Privacy policy

1. Who we are

Inventra is provided by [Company legal name] (RC [CAC registration number]), [Registered address], Kano, Nigeria. This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA).

• For the accounts of store owners and staff, we are the data controller: we decide how that data is used.
• For what a store records about its customers, the store is the controller and we are its data processor: we handle that data only to run Inventra for the store. A customer who wants to know what a store holds about them should ask the store first.

2. What we collect

• Account details: your name, phone number, email address if you give one, and your password, which we store only as a one-way hash.
• Store details: the store's name, phone, email, address, state and logo.
• What a store records: devices with their IMEI or serial numbers, products, stock, sales, payments taken, returns, and customers' names and phone numbers.
• Subscription payments: the amount, reference and outcome. Card and bank details go straight to Paystack or Monnify; we never receive them.
• Activity and security records: when you sign in, what you change in a store (the audit log), your IP address and browser details, and error reports that help us fix problems.

3. Why we use it

• To provide Inventra under our agreement with you: signing you in, confirming your phone by SMS code, keeping the store's records, printing receipts and running reports.
• To send the emails the service depends on: receipts for subscription payments, renewal reminders, and, if the owner turns it on, a weekly list of money owed.
• In our legitimate interest in keeping Inventra secure and reliable: detecting misuse, keeping an audit log a store can rely on, and fixing errors.
• To meet our legal obligations, such as keeping payment records.

We do not sell personal data, we do not use it for advertising, and we do not send marketing by SMS.

4. Who else handles it

We use trusted providers who process data only on our instructions and under contracts that protect it:

• our server and database hosting provider, [hosting provider and location];
• Cloudflare, for storing logos and database backups;
• Vercel, which serves the Inventra web app;
• Resend, which delivers our emails;
• our SMS provider, which delivers one-time sign-in codes;
• Paystack and Monnify, which take subscription payments;
• Sentry, which records errors so we can fix them.

We share data with authorities only when the law requires it. Some of these providers keep data outside Nigeria; where they do, we rely on the safeguards the NDPA requires for such transfers.

5. How long we keep it

• Account details: for as long as your account exists.
• A store's records and audit log: for as long as the store exists on Inventra, so its history stays complete. After a store closes, the owner may ask us to delete them.
• Database backups: 90 days. Server logs: 60 days.
• One-time SMS codes: a few minutes.
• Payment records: as long as tax and company law require.

6. How we protect it

Connections are encrypted, passwords are hashed, sign-in is protected against guessing, and every store's data is kept apart from every other store's. Within a store, staff see only what the owner allows. We back up every day and test that the backups restore.

7. Cookies and storage on your device

Inventra sets one cookie, which keeps you signed in; it cannot be read by scripts on the page. The app also remembers a few preferences in your browser, such as light or dark mode and your phone number's country. We do not use advertising or tracking cookies.

8. Your rights

Under the NDPA you may ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it, or delete it where we no longer need it;
• restrict or object to how we use it;
• send it to you or another provider in a common format.

You can correct your name, phone and email yourself on your account page. For anything else, write to [privacy email address]; we answer within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.

9. Children

Inventra is for businesses and is not meant for anyone under 18.

10. Changes and contact

We publish any change to this policy here with a new version number and tell owners by email when a change matters to them. Questions go to our data protection officer, [Data protection officer's name], at [privacy email address], or by post to [Registered address], Kano, Nigeria. The terms of service cover the rest of our agreement with you.