Privacy Policy

1. Information We Collect

We collect information you provide directly and information generated as you use the Service.

Account & Registration Data

• Business name, subdomain, and contact email
• Owner's full name and phone number
• Hashed password (we never store passwords in plain text)

Business Data You Enter

• Customer and supplier records
• Invoices, quotations, and payment records
• Inventory and product data
• Employee and payroll records
• POS transactions and loan records

This data belongs entirely to your business and is stored in your isolated tenant database.

Usage & Technical Data

• IP address, browser type, and operating system
• Pages visited and features used (for performance monitoring)
• Error logs and crash reports

Payment Data

Payment transactions are processed by Flutterwave. We do not store full card numbers or sensitive payment credentials — only transaction IDs and status records for reconciliation.

2. How We Use Information

We use collected information to:

• Provision, operate, and maintain your Workspace
• Process payments and manage subscriptions
• Send transactional emails (account activation, payment receipts, expiry notices)
• Respond to support requests
• Monitor and improve Service performance and security
• Comply with legal obligations including ZRA reporting where applicable

We do not sell your personal data to third parties. We do not use your business data for marketing purposes.

3. Data Sharing & Third Parties

We share data only in the following limited circumstances:

4. Tenant Data Isolation

BizQuick uses a multi-tenant architecture where each registered business is assigned a dedicated, isolated database. This means:

• Your data cannot be read by other tenants on the platform
• Application code enforces strict per-tenant context on every request
• Database credentials are unique per tenant
• Administrative staff can only access your data for support purposes and only when you explicitly grant permission

5. Data Storage & Security

Your data is stored on servers located in our hosting environment. We employ the following security measures:

• HTTPS / TLS encryption for all data in transit
• Encrypted passwords using bcrypt hashing
• Regular automated database backups
• Role-based access control within your Workspace
• Rate limiting and brute-force protection on all authentication endpoints

While we implement industry-standard security practices, no system is completely immune to breaches. We will notify affected users promptly in the event of a security incident involving their data.

6. Cookies & Tracking

We use cookies and similar technologies to operate the Service:

• Session cookies — to keep you authenticated during a session (deleted on logout)
• CSRF token cookies — to protect against cross-site request forgery
• Preference cookies — to remember your UI settings

We do not use third-party advertising or tracking cookies. You can configure your browser to refuse cookies, but some parts of the Service may not function correctly.

7. Data Retention

We retain your data for as long as your Workspace account is active. Upon account termination:

• You have 30 days to request a full data export
• After 30 days, your tenant database and all associated data will be permanently deleted
• Central account records (email, business name) may be retained for up to 90 days for legal and accounting purposes

8. Your Rights

Subject to applicable Zambian law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate personal data
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Portability — receive your business data in a machine-readable format
• Objection — object to processing of your data for certain purposes

To exercise any of these rights, contact us at support@bizquick.app. We will respond within 30 days.

9. Children's Privacy

The Service is intended for use by businesses and individuals aged 18 or older. We do not knowingly collect personal information from children under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new effective date and, where appropriate, by email. We encourage you to review this policy periodically.