Privacy Policy

1. Who We Are and Our Data Roles

This policy explains how Khanta ("Khanta," "we," "us," or "our") handles personal data through the Khanta app, website, and related services (the "Service") under applicable law, including the Nigeria Data Protection Act 2023 ("NDPA"). The registered legal entity that operates Khanta must be confirmed in the company records; "Khanta" is the product name used here.

Khanta acts as a data controller for account, security, support, and service-administration data it uses for its own purposes. For customer-credit records an Owner enters about that Owner's customers, the Owner generally decides why and how the records are used and acts as controller; Khanta processes those records to provide the Service on the Owner's instructions. The roles for staff, location, messaging, and other features depend on the actual activity and are described in the applicable customer arrangements. An Owner must give staff and customers any notices they are responsible for.

2. People and Personal Data We Handle

• Owners and staff: phone number, shop or business name, preferred language, staff names, account and role details.
• Authentication and security: one-way hashes of one-time codes and staff PINs, a public-key credential if you enable passkey or device sign-in, IP address, browser or device type, and security, diagnostic, and service logs. Khanta does not receive your face scan, fingerprint, or device screen-lock secret.
• Business records: product names, prices, stock, sales, purchases, optional product photos, and related business records.
• Gbese credit records: a credit customer's name and phone number and the amounts an Owner records as owed or repaid.
• Messages and notifications: message content and delivery status for one-time codes, receipts, alerts, and reminders sent through the Service; notification settings and delivery status.
• Location: a shop address and map coordinates if supplied; approximate location recorded when a staff member opens or closes a tracked shift; and, only when the Owner enables live team tracking and the individual staff member separately consents, approximate GPS pings during that staff member's open shift. Live tracking stops when the shift ends or consent is withdrawn. A shop may separately choose whether its address appears on the public store locator.
• Website enquiries: name, email address, enquiry category, and message submitted through the contact form.
• Website and app diagnostics: technical events, performance measurements, error and diagnostic information, and related device or network details from Vercel Analytics/Speed Insights and Sentry when configured.

We do not ask for government ID numbers, payment-card details, or health information to provide the Service. Do not enter personal information that is not needed for the feature you use.

3. Purposes and Legal Bases

• Provide the Service and respond to requests: create and administer accounts, store business records, deliver configured messages, provide support, and respond to website enquiries; generally necessary to perform our contract or take steps you request before a contract.
• Secure and maintain the Service: prevent abuse, protect accounts, diagnose faults, and measure performance; based on our legitimate interests in a safe and reliable service, assessed against people’s rights.
• Optional features: push notifications and live staff location are enabled only through their feature settings and applicable consent controls. Consent can be withdrawn for future processing through the available setting or by contacting us.
• Meet legal obligations and handle claims: retain or disclose information where applicable law requires or permits it.

The lawful basis and controller/processor role must be assessed for each processing activity. Where Khanta processes an Owner's records on the Owner's instructions, the Owner is responsible for establishing a lawful basis for that processing.

4. Sharing and Service Providers

We do not sell personal data. We use service providers to host, secure, operate, and support the Service, subject to appropriate contractual and security controls. Depending on enabled features and configuration, these include:

• Cloud hosting, database, and object-storage providers;
• WhatsApp and SMS providers for codes, receipts, alerts, and reminders. Store messages are sent through the WhatsApp account the store owner connects for that store; a store contact number is separate and is not used as a sender unless connected. If no store account is connected, automated WhatsApp messages are not sent from a shared Khanta number;
• Push-notification infrastructure when enabled;
• Vercel Analytics and Speed Insights, and Sentry error/performance monitoring when configured;
• Open Food Facts for optional barcode lookup; only the barcode number is sent for that lookup, not personal data;
• Payment gateways such as Paystack or Flutterwave to collect Khanta subscription payments. Checkout and card/payment credentials are handled by the selected provider; and
• Professional advisers, auditors, authorities where legally required, or a successor in a business transfer, subject to appropriate safeguards.

We do not use credit-customer records to advertise Khanta or to build advertising profiles.

5. Public Pages

A product barcode or QR code an Owner chooses to generate can create a public page visible to anyone with the code. It may show the product name, brand, colour, size, description, sale price, and photo entered for that product. It does not show cost price, profit margin, exact stock level, or supplier contact details. A shop address appears on the public store locator only if the Owner has completed the address details and enabled public visibility. Owners should publish only information they intend to make public.

6. Cookies and Device Storage

The app uses local storage and IndexedDB for sign-in, offline access, and queued changes that sync when a connection returns. These are functional storage technologies. The marketing site also uses analytics and performance tools described above. We do not sell personal data or use third-party advertising cookies for targeted advertising. Browser or device settings can limit storage, though some Service functions may then not work.

7. Retention

We keep account and business records while an account is active and for as long afterward as needed for the purposes described here, resolving disputes, security, and legal or accounting duties. When an account is deleted, we delete or de-identify personal data within a reasonable period, except where a lawful retention duty, security need, or legal claim requires longer retention. One-time codes are removed after use or expiry. Staff live-location pings are automatically deleted after 30 days. Contact enquiries and technical logs are kept only as long as needed to respond, maintain security and service reliability, and meet applicable obligations; the exact period depends on the record and is reviewed under our retention schedule.

8. International Transfers

Some service providers or their support teams may process or access data outside Nigeria. Before a cross-border transfer, the responsible controller must use a transfer basis and safeguards required by the NDPA and applicable NDPC guidance. Contact us for information about the providers relevant to your use of the Service.

9. Security and Personal Data Breaches

We use technical and organisational safeguards appropriate to the data, including access controls, encryption in transit, and one-way hashing of authentication secrets. No service can guarantee absolute security. If Khanta acts as controller and becomes aware of a personal data breach likely to create a risk to people’s rights, we will assess and notify the NDPC within the period required by law, currently 72 hours, and notify affected people when required. If Khanta acts as a processor, we will notify the relevant controller without undue delay so that controller can assess its duties.

10. Automated Processing

Restock timing, demand forecasts, and margin estimates are calculated from business records using statistical methods. They are suggestions for an Owner to review, not decisions that determine a person’s legal rights or similarly significant interests. We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

11. Your Rights

Subject to the NDPA and any lawful limits, you may request information and access, correction, deletion, restriction, data portability, or object to processing; withdraw consent where consent is the basis; and request not to be subject to a solely automated decision with legal or similarly significant effects. You may also complain to the Nigeria Data Protection Commission. If Khanta processes your data for a shop Owner, contact that Owner first; we will assist the responsible controller as required. For requests to Khanta, contact support@khanta.com.ng. We may ask for proportionate information to verify your identity and will respond within applicable legal timeframes.

12. If You Are a Credit Customer

If a shop Owner recorded your name, phone number, or balance using Gbese, the Owner generally decides why that information is held and is responsible for the controller duties for those records. Ask the Owner to access, correct, or delete the records or stop configured reminders. Khanta processes those records to provide the Service and will route a request to the responsible Owner where appropriate.

13. Children

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal data from people under 18 as account holders. If you believe a child has provided personal data, contact us so we can assess and address it.

14. Changes and Contact

We may update this policy when our processing or legal obligations change. We will publish the current version and notify users in-app of material changes before they take effect where required. For privacy requests, policy questions, or any general enquiry, contact support@khanta.com.ng. That address is the support and enquiry channel; it is not a statement that Khanta has appointed a statutory Data Protection Officer.