Data & privacy. Write to dpo@afribizos.com or use the in-app flow.

6. Retention

Ledger data is retained while your workspace is open (bookkeeping records carry statutory retention periods of their own — at least six years for tax records). On workspace closure you get a full export first; then personal data is erased on the 72-hour flow, with statutory records retained only where the law requires them.

7. Security

Encryption in transit (TLS) is live. At-rest encryption is on our roadmap and labelled as such — we would rather tell you than let you assume. Access is by email + password (hashed), with multi-factor enrolment available; every write is captured in a hash-chained, write-once audit log, and accounting periods can be locked against edits.

8. Processors we use

Bank account linking runs through Mono (read-only consent). Payment links run through Paystack (in pilot — card billing is not live; paid plans are invoiced manually for now). AI inference runs on our configured model provider. Each processes data only to deliver its function, under contract with us.

9. Changes

If this notice changes materially we will tell you in-app before it takes effect — not silently edit the page.

10. Complaints

You can complain to us at dpo@afribizos.com, or to the Nigeria Data Protection Commission (NDPC).