Privacy policy

Effective 1 October 2026.

This policy explains what Africa One Group (we, us) collects when you use AfriBMS or visit afribms.com, what we do with it and what you can ask of us. It is written to be read, so it is short. If anything in it is unclear, ask us.

1. What we collect

Account details. When you sign up we ask for your name, email address and a password. If you give a phone number, we keep that too. Passwords are stored as one-way hashes; we cannot read them.

Company details. The company name, its country, currency, tax number (TIN or TPIN), address, logo and payment details, as you enter them in company settings.

The records you enter. Customers, invoices, quotes, payments, products, expenses, employees and any documents you attach. This is your company's data. Some of it is personal data about your customers and staff, and you are responsible for having the right to hold it; we process it only on your instructions, to provide the service.

Staff records. When your company uses the staff tools, we hold what its members record there: clock-in and clock-out times, work logs, findings, announcements and who has read them, leave requests and the other records your company switches on. A member's company decides what is kept and who in the company can see it.

Location, in the phone app. The AfriBMS app for iPhone and Android reads the phone's location only at the moment a member taps Clock in or Clock out, to check that they are at one of the company's work sites, and when they check in at a client visit. That one reading, the position and how accurate it is, is saved with the attendance record or the visit, and the company's administrators can see it. When a member asks how far they are from work, the app reads the location while that screen is open and neither stores nor sends it. The app never tracks location in the background.

Photos. A photo or screenshot leaves the phone only when a member attaches it to a finding, a request, a client visit or an expense receipt.

Notifications. If a member allows notifications, the app registers a push token for the phone so that we can send reminders and the company's notices. The token is deleted when that phone's sign-in is removed or when Apple or Google tell us the phone no longer accepts notifications.

On the phone itself. The app keeps a member signed in with a token held in the phone's secure storage, and keeps work logs and findings made without a connection on the phone until they can be sent. Unlocking with Face ID, Touch ID or a fingerprint is handled by the phone: the app is told only whether it worked and never receives biometric data.

Billing details. Which plan you are on, when it renews and a record of each payment. Card and mobile money details are entered on Flutterwave's pages, not ours, and we never see the full card number or wallet PIN.

Technical logs. When you use the app or the website our servers record the IP address, browser type, the pages requested and any errors, so that we can keep the service running and secure. We do not use analytics or advertising trackers.

Messages. What you send us through the contact form, by email or on WhatsApp, so that we can reply and remember what was said.

2. Why we use it

We use this data to run your workspace and send the invoices and other documents you ask us to send; to bill you and send receipts; to answer your messages; to keep the service secure and find faults; and to tell you about changes to the service or your subscription. We do not sell data and we do not use your records to advertise to you or anyone else.

We send email only when there is a reason: an invoice you sent, a receipt, a password reset, a security warning or a notice about the service. There is no newsletter unless you ask for one.

3. Who processes it for us

A small number of companies handle data on our behalf, each for one purpose:

• Amazon Web Services (Simple Email Service) sends the emails the app generates, such as the invoices you send and your password resets.
• Flutterwave processes subscription payments and holds the payment details you enter on its pages, under its own privacy policy.
• A European hosting provider runs the servers and backups the service lives on.
• Expo (650 Industries) delivers the phone app's notifications and its updates. A notification passes from Expo through Apple Push Notification service or Google's Firebase Cloud Messaging to the phone.

Each processes data only on our instructions. Your data is stored outside Uganda and Zambia, on servers in Europe, and a copy passes through the email, payment and notification providers above when they act for us. The phone app is downloaded from Apple's App Store or Google Play, which handle that download under their own privacy policies. We do not share data with anyone else unless the law requires it.

4. Cookies

The app sets two cookies: one that keeps you logged in, for up to two weeks, and one that protects forms against forgery. Neither tracks you, and there are no advertising cookies anywhere.

The website afribms.com sets no cookies unless you agree. If we are measuring which pages people read, you will be asked first: nothing is loaded and nothing is set before you answer, and answering no leaves the site working exactly as it did. We remember your answer for six months in a cookie that holds only that answer, and you can change it at any time from "Cookie choices" at the foot of any page. At the time of writing no measurement is switched on; when it is, this page will name the tool and say what it records before you are asked.

Your browser also stores one preference of its own: the currency you chose on the pricing page. It is not a cookie and it never leaves your device. The phone app uses no cookies, analytics or advertising trackers.

5. How long we intend to keep it

This is the retention policy we are putting in place; the periods below are our intended limits. Your account and company data stay for as long as your workspace exists. When a workspace is closed we intend to keep everything for 30 days so that you can export it or return, then delete it, including from backups, within a further 30 days. We intend to keep billing records for as long as tax law requires, technical logs for 90 days, and messages you send us for two years so that a later conversation has its history.

6. How we protect it

Connections to the app and the website are encrypted. Data is stored in an access-controlled database, backed up daily, and each company's data is separated from every other's by the application itself. Only the people who need access to run the service have it, and their access is logged. If we learn of a breach that affects your data we will tell you without undue delay and say what happened and what we are doing about it.

7. Your rights

You can ask us at any time to show you the personal data we hold about you, to correct it, to delete it, or to give you a copy of your company's records in a common format. Most of this you can do yourself in the app; for anything else, write to us and we will act within 14 days. Deleting an account owner's data means closing the workspace, so we will confirm before doing it.

If you use AfriBMS as a member of a company's staff, that company decides what is recorded about your work and who in it can see it. Ask your company first; if you write to us, we will pass your request to your company and help it answer you.

You can stop the phone app reading your location, using the camera or sending you notifications at any time in your phone's settings. Without location the app cannot clock you in, because the check at a work site is how it records your attendance.

If you believe we have handled your data badly you may complain to the data protection authority in your country. In Uganda that is the Personal Data Protection Office; in Zambia it is the Data Protection Commissioner.

8. Children

AfriBMS is a business service for adults. We do not knowingly collect data from anyone under 18, and if we learn that we have, we delete it.

9. Changes to this policy

When this policy changes we update the version at afribms.com/privacy and, for any change that matters to you, tell you by email at least 30 days before it takes effect.

10. Contact

Questions about this policy and requests about your data go to the contact details on the About page. They are read by the people who run the service.