Privacy Policy

Last updated: [DATE YOU PUBLISH THIS]

Written to match how OBX'Server actually stores and processes data today — not generic boilerplate — but not a substitute for legal review, especially given this covers payment data and organisational records (donor information for NGO tenants in particular). Fields marked this need your real information.

1. Who this policy covers

This policy explains how [YOUR REGISTERED BUSINESS NAME], operating OBX'Server, collects and handles personal data. It applies to visitors to obxserver.com, and to accounts and data on the OBX'Server platform. We aim to handle personal data in line with the Nigeria Data Protection Act (NDPA) 2023.

2. What we collect

Category	Examples
Account information	Your name, email address, phone number, and password (stored securely, never in plain text)
Organisational data you enter	Donor/donation records, appointments, orders, customers, and other business records you create in your dashboard
Billing information	Subscription plan, billing interval, and payment status. Card details are collected and stored by Paystack directly — we never receive or store your full card number
Technical data	IP address and basic request logs, used for security (e.g. rate-limiting signup abuse) and troubleshooting

3. How we use it

To create and run your account and tenant site
To process payments and keep your billing records accurate
To respond to support requests
To detect and prevent abuse of the signup and payment systems
To meet legal and accounting obligations

We do not use your organisational data (donor lists, customer records, etc.) for advertising, and we do not sell personal data to third parties.

4. Where your data lives

Each organisation's data is stored in its own separate, isolated database — your records are never mixed with, or visible to, any other organisation on the platform.

5. Third parties we use

Paystack processes all payments and handles your card details directly, under their own privacy policy. [YOUR HOSTING PROVIDER, E.G. HETZNER] hosts the servers the Service runs on. We don't share your organisational or personal data with any other third party except where required by law.

6. Cookies

We use a single session cookie to keep you logged in. We don't use advertising or tracking cookies.

7. Your rights

You can ask us to access, correct, or delete the personal data we hold about you, or export your organisation's data. To do so, contact [SUPPORT EMAIL]. Note that some data (e.g. billing records) may need to be retained for legal or accounting reasons even after a deletion request.

8. Data retention

We retain your account and organisational data for as long as your account is active. If you close your account, we'll delete your data within a reasonable period, except where we're required to keep records (such as billing history) for legal reasons.

9. Children

The Service is intended for organisations and business owners, not children. We don't knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the date at the top of this page.

11. Contact

Questions about this policy, or to exercise your data rights: [SUPPORT EMAIL]