Privacy notice

Who handles your information

Kanti’s operator determines how account, security and service information is used. Merchants normally determine why their customers’ and team members’ business information is entered into Kanti; we process that information to provide the service on their behalf. For a request about a particular order, contact the merchant first. You may also contact Kanti about its own processing.

Information we handle

• Account email, user identifier, sign-in session and authentication information. If you choose Google sign-in, authentication details are supplied through Google and Supabase.
• Business name, phone, description, verified Paystack settlement details, owner-published receiving bank/account details, onboarding draft and preferences.
• Customer names, phone numbers and payer email addresses; order items and optional photos, values, status, addresses, delivery contacts, expense records and associated activity.
• Team invitations, email addresses, membership roles and versioned records of terms acceptance and privacy notice acknowledgement.
• Payment references, amounts, provider fees and confirmation records for payments processed through Paystack, and the method, team member, time and optional reference for manually recorded transfers or cash.
• Technical request information processed by our hosting and authentication providers for service delivery and security.
• With your permission, public-page visit information through Vercel Analytics, such as page visited and browser/device characteristics. Our analytics integration removes query strings and fragments and excludes sign-in, workspace and customer status pages.

Do not enter unnecessary sensitive information. The service is intended for adult business users, not children.

Purposes and lawful bases

We use information necessary to enter into and perform our agreement with you: signing you in, saving records, managing access and providing requested features. We also process information to meet applicable legal obligations and, where justified and balanced against your rights, legitimate interests such as preventing misuse and maintaining security. Merchant-supplied customer data is processed on the merchant’s lawful instructions. Optional public-page analytics relies on your separate consent; it is not required to use Kanti.

Storage and analytics choices

Essential cookies support authentication and your selected business. An unfinished order is kept in this browser tab’s session storage, scoped to your account and business, so you can refresh without losing progress. It is cleared after order creation or sign-out through the workspace. Browser storage also remembers your appearance preference until you change it or clear storage. Browser storage remembers your analytics choice, its date and notice version for up to 180 days, unless you change it or clear storage sooner. Optional analytics is disabled by default. Allowing it is voluntary; choosing “Essential only” leaves core features available. Your browser choice is local to that browser and is not a marketing subscription.

Privacy choices

Withdrawing consent stops future optional analytics events from this integration; it does not undo lawful processing that happened before withdrawal. Clearing browser storage causes us to ask again. We do not interpret silence or continuing to browse as permission.

Who can receive information

When you configure payments or pay for an order, the necessary bank, business and payer details are shared with Paystack to set up settlement and process the payment. Card details are entered on Paystack’s hosted checkout; Kanti does not collect card security codes.

Authorised members of your business can access records according to their roles. Hosting and authentication providers, including Supabase and Vercel, process information needed to operate the service; Google is involved when you choose its sign-in option. We may disclose information where lawfully required or necessary to protect legal rights, subject to applicable safeguards.

If a merchant creates a customer status link, anyone who receives it can view the limited order details it exposes until it expires. For eligible unpaid orders, this includes any receiving bank name, account name and account number the business owner has chosen to publish. Treat these links as private. Kanti does not sell your personal data.

International processing and security

Service providers may process information outside Nigeria depending on hosting regions and their operations. International transfers must have a lawful basis and the safeguards required by Nigerian law. Accepting the terms or enabling analytics is not blanket consent to unrestricted overseas transfers. Contact the operator for details about applicable destinations and safeguards.

Access controls and business-level restrictions limit access to records. No system is entirely risk-free. Protect your sign-in email and devices, review team access, and report suspected incidents promptly.

Retention and deletion

Business records remain available while the business is active unless deleted through supported controls. Owners can delete a business and its associated operational records; the sign-in account remains until separately deleted. Technical logs, backups and records required for legal claims or legal obligations may follow different retention schedules. Retention should be limited to what is necessary for the relevant purpose. Contact the operator for the applicable schedule and a deletion review.

Your rights in Nigeria

Subject to applicable conditions and lawful exceptions, you can request information about processing, access, correction, erasure, restriction, or portability of your data; object to processing; and withdraw consent. You may also challenge solely automated decisions that have legal or similarly significant effects. Kanti’s business charts provide information for human decisions.

When making a request, identify the account or merchant involved and the action requested. Do not send passwords or sign-in codes. We may ask for proportionate information to verify identity and authority. You can lodge a complaint with the Nigeria Data Protection Commission without giving up any other available remedy.

Updates

We will update this notice when our data practices change and identify the current version. Where new processing requires consent, we will ask separately before beginning it.