AfricanComplex — Privacy Policy

DRAFT — FOR ATTORNEY REVIEW ONLY This document was generated from the frozen business rules and platform specifications. It must be reviewed and approved by qualified legal counsel before publication. State-specific privacy law compliance (CCPA, CPRA, Virginia CDPA, Colorado CPA, etc.) must be verified by counsel. Not legal advice.

Last Updated: [DATE] Effective Date: [DATE]

1. Introduction

This Privacy Policy describes how AfricanComplex Holdings LLC ("AfricanComplex," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the AfricanComplex marketplace platform and OrbitApex delivery service (collectively, the "Services"), including our website, mobile applications (Customer, Merchant, and Driver apps), and related services.

By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

All Users:

• Name, email address, phone number
• Profile photo
• Account credentials (managed by Clerk, our authentication provider)
• Delivery addresses
• Communication preferences

Customers:

• Order history and preferences
• Delivery addresses
• Payment method information (processed and stored by Stripe; we do not store card numbers)
• Reviews and ratings
• Support ticket communications
• Refund request details and supporting photos

Merchants:

• Business name and description
• Business license information
• Tax identification number (EIN)
• Owner photo identification
• Bank account information (processed and stored by Stripe Connect)
• Store address and operating hours
• Product listings, images, and inventory data
• Subscription plan and billing history

Drivers:

• Driver's license number and expiration date
• Auto insurance policy details and expiration date
• Vehicle registration and expiration date
• Vehicle information (make, model, year, color, license plate)
• Vehicle photos
• Social Security Number (last 4 digits stored for display; full SSN encrypted with AES-256-GCM and used solely for tax reporting and background checks)
• W-9 tax form
• Bank account or debit card information (processed and stored by Stripe Connect)
• Background check results (administered by Checkr)

2.2 Information Collected Automatically

All Users:

• Device information (device type, operating system, app version)
• Device tokens for push notifications (via Firebase Cloud Messaging)
• IP address
• Usage data (pages viewed, features used, timestamps)
• App crash reports and performance data

Drivers (while online/on delivery):

• Real-time GPS location data
• Location history during active deliveries
• Delivery route information

Customers (during order placement):

• Approximate location for store discovery and delivery radius

2.3 Information from Third Parties

• Clerk: Authentication events, session data
• Stripe: Payment confirmation, payout status, subscription status
• Checkr: Background check results (pass/fail status only)
• Firebase: Push notification delivery status

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Operations

• Creating and managing your account
• Processing orders and payments
• Facilitating deliveries (matching orders with Drivers, providing navigation)
• Processing refunds and resolving disputes
• Managing merchant subscriptions and payouts
• Managing driver earnings and payouts
• Sending order and delivery status notifications
• Providing customer support

3.2 Safety and Compliance

• Verifying Merchant business credentials and approval
• Conducting Driver background checks
• Monitoring Driver document expiration and compliance
• Detecting and preventing fraud (refund abuse, payment fraud)
• Enforcing Platform policies (cancellation limits, suspension rules)
• Generating tax documents (1099-NEC for Drivers earning over $600/year)
• Maintaining audit logs for administrative actions
• Complying with legal obligations

3.3 Platform Improvement

• Analyzing usage patterns to improve the Services
• Monitoring Platform performance and reliability
• Debugging errors and resolving technical issues

3.4 Communications

• Sending transactional emails (order confirmations, payout receipts, document expiration alerts)
• Sending push notifications for order updates, delivery status, and job offers
• Sending subscription and billing notifications
• Sending support ticket updates

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

4.1 Between Platform Participants

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, including:

• Court orders or subpoenas
• Requests from law enforcement or government agencies
• To protect the rights, property, or safety of AfricanComplex, our users, or the public

4.4 Business Transfers

If AfricanComplex is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Services. Specific retention periods:

After the retention period, data is permanently deleted or anonymized.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS
• Encryption at rest: Sensitive data (SSN) is encrypted using AES-256-GCM
• Access controls: Role-based access controls limit data access to authorized personnel
• Authentication: Multi-factor authentication required for administrative accounts
• Payment security: Payment card data is processed and stored by Stripe (PCI DSS Level 1 certified); we never store card numbers
• Document security: Uploaded documents are stored in Cloudflare R2 with signed URLs that expire after 15 minutes
• Audit logging: All administrative actions are logged with timestamps and actor identification
• Monitoring: Application and infrastructure monitoring for security incidents

7. Your Rights and Choices

7.1 Account Information

You may update your account information at any time through the app settings.

7.2 Notification Preferences

You may manage your notification preferences (push, email) through the app settings. Certain transactional notifications (order confirmations, payment receipts, document expiration warnings) cannot be disabled.

7.3 Location Data

• Customers: Location access is optional and used for store discovery. You may deny location permission and manually enter your address.
• Drivers: Location access is required while online and during active deliveries. You may go offline at any time to stop location sharing.

7.4 Account Deletion

You may request deletion of your account by contacting support. Upon account deletion:

• Your profile and personal information will be removed
• Order history will be anonymized but retained for financial compliance
• Merchant store data will be archived
• Active subscriptions will be cancelled
• Outstanding payouts will be processed before deletion

7.5 California Residents (CCPA/CPRA)

[ATTORNEY TO COMPLETE: CCPA/CPRA specific rights disclosures, including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell)
• Right to non-discrimination
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information
• Categories of PI collected, sources, purposes, and third parties shared with
• "Do Not Sell or Share My Personal Information" instructions
• Authorized agent provisions
• Metrics disclosure (if applicable)]

7.6 Other State Privacy Laws

[ATTORNEY TO COMPLETE: Virginia CDPA, Colorado CPA, Connecticut CTDPA, and other applicable state privacy law disclosures]

8. Children's Privacy

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

9. Third-Party Links and Services

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party services you access.

10. International Users

The Services are currently operated in the United States. If you access the Services from outside the United States, you acknowledge that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top of this policy indicates when the most recent changes were made.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

AfricanComplex Holdings LLC [ADDRESS] Email: [email protected] [PHONE]

For data subject requests (access, deletion, correction), email: [email protected]