Privacy Policy

Account data: your name, email address, and password (stored encrypted — we never see it in plain text) when you sign up or are invited to a business.

Business data: whatever you record while using Trackit — sales, purchases, expenses, products, customers, suppliers, and the reports generated from them. This is yours; we process it to provide the service, not for our own purposes.

Usage data: basic technical logs (like error reports, described below) that help us keep Trackit working. We don't use advertising trackers or sell any data to third parties.

To create and run your account, record and display your business data back to you, send account-related email (confirmation, password reset, staff invites), and diagnose problems when something breaks.

We use a small number of service providers to run Trackit, each only for what it's there to do:

• Supabase — hosts the database (EU region, Frankfurt) and handles authentication.
• Resend — sends account-related email (confirmations, password resets, staff invites) from our verified domain.
• Vercel — hosts the application itself.

None of these providers can use your data for their own purposes. Other members of your business (staff you've invited) can see the business data your role gives them access to — that's how Trackit works, not a third-party disclosure. We don't sell personal data to anyone, ever.

We keep your data for as long as your account exists. Trackit deliberately never silently deletes financial records on its own (corrections are done by reversal, so your books stay auditable) — but you can permanently delete your account at any time from Settings, which removes your login and, if you're the sole member of a business, every record belonging to that business. This can't be undone.

You can access and correct your account details at any time while signed in. You can request a copy of your data or ask us to delete it by contacting us, or delete your own account directly from Settings. If you believe your data has been handled incorrectly, you can also raise a complaint with the Nigeria Data Protection Commission.

Every business's data is isolated at the database level (row-level security), so one business can never read another's records, even through a bug in the application code. Data is encrypted in transit and at rest. No system is perfectly secure, but we take reasonable technical measures to protect your data and we monitor for errors in production.

Trackit uses only the cookies needed to keep you signed in. We don't use advertising or cross-site tracking cookies.

Trackit is a business tool and isn't directed at children. We don't knowingly collect data from anyone under 18.

If we make a material change to how we handle your data, we'll update the date at the top of this page and, where appropriate, let you know directly.

Questions, or want to exercise any of the rights above? Reach us at hello@stathub.ng.