AfricanComplex — Privacy Policy

Last Updated: July 25, 2026 Effective Date: July 25, 2026

THIS PRIVACY POLICY describes how AfricanComplex Holdings LLC, an Indiana limited liability company ("AfricanComplex," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use the AfricanComplex marketplace platform and OrbitApex delivery service (collectively, the "Services"), including our website and mobile applications. This Policy currently governs use of the Services within the United States, with Indiana as AfricanComplex's initial launch state. If AfricanComplex expands internationally, it will issue jurisdiction-specific addenda (see Section 9) before offering the Services in those markets.

1. Information We Collect

1.1 Information You Provide

All users:

• Name, email address, phone number
• Profile photo
• Account credentials (managed by Clerk, our authentication provider)
• Delivery addresses
• Communication preferences

Customers:

• Order history and preferences
• Payment method information (processed and stored by Stripe; we do not store card numbers)
• Reviews and ratings
• Support ticket communications
• Refund request details and supporting photos

Merchants:

• Business name and description
• Business license or registration information
• Employer Identification Number (EIN)
• Owner photo identification
• Bank account information (processed and stored by Stripe Connect)
• Store address and operating hours
• Product listings, images, and inventory data
• Subscription plan and billing history

Drivers:

• Driver's license number and expiration date
• Auto insurance policy details and expiration date
• Vehicle registration and expiration date
• Vehicle information (make, model, year, color, license plate)
• Vehicle photos
• Social Security Number (last 4 digits displayed; full number encrypted using AES-256-GCM), used solely for tax reporting and background checks
• IRS Form W-9
• Bank account or debit card information (processed and stored by Stripe Connect)
• Background/screening check results (administered by Checkr)

1.2 Information Collected Automatically

All users:

• Device information (device type, operating system, app version)
• Device tokens for push notifications (via Firebase Cloud Messaging)
• IP address
• Usage data (pages viewed, features used, timestamps)
• App crash reports and performance data

Drivers (while online/on delivery):

• Real-time GPS location data
• Location history during active deliveries
• Delivery route information

Customers (during order placement):

• Approximate location for store discovery and delivery radius

1.3 Information from Third Parties

2. How We Use Your Information

2.1 Service Operations

• Creating and managing your account
• Processing orders and payments
• Facilitating deliveries (matching orders with Drivers, providing navigation)
• Processing refunds and resolving disputes
• Managing merchant subscriptions and payouts
• Managing driver earnings and payouts
• Sending order and delivery status notifications
• Providing customer support

2.2 Safety and Compliance

• Verifying Merchant business credentials and approval
• Conducting Driver background/screening checks
• Monitoring Driver document expiration and compliance
• Detecting and preventing fraud (refund abuse, payment fraud)
• Enforcing Platform policies (cancellation limits, suspension rules)
• Generating tax documents (e.g., Form 1099-NEC for Drivers earning over $600/year)
• Maintaining audit logs for administrative actions
• Complying with applicable U.S. federal and state legal obligations

2.3 Platform Improvement

• Analyzing usage patterns to improve the Services
• Monitoring Platform performance and reliability
• Debugging errors and resolving technical issues

2.4 Communications

• Sending transactional emails (order confirmations, payout receipts, document expiration alerts)
• Sending push notifications for order updates, delivery status, and job offers
• Sending subscription and billing notifications
• Sending support ticket updates

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

3.1 Between Platform Participants

3.2 Service Providers (Processors)

We require each service provider to protect your information under a written data processing or services agreement.

3.3 Legal Requirements

• Court orders or subpoenas
• Requests from law enforcement or government agencies
• To protect the rights, property, or safety of AfricanComplex, our users, or the public

3.4 Business Transfers

If AfricanComplex is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to equivalent protections. We will notify you of any such change.

4. Data Retention

After the retention period, data is permanently deleted or anonymized.

5. Data Security

• Encryption in transit: all data transmitted between your device and our servers is encrypted using TLS.
• Encryption at rest: sensitive identifiers (e.g., Social Security Numbers) are encrypted using AES-256-GCM.
• Access controls: role-based access controls limit data access to authorized personnel.
• Authentication: multi-factor authentication required for administrative accounts.
• Payment security: payment card data is processed and stored by Stripe (PCI DSS Level 1 certified); we never store card numbers.
• Document security: uploaded documents are stored in Cloudflare R2 with signed URLs that expire after 15 minutes.
• Audit logging: all administrative actions are logged with timestamps and actor identification.
• Monitoring: application and infrastructure monitoring for security incidents.
• Breach notification: in the event of a security breach involving your personal information, we will notify affected individuals without unreasonable delay, consistent with applicable state law. For Indiana residents, this means notice no later than 45 days after discovery of the breach, along with notice to the Indiana Attorney General, as required by Indiana's data breach notification statute, Ind. Code §§ 24-4.9-1 to -5.

