Privacy Policy

1. Information We Collect

Account & Registration Data

When you create a BranchOS account or join as a staff member, we collect:

• Full name, email address, and phone number
• Business name, branch address, and business type
• Role within your organisation (Owner, Manager, CSR)
• Password (stored as a one-way cryptographic hash — we cannot see it)

Business Operations Data

As you use BranchOS to run your business, we collect and store:

• Sales transactions: product, quantity, price, payment method, timestamp, and the staff member who logged the sale
• Inventory records: stock levels, product movements, transfers between branches
• Staff attendance records: clock-in and clock-out timestamps
• Payment records: cash, bank transfer, and POS reconciliation data
• Audit logs: every action taken in the platform, linked to a user and timestamp

Technical Data

When you access BranchOS, we automatically collect standard technical information including:

• IP address, browser type, and operating system
• Pages visited and features used within the platform
• Session duration and device identifiers
• Error logs to help us identify and fix bugs

Communications

If you contact us by email, WhatsApp, or our in-app chat, we retain those communications to provide support and improve our service.

2. How We Use Information

We use the information we collect strictly to:

• Provide the service: Power your dashboards, reports, stock alerts, and daily close features
• Maintain security: Authenticate users, detect suspicious activity, and prevent unauthorised access
• Communicate with you: Send account notifications, security alerts, product updates, and support responses
• Improve BranchOS: Analyse aggregate, anonymised usage patterns to prioritise features and fix bugs
• Comply with legal obligations: Respond to lawful requests from regulatory authorities in Nigeria

We do not use your business data for advertising, do not sell it to any third party, and do not use it to build profiles for any purpose outside of running your BranchOS account.

3. Data Storage & Security

Your data is stored on cloud infrastructure with servers located in data centres that meet industry-standard security requirements. We implement the following technical safeguards:

• All data in transit is encrypted via TLS 1.2 or higher (HTTPS)
• All data at rest is encrypted using AES-256
• Passwords are hashed using bcrypt — never stored in plain text
• Access to production data is restricted to authorised BranchOS engineers only, with full audit logging of any administrative access
• Regular automated backups with point-in-time recovery capability
• Vulnerability assessments conducted on a quarterly basis

Despite our best efforts, no method of electronic storage is 100% secure. If a security incident occurs that affects your data, we will notify affected account holders within 72 hours of becoming aware of the breach.

4. Third-Party Services

BranchOS uses a limited number of trusted third-party service providers to operate the platform:

• Render / Railway: Cloud hosting and infrastructure
• Paystack: Payment processing for subscription fees (we do not store card numbers; Paystack handles all payment data under their own PCI-compliant systems)
• SendGrid / Mailgun: Transactional email delivery (password resets, invitations, reports)
• Sentry: Error monitoring and crash reporting (anonymised technical data only)

We do not share your business data with any of these providers beyond what is technically necessary to deliver their specific function. All providers are contractually bound to protect your data and are prohibited from using it for their own purposes.

5. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription:

• Your account moves to a read-only state immediately
• You have 90 days to export all your data in CSV or PDF format
• After 90 days, your data is permanently and securely deleted from our servers
• Anonymised, aggregate analytics data may be retained indefinitely

Certain data may be retained longer where required by Nigerian law or for the resolution of active legal disputes.

6. Your Rights

As the owner of your BranchOS account, you have the following rights with respect to your data:

• Access: Request a full copy of all data we hold about you and your organisation
• Correction: Request that inaccurate personal information be updated or corrected
• Deletion: Request permanent deletion of your account and all associated data
• Portability: Export your business data (sales, inventory, staff records) at any time from within the platform
• Objection: Object to any processing of your data that goes beyond what is strictly necessary to provide the service

To exercise any of these rights, email us at privacy@thebranchos.com. We will respond within 14 business days.

7. Cookies

BranchOS uses cookies and similar technologies to operate the platform. We use:

• Session cookies: Essential for keeping you logged in. These expire when you close your browser.
• CSRF tokens: Security cookies that protect against cross-site request forgery attacks
• Preference cookies: Remember your dashboard settings and display preferences

We do not use advertising cookies, third-party tracking pixels, or cross-site tracking technologies. You can disable cookies in your browser settings, but some features of BranchOS will not function without session cookies.

8. Changes to This Policy

We may update this Privacy Policy from time to time as our platform evolves or as legal requirements change. When we make material changes, we will:

• Send an in-app notification to all account owners
• Email the account owner at their registered email address
• Update the "Last updated" date at the top of this page

Your continued use of BranchOS after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you may close your account before the effective date.

9. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your data rights, please reach out: