Privacy Policy
Who we are
- Bytes & Acres Ltd, company code 156896306, registered office Gift House, No 7, KG 647 St, Kacyiru, Gasabo, Kigali, Rwanda.
- For account data (who uses the Service and how) we are the data controller.
- For Customer Data your organization enters, such as buyer and supplier contacts, we act as a processor on your organization's behalf.
- Data Protection Officer: suleiman@bytesandacres.com, +250 799 908 160.
What we collect
- Account: your name, email address, a hashed password (never the password itself), role, and when you accepted these policies and verified your email.
- Organization profile: name, logo, business address, phone and tax ID (TIN). The TIN is encrypted in our database.
- Deals: produce, quantities, prices and costs; buyer and supplier names, addresses and contact details; payment terms; and the bank account where your organization receives payment. Bank account details are encrypted in our database.
- Activity log: who created, changed or deleted deals, team members and organization details, and when. Bank details are recorded masked.
- Technical: a session cookie and server logs (IP address, browser, pages requested, time) used to keep you signed in and protect the Service.
Why we use it
- To provide the Service you signed up for (contract).
- To secure the Service, prevent abuse and investigate problems (legitimate interest).
- To send service emails such as email verification and password resets (contract). We do not send marketing from the Service.
- To meet legal obligations.
Where it is stored
The Service, its database, uploaded logos and backups are hosted in Kigali, Rwanda, on a server operated by STRETTCH CLOUD Limited. Some service providers listed below process limited data outside Rwanda; for those transfers we rely on contractual safeguards and on the authorisation of the supervisory authority where the law requires it.
Service providers
- STRETTCH CLOUD Limited (Rwanda): server hosting for the Service, database and backups.
- Zoho: delivery of service emails (verification and password reset). Your name and email address pass through Zoho, which may process them outside Rwanda.
- Frankfurter (api.frankfurter.dev): exchange rates. Only the two currency codes are sent, never deal or personal data.
- Google Fonts: the app's typefaces are loaded from Google, which receives your IP address when a page loads.
We do not sell personal data.
Cookies and local storage
ba_dossier_sid: keeps you signed in. Strictly necessary. Lasts up to 30 days or until you sign out.dossier_lang(browser storage): remembers your language choice.- The app can be installed on your device. Installing it does not store deal data on your device.
We do not use analytics or advertising cookies in the Service.
How long we keep it
- Account, organization and deal data: while the account exists. Deleted deals stay restorable until the organization is deleted.
- Activity log: while the organization exists.
- Database backups: 14 days.
- Sessions: up to 30 days.
Your rights
Under Rwanda's Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy you can ask to access, correct or delete your personal data, object to or restrict its use, receive it in a portable format, and withdraw consent. Email suleiman@bytesandacres.com. If your data was entered by an organization using the Service (for example as a buyer contact), we will pass your request to that organization and help it respond. We aim to reply within 30 days. You can also complain to the Data Protection and Privacy Office at the National Cyber Security Authority (dpo.gov.rw).
Security
Connections use HTTPS. Passwords are hashed with bcrypt. Bank details and tax IDs are encrypted with AES-256-GCM. Each organization can only see its own data. If a breach is likely to affect your rights, we will notify the supervisory authority within 48 hours of becoming aware of it and tell affected people without undue delay.
Changes
We show the version and date at the top of this page and will ask you to accept a materially changed version when you next sign in.