Privacy Notice

What personal data AfriSpine collects

• • Phone number — for authentication via one-time password (OTP).
• • Name and email — optional, for profile identification and receipts.
• • Business information — name, sector, location, contact details for business operations.
• • Transaction records — sales, expenses, stock purchases recorded by the merchant.
• • Device/session information — browser/OS summary and IP address for security and session tracking.
• • Customer enquiry data — name, phone, message submitted via Smart Pages.

Why data is collected

• • Authentication and account management
• • Business operations (recording sales, expenses, stock, appointments)
• • Security (session tracking, audit logs, multi-factor authentication)
• • Customer service (responding to Smart Page enquiries)

Data is NOT used for:

• • Model training or AI analysis
• • Marketing or advertising
• • Sale to third parties

Who can access your data

• • You (the account holder) — full access to your own data
• • Business owners — access to data within their business scope
• • Staff members — access limited by their assigned role (deny by default)
• • AfriSpine operators — for support and security investigation only

Data is never shared across businesses or organizations.

How long data is retained

• • Active business records: while the business is active
• • Financial records (Pesa Coach): 7 years (anonymized after account deletion)
• • Customer requests: 90 days from submission
• • Session/security data: 30 days
• • Audit logs: 7 years (actor IDs anonymized after account deletion)
• • OTP codes: 10 minutes (automatic deletion)

Backups and security

Database backups are encrypted at rest. Backup access is restricted to authorized operators. Session cookies use HttpOnly, SameSite=Lax, and Secure (in production) attributes. MFA secrets are encrypted with AES-256-GCM. Passwords are never stored (phone+OTP authentication).

Your rights

• • Access — export your data at Privacy & Data
• • Correction — edit your profile at the same page
• • Deletion — request account deletion with explicit confirmation
• • Objection — contact privacy@afrispine.app

Cookies

• • next-auth.session-token — authenticated session (HttpOnly, SameSite=Lax, Secure in production)
• • next-auth.csrf-token — CSRF protection
• • afri-locale — language preference

No tracking, advertising, or third-party analytics cookies are used.

Contact

For privacy questions or requests: privacy@afrispine.app