Privacy policy

01

Scope

This policy covers the AfriFlow website, enquiry form, client and team workspaces, and sign-in through connected AfriFlow applications. It does not replace a separate data-processing agreement for a commissioned project. ARROW RED, CryptoGyd, Google and X have their own policies; following their links does not send them your enquiry.

02

Data we receive

An enquiry contains the name, contact method, service, approximate budget, project description and language you provide. You can review it before confirming submission.

Client workspaces process names, email addresses, project details, stages, comments, approvals and uploaded files. Account and secure-session information enables access. Do not send passwords, wallet private keys, payment secrets or another person’s personal data without a lawful basis.

03

Purposes and legal grounds

We use enquiries to reply, clarify requirements and prepare proposals, and project information to deliver agreed work and communicate. The grounds may include steps you request before entering a contract, contractual performance and, where necessary, specific consent.

Account security, prevention of abuse and proportionate measurement of site performance may rely on legitimate interests where applicable law permits, taking visitors’ rights into account. Where a particular activity requires consent, it must be obtained separately; this policy is not blanket consent. Legal obligations are met under the applicable law.

04

Visits and source statistics

Our own analytics may include pages visited, activity times and duration, referral source, campaign key, language, browser, operating system, device type, IP address and approximate country. We also count outbound clicks from AfriFlow to projects. This does not give us access to your activity on external websites.

Random cookie identifiers link visits. In combination with IP addresses, these records are pseudonymous rather than fully anonymous. We do not fingerprint browsers. Country lookup takes place on our server using a local DB-IP database; visitor IPs are not sent to a separate geolocation service. Recognised team browsers are excluded from customer reports.

05

Cookies and local preferences

First-party cookies support sign-in, session protection, short-lived QR sign-in, analytics and referral attribution. Language and certain interface preferences may be stored locally. The visitor cookie lasts 90 days, the visit cookie 30 minutes and the referral cookie 30 minutes. A team-browser marker lasts up to 365 days and is renewed on use.

Team sessions last up to 12 hours and client sessions up to 7 days; temporary sign-in checks have shorter lifetimes. A QR request lasts 3 minutes. Browser settings let you delete or block cookies and local storage, which may require signing in again and reset your language. You can raise questions and object to analytics through the contact form.

06

Downloads and team notifications

Download analytics record the APK version, complete bytes transferred, time, device type and a random browser identifier. A separate cookie lasting up to 24 hours groups resumed transfers. Button clicks are not downloads; the site cannot observe installation or saving to phone storage. Analytics are retained for up to 90 days.

Team notifications store events, recipients, read state, a device identifier and push token, notification permission and delivery states. When Firebase Cloud Messaging is connected, Google processes the push token and a brief work alert. Telegram receives a brief event and link without contact details or enquiry text. An app receipt is not proof that a person read it. Signing out on a device or revoking access stops notifications. External providers may process data in other countries under their own policies.

07

Google, QR and account security

When you choose Google sign-in, basic profile details, email and Google identifier are used to verify and link a previously authorised account. We do not receive your Google password or request access to Gmail, Drive or Google contacts for this purpose.

Passwords are stored as verification hashes and Authenticator secrets are encrypted. QR codes contain short-lived, single-use requests rather than passwords or permanent sessions. Workspace access is role-based and checked by the server. Sharing an active QR may allow access to your account: do not show it to others. The camera recognises QR codes locally; its video is not sent to AfriFlow for storage.

08

Access, recipients and external services

Authorised team members access enquiries and projects only as needed for their work. Technical providers, including hosting, may process necessary data to operate the site. We do not sell personal data or supply visitor lists to advertisers.

Google processes information when you choose Google sign-in; X does so when you open it or contact us there. Their policies apply to their processing. Data may be disclosed to meet a lawful requirement to the necessary extent. Where processing involves another country, applicable transfer grounds and safeguards must be respected; using a foreign service does not itself remove your rights.

09

Retention

Operational analytics use a rolling 90-day window and are removed through regular cleanup. Short-lived sign-in records expire and are cleaned up during maintenance.

Enquiries, accounts and project materials are retained while needed to respond, deliver and support work, resolve disputes or meet mandatory requirements, and are then deleted or de-identified. The appropriate period depends on the relationship and law. Backups are kept separately for recovery, are not used in routine operations and may be cleared later than the live system.

10

Your rights and requests

Subject to applicable law, you may request processing information, access and a copy, correction, deletion, restriction or portability, object to processing based on legitimate interests and withdraw consent for the future. Withdrawal does not invalidate earlier lawful processing or remove other lawful retention grounds.

Use the Contact page form and identify your request as a personal-data matter. We may request the minimum information needed to verify ownership, such as your original contact or project reference. Do not attach identity documents without a separately justified need. You may complain to the competent data-protection authority, including the Nigeria Data Protection Commission in Nigeria.

11

Further information

The site is intended for business communications and IT-service enquiries, rather than collecting children’s data. Contact us if a child’s data has been submitted without an appropriate basis. Analytics are not used to make solely automated decisions producing legal or similarly significant effects.

We apply organisational and technical safeguards but do not promise absolute security. Material policy updates are published with a new date and version; renewed consent is requested where required.