Privacy Policy

UbiniOS is operated by ConfluenceBits (“we”, “us”). This policy explains what personal data we collect, why, how we protect it and what choices you have. It covers this website (https://ubinios.com), the free tools on it, and the UbiniOS platform.

We follow the principles of the Nigeria Data Protection Act 2023 (NDPA): we collect only what we need, tell you what we do with it, protect it, and keep it no longer than necessary. Questions and requests go to support@confluencebits.com.

For this website and your account, we are the data controller. This covers the details you give us to open an account, sign in, pay and contact support.

For the records your business enters into the platform (employees, customers, suppliers, sales, payroll, accounting), your business is the data controller and we are its data processor. We process that data only to provide the service and on your business’s instructions. If you are an employee or customer of a business that uses UbiniOS, that business decides how your data is used; we will forward any request you send us to them.

Website visitors. We do not run analytics or advertising trackers on this site. Our hosting provider keeps standard server logs (IP address, browser, pages requested) for security and to keep the site running. The demo and early-access forms open an email in your own mail client; nothing is sent to us until you choose to send it.

Free tools. The PAYE calculator and invoice generator run entirely in your browser. The invoice generator saves your draft, including any logo you add, in your browser’s local storage so it survives a refresh. That draft never leaves your device, and you can clear it with the tool’s reset button.

Account holders. Name, work email, phone number, business name and profile, password (stored only as a salted hash), optional two-factor secrets, sign-in and activity logs, billing history and a payment-provider token for your card. We never see or store your full card number.

Data your business enters into the platform, which may include:

• employee identity and contact details, next of kin, emergency contacts and dependants;
• statutory identifiers (NIN, BVN, TIN), bank account details, pension and tax registrations, all stored encrypted at field level;
• salary, payroll, leave, attendance and performance records, including clock-in location when your business enables geofenced attendance;
• customer and supplier contact details, sales, stock and accounting entries;
• documents your business uploads, such as ID copies and payslips.

• To provide the service: running your Business, calculating payroll, generating payslips and invoices, sending the notifications you configure.
• To run your account: sign-in, security alerts, billing and receipts, support.
• To keep the platform safe: fraud prevention, access logs, audit trails and incident response.
• To improve the product: aggregated, non-identifying usage figures.
• To meet legal obligations: tax and accounting records, lawful requests from authorities.

Our legal bases under the NDPA are performance of our contract with you, our legitimate interest in running a secure service, compliance with law, and consent where we ask for it (for example WhatsApp notifications). We do not sell personal data and we do not use it for advertising.

We share data only with providers that help us run the service, each bound by contract to use it solely for that purpose:

We may also disclose data where the law requires it, to protect our rights or safety, or as part of a merger or sale of the business, in which case the new owner takes on this policy.

The platform is hosted on managed cloud infrastructure in London, United Kingdom, a jurisdiction with data-protection law comparable to the NDPA. Data therefore leaves Nigeria for hosting. We protect it in transit with TLS and at rest with encryption, and our hosting contracts require the same level of protection this policy describes.

• All traffic is encrypted with TLS; statutory identifiers and bank account numbers are additionally encrypted at field level with keys kept separate from the database.
• Every record is scoped to one Business, and access within it is governed by roles and permissions that your administrators control.
• Two-factor authentication is available for every user, and changes to sensitive fields such as bank details can require a second approver.
• Append-only audit logs record who changed what and when; sensitive values are never written to logs.
• Data is backed up regularly. If a breach affecting your data occurs, we will notify you and the regulator within the timeframes the NDPA requires.

We keep account and Customer Data for as long as your subscription is active. After cancellation we keep it for 90 days so you can reactivate or request a copy, then delete it from live systems. Backups roll off on their own schedule after that.

Some records must be kept longer by law, such as invoices, payroll and tax filings, which we retain for the statutory period. Server logs are kept for a short period for security.

Under the NDPA you can ask to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct data that is inaccurate or incomplete;
• delete your data, where we have no legal duty to keep it;
• restrict or object to processing based on legitimate interest;
• withdraw consent where processing relies on it, for example WhatsApp notifications.

Email support@confluencebits.com. We will confirm your identity and respond within 30 days. If your data was entered by a business that uses UbiniOS, we will pass your request to that business and help them fulfil it. You also have the right to complain to the Nigeria Data Protection Commission (NDPC).

This website sets no tracking cookies. It uses browser local storage for two things only:

• ubinios.cookie-consent: remembers the choice you make in the cookie banner.
• ubinios:invoice-generator:draft: your invoice-generator draft, stored on your device only.

If we add analytics in future it will run only after you choose “Allow analytics” in the banner. You can change your choice at any time using the “Cookie preferences” link in the footer, or by clearing site data in your browser. The platform itself uses strictly necessary session cookies to keep you signed in.

UbiniOS is a business tool and is not directed at anyone under 18. Businesses may record dependants of employees for benefits purposes; that data is used only for that purpose.

We will post any changes here and update the date at the top. For material changes we will also email account owners. The current version is always at https://ubinios.com/privacy. See also our Terms & Conditions.