POSNek Privacy Policy

This plain-language summary highlights key points. The full policy below controls if there is any conflict.

• What we collect: account/contact details, Business Data you enter, technical/diagnostic data, and payment metadata for subscriptions — not full card numbers.
• Why we use it: to provide POSNek, authenticate users, process subscriptions, support you, secure the service, and meet legal obligations.
• Who we share it with: service providers such as Appwrite (auth/infrastructure) and Paystack (payments), plus hosting providers — not sold for money.
• How long we keep it: according to our retention practices; some periods are still being finalized ([DEFINE RETENTION PERIOD] where noted).
• Your rights: access, correction, and other rights available under Ghana's Data Protection Act, 2012 (Act 843) and other applicable law.
• How to contact us: dikodercom@gmail.com (Dikoder Recording Studio (DikoderGroup)).

This Privacy Policy explains how Dikoder Recording Studio (DikoderGroup) ("we", "us") handles Personal Data in connection with POSNek, including the Website, Application, API, and related Services.

It is drafted with Ghana's Data Protection Act, 2012 (Act 843) principles in mind (lawfulness, transparency, purpose limitation, data minimisation, accuracy, retention limitation, security, and accountability). It does not claim that any Data Protection Commission registration has been completed.

This document is a product/legal draft and requires counsel review before being treated as a complete statement of regulatory compliance. [LEGAL REVIEW REQUIRED]

Operator: Dikoder Recording Studio (DikoderGroup). Product: POSNek. POSNek is not a separate legal company from Dikoder Recording Studio / DikoderGroup.

Website: https://posnek.torsaa.com. Application services: https://posnek.torsaa.com/app. API: https://api.posnek.torsaa.com. Admin: https://admin.posnek.torsaa.com.

Privacy contact: dikodercom@gmail.com. Address: [INSERT REGISTERED/CONTACT ADDRESS]. Telephone: +233 54 544 3117.

Depending on how you use POSNek, we may process:

• Identity and contact: name, business name, role, email, phone (where provided)
• Account: login identifiers, Appwrite user identifiers, authentication/session metadata
• Business Data: products, sales, inventory, customers, suppliers, expenses, debt records, shifts, returns, reports, settings, and similar operational records you enter
• Technical: IP address where collected, device type, OS, browser, app version, diagnostic logs
• Payment: transaction references, subscription status, and payment metadata from Payment Providers — not full card numbers
• Support: messages and attachments you send to support

We collect information from you and your authorized Business Users, from support requests, from Payment Providers (payment status/metadata), and from application/device usage and logs needed to operate and secure the service.

We only describe integrations that are actually used. We do not claim third-party marketing analytics trackers on the marketing site unless enabled and disclosed.

We use Personal Data and related service data to:

• Create and administer Accounts and Businesses
• Authenticate users and enforce permissions
• Provide POS, inventory, customer, reporting, and related product features
• Manage Free, trial, and paid subscriptions
• Process subscription payments via Payment Providers
• Provide customer support and troubleshoot issues
• Prevent fraud, abuse, and security incidents
• Maintain backups, reliability, and audit/security logs where implemented
• Improve the service based on operational needs
• Comply with legal obligations

Depending on the activity and applicable Ghana law, processing may be justified by performance of a contract, consent where required, legal obligation, or other lawful grounds recognized under Act 843 and related guidance.

We do not mechanically copy GDPR lawful-basis labels. Exact mapping of each purpose to a statutory ground requires counsel review. [LEGAL REVIEW REQUIRED]

Businesses using POSNek may enter Personal Data about their own customers, employees, suppliers, and contacts.

Your business is responsible for ensuring that collection and use of that data is lawful (for example notices, consent where needed, and purpose limitation).

We process such data to provide the Services according to your instructions and our agreement with you, where applicable. Exact controller/processor allocation depends on the factual relationship and must be confirmed with counsel. [LEGAL REVIEW REQUIRED — CONTROLLER/PROCESSOR ROLES]

A future Data Processing Agreement (DPA) may be appropriate for business customers; it is not published as a completed instrument in this draft.

POSNek uses Appwrite-based authentication and related account infrastructure. We and our providers process identifiers and session metadata needed to sign you in and protect Accounts.

We do not publish API keys, project secrets, or other technical credentials in this policy.

POSNek subscription payments may be processed by Paystack. Paystack may process card or other payment details under its own policies.

POSNek may store or receive transaction references, payment status, subscription status, and related metadata. We do not store full payment card numbers for POSNek subscriptions.

See Paystack's published policies (for example https://paystack.com/terms).

We may process technical and diagnostic information to operate, secure, and improve POSNek. Business addresses you type into settings are not the same as precise device GPS location. We do not claim collection of precise GPS location unless the product actually does so.

We use essential cookies and similar technologies needed for site/app operation (for example session and security). See the Cookie Policy at https://posnek.torsaa.com/cookies.

As of this version, the marketing site is not described as using separate marketing analytics trackers. If that changes, we will update the Cookie Policy.

The POSNek AI Assistant may use Business Data available within your authenticated Business to generate operational insights through a deterministic rules/insights engine.

It is not ChatGPT/OpenAI and is not described as training external large language models on your data. We do not sell your data to AI companies.

