Privacy Policy

This Privacy Policy describes how WebFront360 ("we", "us") collects, uses, and protects your personal information when you use the MyProfits mobile application and related backend services (collectively, "the App"). MyProfits helps small business owners track sales, costs, and profit.

1. Who we are

WebFront360 is the data controller for the App. We are based in Ghana, and this Policy is governed by Ghana's Data Protection Act, 2012 (Act 843).

2. Information we collect

You can use the App without an account; your records then stay on your phone and we receive none of them. If you sign in to back up your records, we collect:

From your sign-in provider (Apple or Google, depending on which you choose):

• Your name
• Your email address (with Apple, this may be a private relay address Apple creates for you)
• Your profile picture URL (if you have one)
• A unique identifier from the provider, used only to recognise you on return visits

From your use of the App, only what you enter:

• Business name, type, currency, and tax-rate setting
• Products and their selling prices, direct costs, and batch sizes
• Operational expenses (rent, utilities, etc.) and owner withdrawals
• Sales — date, quantity, revenue, computed profit, and payment status
• Customers you add: their name, and optionally a phone number and a note, plus what they owe and pay you
• Stock movements and bills you record
• Attendants you add: their name and a scrambled (hashed) copy of their PIN, never the PIN itself
• Notes you add to sales or expenses

If you subscribe to Pro:

• Your subscription status, plan and renewal date. Payment itself is handled by Apple or Google; we never see your card or bank details.

Technical information collected automatically:

• Device type and operating system (so we can fix platform-specific bugs)
• App version
• Crash and error logs (no business data is included in these)
• IP address (only when signing in, used to detect suspicious activity)

We do not collect: your contacts, your friends list, your photos, your location, your messages, your microphone or camera, or anything from third-party apps. We don't run advertising trackers.

3. Why we collect it

• To provide the service: recording sales, computing profit, generating reports.
• To identify you: so your data is yours and only yours.
• To support you: if you contact us, we can verify your account.
• To improve reliability: error logs help us fix crashes faster.

We do not use your data for marketing, advertising, profiling, or any automated decisions that affect you.

4. How we store and secure it

• Stored in a managed PostgreSQL database hosted by Railway (our infrastructure provider).
• Encrypted in transit (TLS/HTTPS) between the App, our server, and the database.
• Access to the database is restricted to authorised maintainers using strong credentials.
• We never see or store your Apple or Google password; sign-in is handled entirely by them.

No system is perfectly secure. We commit to using reasonable safeguards and to notifying you and the Data Protection Commission of Ghana if a breach affects your personal data, in line with Section 31 of Act 843.

5. Who we share it with

We do not sell your data. We do not share it with advertisers. The only parties that ever touch your data are:

• Railway — our infrastructure (server hosting and database).
• The sign-in provider you chose — Apple or Google — which authenticates you. They only learn that you signed in to MyProfits; we do not send them your business data.
• Apple and Google — when you buy Pro, the App Store or Google Play takes the payment and manages the subscription.
• RevenueCat — processes in-app purchase receipts so we know whether your Pro subscription is active. It receives an anonymous account identifier and your purchase history, not your business data.
• Law enforcement or regulators — only when legally compelled (court order, statutory request from the Data Protection Commission, etc.).

6. International transfers

Railway's servers may be located outside Ghana (typically in the United States or the European Union). By using the App you consent to this transfer. We rely on Railway's own security and compliance commitments to safeguard the data while it's there.

7. How long we keep it

• While your account is active: indefinitely — your historical sales data is useful to you.
• When you delete your account in the App: your account and everything backed up to it are deleted immediately.
• When you ask us by email: we delete it within 30 days. See the Data Deletion page.
• Crash logs: retained for 90 days, then automatically discarded.
• Aggregated, non-identifying statistics: we may retain these indefinitely (e.g. "X total sign-ups this quarter"). They cannot be traced back to you.

8. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access — ask us what data we hold about you.
• Correct — ask us to fix anything that is inaccurate.
• Delete — ask us to erase your personal data.
• Withdraw consent — at any time, by deleting your account in the App.
• Complain — to the Data Protection Commission of Ghana if you believe we have mishandled your data: dataprotection.org.gh.

To exercise any of these rights, email us at hello@webfront360.com. We respond within 30 days.

9. Children

MyProfits is intended for use by people aged 18 and over who run a business. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top will reflect the most recent change. For material changes, we will notify you via the App and/or by email.

11. Contact

Questions or concerns about this Policy or how we handle your data: hello@webfront360.com.