Privacy Policy

ProStackNG Technologies ("we", "us", "our") operates ProStackNG CRM, a cloud-based ERP/CRM platform for African SMEs. We are the data controller for personal information collected through our platform.

Contact: privacy@prostackng.com.ng · Port Harcourt, Rivers State, Nigeria

Account Information: When you sign up, we collect your name, business name, email address, phone number, and password (stored as a bcrypt hash, never in plain text).

Business Data: Customer records, invoices, financial transactions, inventory data, and other business information you enter into the platform. This data belongs to you.

Usage Data: Log data including IP addresses, browser type, pages visited, API calls, timestamps, and session information. Used to improve the service and detect security threats.

Payment Information: We do not store your card details. Payments are processed by Paystack, who maintain their own privacy policy. We store only transaction references and subscription status.

Cookies: We use essential session cookies (httpOnly, Secure, SameSite=Strict) for authentication. We do not use advertising or tracking cookies.

• Service Delivery: To operate, maintain, and improve ProStackNG CRM
• Authentication: To verify your identity and secure your account
• Billing: To process payments and send invoices
• Communications: To send service notifications, security alerts, and product updates (you can unsubscribe from marketing emails)
• Security: To detect fraud, abuse, and unauthorized access
• Legal Compliance: To comply with Nigerian and other applicable local laws and regulatory requirements

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We share your data only with trusted service providers necessary to operate the platform:

• Paystack: Payment processing (subject to Paystack's Privacy Policy)
• Resend: Transactional email delivery
• Supabase: Database hosting and file storage (servers in secure data centers)
• Sentry: Error monitoring (anonymized crash reports)

All third-party providers are contractually bound to handle data securely and only for the purpose of providing services to us.

We may disclose your information if required by Nigerian or other applicable law, court order, or government authority.

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• bcrypt password hashing (cost factor 12)
• Multi-tenant isolation, your data is never accessible to other tenants
• Role-based access control (RBAC) within your organization
• Comprehensive audit logging of all data access and changes
• Regular security assessments and penetration testing

Despite our best efforts, no security system is perfect. In the event of a data breach, we will notify affected customers within 72 hours as required by applicable law.

Active Accounts: We retain your data for the duration of your subscription plus 90 days after termination.

Suspended Accounts: Data is retained for 30 days in read-only state, then permanently deleted.

Audit Logs: Security and activity logs are retained for 1 year for compliance purposes.

Backups: Database backups are retained for 30 days and then securely destroyed.

Under the Nigerian Data Protection Regulation (NDPR), GDPR principles, and comparable data protection laws in other African markets we serve, including Ghana's Data Protection Act and Kenya's Data Protection Act, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Data Portability: Export your data in standard machine-readable formats
• Restriction: Request that we restrict processing of your data
• Object: Object to processing for marketing purposes
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, email privacy@prostackng.com.ng. We will respond within 30 days.

We use only essential cookies necessary for the service to function:

• refresh_token: Secure authentication cookie (httpOnly, SameSite=Strict, 7-30 days)
• No advertising cookies, we do not run ads on our platform
• No third-party tracking pixels

ProStackNG CRM is a business software platform intended for adults (18+). We do not knowingly collect personal information from children under 18. If we discover we have collected data from a child, we will delete it immediately.

Your data is primarily stored in servers within or accessible to Nigeria. Where data is transferred internationally (e.g., to cloud providers), we ensure appropriate safeguards are in place.

We may update this Privacy Policy periodically. We will notify you of material changes via email at least 30 days before they take effect. The updated policy will always be available at prostackng.com.ng/privacy-policy.