6. Your Rights and Choices

6.1 Account Information

You may update your account information at any time through the app settings.

6.2 Notification Preferences

You may manage your notification preferences (push, email) through the app settings. Certain transactional notifications (order confirmations, payment receipts, document expiration warnings) cannot be disabled.

6.3 Location Data

• Customers: Location access is optional and used for store discovery. You may deny location permission and manually enter your address.
• Drivers: Location access is required while online and during active deliveries. You may go offline at any time to stop location sharing.

6.4 Account Deletion

You may request deletion of your account by contacting support. Upon account deletion: your profile and personal information will be removed; order history will be anonymized but retained for financial compliance; merchant store data will be archived; active subscriptions will be cancelled; and outstanding payouts will be processed before deletion.

6.5 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect, its sources, and the purposes for which it is used; delete personal information we hold about you, subject to certain exceptions; opt out of the sale or sharing of personal information — AfricanComplex does not sell or share personal information as defined by the CCPA; correct inaccurate personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising these rights. To exercise these rights, contact [email protected]. We will verify your request using the information associated with your account before responding. You may designate an authorized agent to submit a request on your behalf, subject to our ability to verify that authorization.

6.6 California "Do Not Track" Disclosure

Separately from the CCPA/CPRA rights above, the California Online Privacy Protection Act, Cal. Bus. & Prof. Code § 22575(b)(5), requires any operator of a commercial website that collects personal information from California residents — regardless of the operator's size or revenue — to disclose how it responds to web-browser "Do Not Track" signals. AfricanComplex's website does not currently respond differently to a browser's "Do Not Track" signal, because, as described in our Cookie Policy, africancomplex.com does not use analytics, advertising, or cross-site tracking cookies for which a "Do Not Track" signal would change our behavior. We will update this disclosure if that changes.

6.7 Rights for Residents of Other U.S. States

If you reside in Virginia, Colorado, Connecticut, Utah, or another state with a comprehensive consumer privacy law in effect, you may have similar rights to access, delete, correct, and port your personal information, and to opt out of targeted advertising, the sale of personal information, or certain profiling. To exercise any such right, contact [email protected], and we will process your request in accordance with the law applicable in your state of residence.

6.8 Indiana Consumer Data Protection Act

The Indiana Consumer Data Protection Act ("ICDPA"), Ind. Code Art. 24-15, took effect January 1, 2026. It applies to a person conducting business in Indiana, or producing products or services targeted to Indiana residents, that during a calendar year either (a) controls or processes the personal data of at least 100,000 Indiana consumers, or (b) controls or processes the personal data of at least 25,000 Indiana consumers and derives more than 50% of gross revenue from the sale of personal data. AfricanComplex does not expect to meet either threshold at its initial Indiana-only launch scale and will reassess ICDPA applicability, and update this Policy accordingly, as its Indiana user base grows. If the ICDPA becomes applicable to AfricanComplex, Indiana consumers would have the right to confirm whether AfricanComplex is processing their personal data, access that data, correct inaccuracies, request deletion, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, or profiling in furtherance of certain decisions. The ICDPA is enforced exclusively by the Indiana Attorney General, provides a 30-day cure period before an enforcement action may proceed (Ind. Code § 24-15-10-3), and does not create a private right of action. You may direct any ICDPA-related question to [email protected].

7. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

8. Third-Party Links and Services

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party services you access.

9. International Expansion — Future Scaffolding

AfricanComplex's Services currently operate only within the United States. The following international provisions are retained so that, if and when AfricanComplex expands abroad, this Policy can be extended by addendum rather than redrafted from scratch. They do not reflect current operations or obligations.

9.1 European Economic Area and United Kingdom

If AfricanComplex expands to the EEA or UK, individuals there would have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority. Before launch in those markets, counsel must confirm the controller/processor structure, appoint an Article 27 representative if required, assess whether a Data Protection Officer is required, and confirm the cross-border transfer mechanism (Standard Contractual Clauses, UK IDTA, or adequacy reliance).

9.2 African Jurisdictions

If AfricanComplex expands to African markets, individuals there may have rights under local law, such as Kenya's Data Protection Act, 2019; Nigeria's Data Protection Act, 2023; South Africa's POPIA; or Ghana's Data Protection Act, 2012. Before launch in any such market, counsel must confirm registration/notification obligations with the applicable data protection authority and the specific statutory rights that apply.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top of this Policy indicates when the most recent changes were made.

11. Contact Us

AfricanComplex Holdings LLC 5702 Walkabout Way, Brownsburg, IN 46112 Email: [email protected] · Phone: +1 317-389-1333

For data subject requests (access, deletion, correction, or portability), email [email protected].