Privacy Policy

Who is responsible for your data

For account holders, applicants and users, Incluve decides how their data is used and is the data controller. This covers sign-in details, verification documents, billing and support conversations.

For the records a business keeps in Prospera about its own customers, suppliers, contacts and staff, that business is the data controller and Incluve processes the data on its behalf. If you are one of those people, contact the business first; we will help it respond.

What we collect

• Account and user details: name, email address, phone number, job title, profile picture, role and branch.
• Verification (KYC) information: business registration and tax numbers, directors' or owners' identity documents, proof of address and other documents you upload when applying.
• Business records you enter or import: customers, suppliers and their contacts, phone numbers and bank account details, products, invoices, quotations, purchase orders, bills, payments, expenses, stock and equipment records.
• Files you upload: supplier invoices, bank statements, logos, product pictures and documents you send from Prospera.
• Messages between businesses on Prospera, support tickets and AI Assistant conversations, including voice notes you record.
• Technical data: IP address, device and browser type, sign-in times, error and security logs, push notification tokens and reCAPTCHA signals.

How we use it and our legal bases

• To provide Prospera and its features, including document delivery and AI features (performance of our contract with the business).
• To verify businesses before activation and prevent fraud (legitimate interests and legal obligations).
• To keep the service secure, investigate problems and support you (legitimate interests).
• To send service messages such as verification results, password resets, receipts and notices of changes (contract and legitimate interests).
• To bill for subscriptions and keep financial records (contract and legal obligations).
• To understand how Prospera is used and improve it, using aggregated or de-identified data where possible (legitimate interests).
• Where we ask for consent, for example optional marketing, you can withdraw it at any time.

We do not sell personal data, and we do not use your business records to advertise to you.

AI processing

When you use AI features, the relevant content (for example a bank statement, a supplier invoice, a spreadsheet you are importing, or your question to the AI Assistant) is sent to our AI service providers, currently Anthropic and OpenAI, to produce the result. [Confirm that provider terms bar them from training models on this data and state their retention periods.]

AI results are suggestions. A person at your business reviews and confirms them before anything is posted to your books.

Who we share it with

We share personal data only as needed, with:

• Service providers that run Prospera for us: Google Cloud and Firebase (hosting, sign-in, file storage, push notifications, reCAPTCHA), Aiven (database hosting), Anthropic and OpenAI (AI features), SendGrid (email delivery), Pydantic Logfire (error and performance monitoring) and TypeSafe (bank line classification). [Confirm this list before publishing.]
• Other businesses, only what you choose to share: a public listing, messages you send, or documents you send to a customer or supplier.
• Professional advisers, and authorities or courts where the law requires it or to protect rights and safety.
• A buyer or successor, if Incluve's business is sold or reorganised, under the same protections.

International transfers

Prospera's servers and several of our providers are outside Nigeria and Kenya, including in the European Union and the United States. [Confirm hosting regions.] Where data leaves your country, we rely on the safeguards the law recognises, such as contractual protections with our providers.

How long we keep it

We keep account and business records while the account is active. After an account closes, we keep them for [30] days so the business can ask for an export, then delete or anonymise them, except financial and tax records we must keep by law for [6] years.

Verification documents are kept for [the duration of the account plus 5 years] to meet anti-fraud and legal obligations. Rejected applications are deleted after [12 months]. Security logs are kept for [12 months].

Security

Data is encrypted in transit and at rest, access is limited by role, staff at Incluve see business data only when necessary, and we monitor for misuse. If a personal data breach puts your rights at risk, we will notify you and the regulator as the law requires.

Your rights

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct inaccurate data or complete missing data;
• delete data we no longer need or have no right to keep;
• restrict or object to certain uses, including processing based on legitimate interests;
• give you your data in a portable format;
• withdraw consent where we rely on it.

Email support@medcore.ai to use these rights. We may need to confirm your identity, and we reply within the time the law sets. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or Kenya's Office of the Data Protection Commissioner (odpc.go.ke).

Cookies and local storage

Prospera uses cookies and browser storage that are needed to keep you signed in, remember your company, branch and display choices, and protect sign-up and sign-in with reCAPTCHA. We do not use advertising cookies.

Children

Prospera is for businesses and is not intended for anyone under 18.

Changes to this policy

We will post changes here and update the date at the top. For significant changes we will also notify account holders in the app or by email.

Contact and data protection officer

Incluve, LLC, [registered address]. Data protection contact: [name or role, if a DPO is appointed], support@medcore.ai.