Outputs may err. The Assistant is informational and is not intended to make automated decisions with legal or similarly significant effects (for example employment, credit, or medical decisions).

We may share Personal Data with:

• Service providers / processors that help us operate POSNek
• Payment providers (Paystack) for subscription billing
• Hosting and infrastructure providers
• Authentication providers (Appwrite)
• Professional advisers or authorities where legally required
• Parties to a corporate transaction (merger, acquisition, reorganization), subject to appropriate safeguards

We do not sell Personal Data for money.

Key providers currently include Appwrite (authentication and related backend services) and Paystack (subscription payments). Hosting/Dokploy/VPS providers support delivery of the Website, Application, and API.

Appwrite privacy information: https://appwrite.io/privacy. Paystack policies: https://paystack.com/terms.

Providers process data only as needed to deliver their services to us. An internal subprocessors register is maintained for governance; public lists may be updated as architecture changes.

POSNek may use cloud and third-party providers that process data outside Ghana. Personal Data may therefore be transferred internationally where those providers operate.

We will describe transfer safeguards in a legally accurate way after confirming provider locations and contractual measures. [LEGAL REVIEW REQUIRED — INTERNATIONAL DATA TRANSFERS]

We retain Personal Data only as long as needed for the purposes described, including security, billing, dispute resolution, and legal compliance.

Specific periods for account data, Business Data, payment records, support tickets, audit logs, security logs, and backups are maintained internally. Where not yet decided for public disclosure, periods remain [DEFINE RETENTION PERIOD] until confirmed.

Contact us if you need information about retention applicable to your Account or Business.

We apply security measures appropriate to a multi-tenant business application, including authenticated access, role-based permissions, server-side authorization checks, tenant/business isolation, secure credential handling, and audit logging where implemented.

Encryption in transit is used where the deployment provides it (for example TLS on public endpoints). We do not claim encryption at rest, SOC 2, ISO, PCI DSS, or other certifications unless independently verified and published.

No method of transmission or storage is completely secure.

If we become aware of a security incident affecting Personal Data, we will take reasonable steps to investigate, contain risk, assess impact, and comply with applicable notification obligations.

Statutory notification deadlines and customer communication SLAs must be confirmed with counsel. [DEFINE INCIDENT RESPONSE AND NOTIFICATION SLA] [LEGAL REVIEW REQUIRED]

Subject to Act 843 and other applicable law, you may have rights to access, correct, update, or delete Personal Data, and to seek redress or complain to a competent authority.

To exercise rights, email ${legalMeta.privacyEmail} with enough detail for us to verify your identity and locate the relevant records. We may need to distinguish Account holder requests from end-customer requests directed to a Business that uses POSNek.

We do not invent statutory response deadlines. Where a Business is the primary controller of end-customer data, we may redirect the request appropriately. [LEGAL REVIEW REQUIRED]

You may request Account or Business deletion through available product flows or by contacting ${legalMeta.supportEmail} / ${legalMeta.privacyEmail}.

Deletion of a user profile is not always the same as deleting an entire Business or all historical transaction records. Billing records, audit logs, security logs, and backups may persist for a limited period or where legally required.

We do not promise full GDPR-style erasure tooling or immediate removal from every backup copy.

POSNek is business software and is not directed at children. We do not knowingly target children for Accounts.

Minimum age requirements for Account holders: [LEGAL REVIEW REQUIRED — confirm age policy].

When a Business enables WhatsApp Commerce, POSNek processes customer phone numbers, WhatsApp message content needed to understand and fulfil orders, delivery addresses the customer provides, order and payment references, and related fulfilment status — solely to operate that Business's WhatsApp sales channel inside POSNek.

Messages are processed through Meta's official WhatsApp Business Platform / Cloud API. POSNek does not scrape WhatsApp Web or use unofficial WhatsApp automation.

The Business remains responsible for lawful customer communications, consent where required, and compliance with Meta/WhatsApp policies. POSNek is software infrastructure for the Business; it does not own the Business–customer relationship.

Message retention follows product configuration and operational need for order handling. Unlimited chat archives are not retained by default. [LEGAL REVIEW REQUIRED before production]

We may send service, transactional, and security messages related to your Account. You cannot opt out of essential service notices while you use POSNek.

Promotional email, WhatsApp, or SMS is used only where we actually operate that channel. Where promotional messages are sent, you may unsubscribe using the method provided. [CONFIRM MARKETING CHANNELS]

The Website or Application may link to third-party sites. Their privacy practices are their own. Review their policies before providing Personal Data.

We may update this Privacy Policy. We will publish the new version with an updated version number and effective date. Material changes may be communicated by email, in-app notice, or Website notice where practical.

If you have a privacy concern, contact us first at ${legalMeta.privacyEmail} so we can try to resolve it.

You may also have rights to seek redress through applicable regulatory mechanisms in Ghana, including under Act 843. Verify current official Data Protection Commission contact details before relying on any published regulator address. We do not claim DPC registration in this policy.

Dikoder Recording Studio (DikoderGroup)

Privacy: dikodercom@gmail.com

Support: dikodercom@gmail.com

Legal: dikodercom@gmail.com

Address: [INSERT REGISTERED/CONTACT ADDRESS]

Telephone: +233 54 544 3117