Privacy Policy & Data Transparency

1. Information We Collect

Depending on how you use TraderERP, we collect and process the following categories of information:

2. Why We Collect and Process Your Data

• To provide retail & POS operations: Generating sales receipts, adjusting stock quantities upon sale, calculating customer credit balances, and reporting estimated business gross profit.
• To safeguard your workspace: Verifying identity via secure session cookies, preventing unauthorized access, and validating multi-tenant boundaries between separate stores.
• To send essential operational communications: Delivering password reset links, security alerts, and system notices.
• With your explicit consent: Sending optional product tips, feature guides, or trade performance suggestions (you may opt out anytime without penalty).

3. How Your Data Is Stored and Protected

TraderERP is built on enterprise cloud infrastructure hosted on Supabase (PostgreSQL). We implement multi-layered defenses:

• Row Level Security (RLS): Every database table enforces PostgreSQL Row Level Security. Users from one business cannot view, mutate, or query records belonging to another business.
• Server-Side Authorization: Sensitive actions (such as product pricing adjustments, staff creation, and password updates) validate user roles on the server before mutating data.
• Secure Authentication: User credentials are protected using industry-standard hashing (bcrypt/Argon2) handled by Supabase Auth. Passwords are never stored in plain text.
• Encrypted Transmission: All browser-to-server communication is encrypted using modern TLS (HTTPS).

4. Who Can Access Your Business Records

Access is strictly governed by role-based permissions inside your organization:

• Business Owners & Admins: Have full oversight over their business workspace, including sales, expenses, staff members, reports, and store settings.
• Store Staff & Cashiers: Are restricted to operational duties: processing sales, looking up product availability, and recording customer credit payments. They cannot alter store ownership or delete other accounts.
• TraderERP Platform Administrators: Platform engineers have access strictly for technical support, infrastructure maintenance, system availability, and security triage.

5. Third-Party Service Providers

We rely on vetted technical infrastructure partners to deliver the platform:

• Supabase: For cloud database hosting, real-time replication, and authentication services.
• Mailhive / Transactional SMTP: For delivering system transactional emails (password reset links and security notices).

We do not sell, rent, or monetize your customer records, transaction histories, or personal data to third-party advertising exchanges.

6. Data Retention & Business Records

We retain personal account information as long as your account remains active. However, please note the distinction between personal data and shared business data:

7. Your Rights: Access, Export, and Deletion

As a user of TraderERP, you possess meaningful control over your personal data:

• Data Export: You can download a machine-readable JSON copy of your personal account profile, roles, and registered consents directly from Settings > Privacy & Data.
• Correction: You can update your display name, contact phone number, and password at any time in Settings.
• Account Deletion: You can submit an auditable account deletion request from Settings. Requests require password reauthentication to prevent unauthorized deletion.
• Consent Management: You can withdraw consent for optional marketing communications at any time without impacting your access to the ERP platform.

8. Legal Basis & Regulatory Note

TraderERP processes personal and commercial data in accordance with Nigerian data protection principles (including the Nigeria Data Protection Act - NDPA). Processing is justified based on contractual necessity to provide business software services, compliance with financial bookkeeping requirements, legitimate business security interests, and explicit consent for optional marketing.

Note: Specific statutory retention schedules or formal regulatory registration numbers will be updated upon final review with the product owner and legal adviser.