Privacy Policy

1. Who is responsible

Corehi Limited (“Corehi”, “we”, “us”) operates Konduit and is the data controller for the information described here. [TO CONFIRM: registered address, and whether a Data Protection Officer or NDPA Data Protection Compliance Organisation is appointed — and their contact details if so]

2. What we collect

Account and business information — your name, email address, phone number, business name, legal entity name, country and, where you give it, business registration details.

Information about how you use Konduit — pages and features used, actions taken in the portal, and technical information such as IP address, device and browser.

Payout and billing information — the bank or payout account you give us so we can pay you, and records of fees invoiced.

Support and communications — messages you send us.

We do not store full card numbers. Card payments are handled by our payment providers; where a card is saved for reuse we store only a token supplied by the provider, not the card details themselves.

3. Why we use it

To provide and operate the platform; to take payment and pay you; to verify identity and prevent fraud or abuse; to give support; to tell you about service changes; to meet legal and regulatory obligations; and to understand and improve how the product is used.

[TO CONFIRM: the lawful bases relied on under the Nigeria Data Protection Act 2023, and under UK/EU GDPR if merchants or staff are based there]

4. Who we share it with

We share personal information with service providers who help us run Konduit, only as needed for them to do so:

• Payment providers — Flutterwave and Stripe, to collect payments and make payouts.
• Cloudflare — DNS, TLS and custom store domains, so requests to your store reach us securely.
• Sentry — error monitoring. An error report can contain personal information present when the error happened.
• Email delivery — Resend, for transactional email such as verification codes and invitations.
• Anthropic — the AI model provider behind assistant and content features, for the text sent to those features.
• Messaging and delivery partners — where you enable them, the channels and carriers you choose to use.
• Advertising measurement — Meta Platforms Ireland, only if you turn on advertising cookies. See section 4b.

We also share information where we must by law, or to establish or defend legal claims. We do not sell personal information.

4a. Optional analytics with PostHog

With your permission, Corehi Limited uses PostHog for optional analytics about website visits, merchant and partner portal use, signup, store setup, publication and first-sale milestones. Corehi is the controller of this usage data; PostHog processes it for our product analytics. This is separate from advertising consent.

We send selected action names, timestamps, page categories, campaign labels and pseudonymous visitor or business identifiers. We do not send form contents, names, email addresses, passwords, full page addresses, customer records, order details or payment amounts. Session recording and automatic page-content capture are disabled. We disable IP geolocation in analytics events, although PostHog receives the network connection when your browser sends an event.

Our analytics deployment uses PostHog Cloud in the United States, outside Nigeria. See PostHog’s privacy information and data-storage information.

Analytics is optional. Use Analytics preferences to allow or decline it at any time; signup and other product functions remain available. Browser Do Not Track keeps analytics off. We remember your choice for up to 180 days and retain consented campaign attribution in your browser for up to seven days. Each website or portal origin has its own preference. In the merchant portal, the choice also controls future store onboarding milestones.

Withdrawal stops future browser collection and clears campaign attribution. If you allow analytics again, a new analytics identity is used for that consent period. Withdrawal does not erase events already received by PostHog. For access or deletion requests, contact info@usekonduit.com. PostHog does not receive your shoppers’ personal information through this integration.

4b. Optional advertising measurement with Meta

If you choose it, we use the Meta pixel on our website to measure which adverts bring people to Konduit. This is off unless you turn it on, and it is a separate choice from the analytics above — declining analytics also turns it off. We do not turn it on if your browser sends a Do Not Track signal.

When it is on, Meta Platforms Ireland Limited receives the page you viewed, your IP address, your browser user agent and a cookie it sets in your browser (_fbp). If you go on to create an account and agree to it during sign-up, we also send Meta a record that a registration completed, together with a one-time event identifier so the same signup is not counted twice. We do not send Meta your name, your email address, your customers’ details or anything you type into a form.

Meta uses this to report on advert performance and, as an independent controller for its own purposes, may combine it with data it already holds about you. You can withdraw your choice at any time using the privacy preferences on any page of this website, and you can control advert personalisation in your Meta account settings.

[TO CONFIRM: whether Corehi and Meta are joint controllers for this measurement, and which Meta controller terms or data-sharing addendum applies — counsel to confirm before advertising begins]

5. Where it is held

[TO CONFIRM: countries where data is stored and processed, and the transfer mechanism relied on for any transfer out of Nigeria]

6. How long we keep it

We keep account information for as long as your account is open. After it closes we keep it for 30 days, then delete or anonymise it — except records we must keep longer for tax, accounting or regulatory reasons.

7. Your rights

Subject to applicable law, you may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, object to or restrict certain processing, and ask to receive it in a portable form. You can export your business records from the portal at any time.

To exercise any of these, contact info@usekonduit.com. You may also complain to the Nigeria Data Protection Commission.

8. Security

We use access controls, encryption in transit, and encryption of sensitive stored credentials such as payment-provider keys. No system is perfectly secure; we ask that you keep your own credentials safe and use the access controls the portal provides for your team.

9. Changes

This policy is versioned. When we change it we publish a new version and record which version applied. Where a change is material we will tell you.

10. Contact

Questions or requests: info@usekonduit.com.