Legal
Privacy policy
What AfriBMS collects about you and your company, why, who processes it on our behalf, how long we keep it and the rights you have over it.
Draft for review — effective date to be set.
This policy explains what Africa One Group (we, us) collects when you use AfriBMS or visit afribms.com, what we do with it and what you can ask of us. It is written to be read, so it is short. If anything in it is unclear, ask us.
1. What we collect
Account details. When you sign up we ask for your name, email address and a password. If you give a phone number, we keep that too. Passwords are stored as one-way hashes; we cannot read them.
Company details. The company name, its country, currency, tax number (TIN or TPIN), address, logo and payment details, as you enter them in company settings.
The records you enter. Customers, invoices, quotes, payments, products, expenses, employees and any documents you attach. This is your company's data. Some of it is personal data about your customers and staff, and you are responsible for having the right to hold it; we process it only on your instructions, to provide the service.
Billing details. Which plan you are on, when it renews and a record of each payment. Card and mobile money details are entered on Flutterwave's pages, not ours, and we never see the full card number or wallet PIN.
Technical logs. When you use the app or the website our servers record the IP address, browser type, the pages requested and any errors, so that we can keep the service running and secure. We do not use analytics or advertising trackers.
Messages. What you send us through the contact form, by email or on WhatsApp, so that we can reply and remember what was said.
2. Why we use it
We use this data to run your workspace and send the invoices and other documents you ask us to send; to bill you and send receipts; to answer your messages; to keep the service secure and find faults; and to tell you about changes to the service or your subscription. We do not sell data and we do not use your records to advertise to you or anyone else.
We send email only when there is a reason: an invoice you sent, a receipt, a password reset, a security warning or a notice about the service. There is no newsletter unless you ask for one.
3. Who processes it for us
A small number of companies handle data on our behalf, each for one purpose:
- Amazon Web Services (Simple Email Service) sends the emails the app generates, such as the invoices you send and your password resets.
- Flutterwave processes subscription payments and holds the payment details you enter on its pages, under its own privacy policy.
- A European hosting provider runs the servers and backups the service lives on.
Each processes data only on our instructions. Your data is stored outside Uganda and Zambia, on servers in Europe, and a copy passes through the email and payment providers above when they act for us. We do not share data with anyone else unless the law requires it.
4. Cookies
The app sets two cookies: one that keeps you logged in, for up to two weeks, and one that protects forms against forgery. Neither tracks you, and there are no analytics or advertising cookies. The website afribms.com sets no cookies of its own and uses no third-party tracking. Your browser may store a preference such as the currency you chose on the pricing page; that never leaves your device.
5. How long we intend to keep it
This is the retention policy we are putting in place; the periods below are our intended limits. Your account and company data stay for as long as your workspace exists. When a workspace is closed we intend to keep everything for 30 days so that you can export it or return, then delete it, including from backups, within a further 30 days. We intend to keep billing records for as long as tax law requires, technical logs for 90 days, and messages you send us for two years so that a later conversation has its history.
6. How we protect it
Connections to the app and the website are encrypted. Data is stored in an access-controlled database, backed up daily, and each company's data is separated from every other's by the application itself. Only the people who need access to run the service have it, and their access is logged. If we learn of a breach that affects your data we will tell you without undue delay and say what happened and what we are doing about it.
7. Your rights
You can ask us at any time to show you the personal data we hold about you, to correct it, to delete it, or to give you a copy of your company's records in a common format. Most of this you can do yourself in the app; for anything else, write to us and we will act within 14 days. Deleting an account owner's data means closing the workspace, so we will confirm before doing it.
If you believe we have handled your data badly you may complain to the data protection authority in your country. In Uganda that is the Personal Data Protection Office; in Zambia it is the Data Protection Commissioner.
8. Children
AfriBMS is a business service for adults. We do not knowingly collect data from anyone under 18, and if we learn that we have, we delete it.
9. Changes to this policy
When this policy changes we update the version at afribms.com/privacy and, for any change that matters to you, tell you by email at least 30 days before it takes effect.
10. Contact
Questions about this policy and requests about your data go to the contact details on the About page. They are read by the people who run the service.