Privacy Policy

Kuza is a business management platform built for Nigerian businesses. It brings billing, inventory, sales records, customer records, staff records, online storefronts, bookings, tax and compliance tools, and related modules into one workspace.

In this policy, "Kuza", "we", "us" and "our" mean the Kuza platform, and "you" means the person or business using it. For the business records you keep inside your workspace, you are the data controller and we act as your data processor. For your account details and website usage, we act as the data controller.

We collect information in three ways: what you give us, what is generated as you use the platform, and what we receive from service providers.

• Account information: your name, email address, phone number, business name, business type, business address, and login credentials.
• Business records you create: products, inventory, sales and receipts, invoices, customers, suppliers, staff, bookings, deliveries, event or ticketing records, church and member records, education records, and any files you upload.
• Payment and subscription information: the plan you are on, invoices issued to you, payment status, and payment references. Card details are handled by our payment provider and are never stored on Kuza servers.
• Public page information: content you publish through storefronts, QR menus, booking pages, event pages, Link Hub pages, or other public pages you switch on.
• Usage information: pages viewed, features used, device and browser type, approximate location from your IP address, and error logs.
• Support information: messages you send us and any attachments you include.

We use the information described above to run the service and to keep it safe. Specifically, we use it to:

• Create and secure your account, and let you sign in.
• Provide the modules you enable, including generating receipts, invoices, reports and certificates.
• Process subscription payments and issue payment confirmations.
• Publish public pages that you choose to make public, such as a storefront or booking page.
• Send transactional messages such as verification codes, password resets, receipts, order notifications and service notices.
• Provide support and respond to your requests.
• Monitor performance, fix faults, and prevent fraud, abuse and unauthorised access.
• Meet our legal, tax and accounting obligations, including Nigerian tax and record-keeping requirements.
• Send product updates where you have agreed to receive them. You can opt out at any time.

We process personal data in line with the Nigeria Data Protection Act 2023 and the guidance of the Nigeria Data Protection Commission. Depending on the purpose, we rely on: your consent; the performance of our contract with you; our legal obligations; and our legitimate interests in operating and securing the platform, where those interests do not override your rights.

Where you use Kuza to keep records about your own customers, members, students, patients, tenants, staff or congregants, you are responsible for having a lawful basis for that processing. We process those records only on your instructions.

We do not sell your personal data. We share it only where necessary, and only with parties who are bound to protect it:

• Service providers who host, store and secure the platform, send email, and deliver the service.
• Payment providers who process subscription and online payments.
• Professional advisers such as auditors and lawyers, where required.
• Authorities or third parties where we are legally required to disclose, or where disclosure is needed to protect rights, safety or the integrity of the service.
• A buyer or successor, if the business or part of it is sold or reorganised, subject to this policy continuing to apply.
• Other users of your own workspace, such as staff you have invited or customers you have given a portal link.

Subscription payments and online payments made through Kuza are processed by our payment partners. When you pay, you provide your payment details directly to the payment provider, and we receive only a confirmation, a reference, and limited details such as the amount paid and the payer email address. We never see or store full card numbers or card security codes.

We keep account information for as long as your account is open. Business records are kept for as long as you keep them in your workspace, and are deleted or anonymised within a reasonable period after your account is closed, unless we are required to keep them longer for tax, accounting or legal reasons.

Some records, such as payment confirmations and accounting entries, may be retained for the period required by Nigerian law even after your account is closed.

We use encryption in transit, access controls, role-based permissions inside workspaces, and audit logging of sensitive actions. Access to production data is limited to people who need it to operate and support the service.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify affected users and the Nigeria Data Protection Commission as required by law.

Under the Nigeria Data Protection Act you have the right to:

• Be informed about how your personal data is used.
• Access the personal data we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information that we no longer need to keep.
• Object to, or ask us to restrict, certain processing.
• Ask for a copy of your data in a portable format.
• Withdraw consent where we relied on consent, without affecting processing that already happened.
• Lodge a complaint with the Nigeria Data Protection Commission.

We use cookies and browser storage to keep you signed in, remember your preferences, and understand how the platform is used. Our Cookie Policy explains what we use and how you can control it.

Kuza is a business tool and is not intended for children. Where a school or education provider uses Kuza to hold student records, the school is responsible for the lawful basis of that processing and for any consent required from parents or guardians.

Kuza runs on cloud infrastructure provided by Base44, which hosts our application, databases and uploaded files. That infrastructure is operated in data centres located outside Nigeria, so your account details and the business records you keep in your workspace are stored and processed cross-border.

Payment processing is handled by Paystack or its local equivalents. Card data is captured and tokenised by the payment provider and is never stored on Kuza servers.

We tell you this openly so you can make an informed decision about using Kuza. The same cross-border hosting applies to any customer, member, student or staff records you choose to keep in your workspace.

Under the Nigeria Data Protection Act, personal data may be transferred outside Nigeria where the destination provides an adequate level of protection, or where appropriate safeguards and enforceable data subject rights are in place. We rely on those safeguards, together with contractual obligations passed down to our hosting and payment partners.

Our hosting and infrastructure providers are bound to protect data to a standard at least as strict as this policy, to process it only on our instructions, and to notify us of any security incident affecting it. We review those arrangements as the platform grows.

If you need more detail for your own compliance file, our Data Processing Agreement describes the roles, safeguards, sub-processors and breach notification commitments in full.

For the business records you keep in Kuza, you are the data controller and we are the data processor. Our Data Processing Agreement (DPA) sets that relationship out formally: it confirms that your business owns its data, describes the infrastructure providers we rely on, covers cross-border storage, and sets out how we notify you of a breach and return or delete data when your account closes.

The DPA forms part of our Terms of Service. You accept it when you register and complete onboarding, and you can read it at any time on this website.

We may update this policy as the platform grows or the law changes. When we make a material change we will notify you in the app or by email, and we will always show the date of the latest version at the top of this page.