Data protection

Your shop is in control

Each client has their own install and their own database. No other shop shares it. As the shop owner you decide what customer and staff data is collected, and you are responsible for it under the Data Protection Act, 2012 (Act 843). When we support your system, we handle that data only as needed to do so, and on your instructions.

Depending on what you do with personal data, your business may need to register with the Data Protection Commission. We can point you in the right direction.

Collect only what is needed

The system is built to keep customer details small: a name and a phone number are enough to sell on credit. Nothing else is required to sell. Staff accounts hold a name, a role and a login.

How the system protects data

• Passwords and PINs are stored hashed, never in plain text.
• Sign-in attempts are rate-limited, and wrong PINs lock the account for a period.
• The system is served over HTTPS only.
• Permissions are checked on the server, not only hidden in the screens.
• Sensitive actions (voids, refunds, price and stock changes, user and settings changes) are written to an audit log.
• Payment gateway keys are stored encrypted and kept in your own environment, never in source code.
• File uploads are validated.

Payments and card data

Mobile money payment links are handled by your payment gateway (Paystack). The system confirms a payment only from a verified gateway callback. It does not store card numbers or mobile money PINs.

Offline devices

To work without internet, tills keep a copy of products, prices and staff on the device. Use screen locks on your tablets and laptops, sign out when staff leave the till, and tell us straight away if a device is lost so we can disable it.

Backups

Your database is backed up on a schedule to storage you control, with the backup copies protected. We test a restore with you before you go live. Backups are kept for the period you agree, then removed.

When we help you

We only look at your system when you ask for help. Support tools can export diagnostics (logs, versions and sync state) to help find a fault. This does not include your customer lists or sales, and you can see what is exported before you send it.

If something goes wrong

If we learn of a security incident that affects your data, we will tell you without undue delay with what happened and what to do next, so that you can meet your own duty to notify those affected and the Data Protection Commission where required.

Rights of your customers

People whose data you hold may ask to see it, correct it or have it removed. The system lets you find and update customer records, and customers with sales history are deactivated rather than deleted so that your accounts stay accurate. We will help you handle any request.

Contact

For data protection questions, contact +233 24 020 9723 or dhayford92@gmail.com. See also the privacy policy for this website.