NexaTrackerNexaTracker

Legal

Privacy Policy

Last updated: September 27, 2026

NexaTracker is an inventory and operations platform for businesses in Ethiopia, built by Buna Labs. This policy explains what we collect when you use the web app or the mobile app, how we use it, and how you can have it removed.

Introduction

NexaTracker is an inventory and operations platform for businesses in Ethiopia, built by Buna Labs. This policy explains what information we collect when you use our web application (app.nexatracker.com) and mobile application (Android/iOS), how we use it, who we share it with, and your rights regarding your data. By using NexaTracker, you agree to the collection and use of information in accordance with this policy.

Information We Collect

We collect information in the following categories:

1. Account & Authentication Data

When you sign in with Google, we receive your name, email address, and profile picture from your Google account. We use this solely to create and secure your account, identify you in the app, and sync your data across web and mobile. We do not use Google sign-in data for advertising or share it with third parties.

2. Business Data You Provide

Inside the app, you enter and store business data — items, sales, purchases, accounts, inventory records, customer/supplier details, loan records, production orders, and related operational data. This data belongs to you. We store it to provide the service and sync it across your devices. We do not access it for any purpose other than operating the service and providing support.

3. Mobile App: Device Permissions

The NexaTracker mobile app requests the following permissions only when needed for specific features. You can grant or deny each permission individually in your device settings:

• Camera

To scan barcodes/QR codes, capture receipt photos, and take product images for inventory management. Images are uploaded to our secure servers only when you explicitly attach them to a record. We do not access your camera otherwise.

• Storage / Files (Photos, Media, Documents)

To export reports (PDF/Excel), import data from files, cache offline data, and save images you capture. We only access files you explicitly select. Your files remain private to your account.

• Location (Approximate)

Used only for: (a) auto-filling address fields when creating customers/suppliers; (b) warehouse/branch location tagging; (c) fraud prevention and security analytics. We do not track your precise location continuously. You can deny this permission without losing core functionality.

• Notifications

To deliver payment reminders, low-stock alerts, team activity updates, and critical system notifications via Firebase Cloud Messaging (FCM). This is optional — you can disable notifications in app settings or device settings at any time.

• Internet / Network Access

Required for all cloud sync, authentication, analytics, crash reporting, and real-time features. The app does not function offline without initial sync.

• Biometric / Face ID (Optional)

Used only for app lock (local authentication). Biometric data never leaves your device — it is handled entirely by the OS.

4. Mobile App: Automatic Analytics & Crash Data

Our mobile app uses Firebase Crashlytics and Firebase Analytics to monitor stability and usage. This automatically collects: (a) Crash reports — stack traces, device state, app version at time of crash (no personal/business data); (b) Performance data — app launch time, frame rates, network latency; (c) Engagement data — screen views, feature interactions, session duration; (d) Device info — model, OS version, app version, language, region. All data is encrypted in transit (TLS). Governed by Google's Privacy Policy: https://policies.google.com/privacy

5. Mobile App: Meta (Facebook) SDK — Install Attribution & Analytics

We integrate the Meta SDK for Android to measure advertising campaign effectiveness and enable "Direct Install" buttons on Meta platforms (Facebook, Instagram). The SDK automatically collects the following unless you opt out: (a) App Install — when you first open the app after installing from a Meta ad; (b) App Launch — each app open (debounced at 60 seconds); (c) In-App Purchase — transactions processed through Google Play Billing; (d) Advertising ID (AAID) — for attribution and analytics (disable in Android Settings → Google → Ads → "Opt out of Ads Personalization" or "Reset advertising ID"); (e) IP address (for approximate location), device model, OS version; (f) Direct Install button clicks from Facebook/Instagram. Data is shared with Meta Platforms, Inc. per their Privacy Policy: https://www.facebook.com/privacy/policy/

6. Mobile App: Google Play Billing (In-App Purchases)

If you make purchases in the mobile app (subscriptions, upgrades), Google Play Billing processes the transaction. We receive: purchase token, order ID, product ID, price, currency, timestamp, and status. We do NOT receive your payment method details (card, bank, carrier billing). Google's privacy practices apply: https://play.google.com/about/play-terms/

7. Mobile App: Push Notifications (Firebase Cloud Messaging)

If you enable notifications, we use Firebase Cloud Messaging (FCM). This generates an FCM registration token tied to your device/app instance. We use it only to send: payment due reminders, low-stock alerts, team activity updates, and critical system notifications. The FCM token is not linked to your personal identity beyond your account. You can disable notifications anytime in app settings or Android Settings → Apps → NexaTracker → Notifications. Governed by Google's Privacy Policy: https://policies.google.com/privacy

8. Mobile App: Offline Mode & Local Data Storage

The mobile app works offline using a local SQLite database (via Drift). Your business data is stored locally on your device and synced to our servers when online. You can clear local data by: (a) Logging out (clears cached auth); (b) Uninstalling the app (removes all local data); (c) Using 'Clear Cache' in Android Settings → Apps → NexaTracker. No cloud data is deleted by these actions.

How We Use Your Information

We use collected information only for: (1) Providing and maintaining the NexaTracker service (authentication, sync, core features); (2) Monitoring and analyzing usage trends to improve the app (via Firebase Analytics, Meta SDK); (3) Measuring advertising effectiveness and attribution (via Meta SDK); (4) Sending relevant notifications you opted into (via FCM); (5) Ensuring security, preventing fraud, and detecting unauthorized access; (6) Providing customer support and fixing problems; (7) Complying with legal obligations.

What We Never Do

We do not sell, rent, or trade your personal or business information. We do not use your Google user data for advertising. We do not share your business data with other customers. We do not use your images/media for any purpose other than the app functionality you selected them for. Google user data is never transferred to third parties except as described below.

Who We Share Data With

We share data only with the following categories of service providers, and only to operate the service on our behalf:

• Infrastructure & Hosting

Cloud hosting, database, and CDN providers (e.g., Firebase, Supabase, Vercel) — to run the web and mobile app backend.

• Analytics & Crash Reporting

Google (Firebase Crashlytics, Firebase Analytics) — for app stability and usage analytics. Meta Platforms, Inc. (Facebook SDK) — for install attribution and ad measurement. Data shared is limited to what each SDK automatically collects (see sections 4 and 5 above).

• Payment Processing

Google Play Billing — for in-app purchase processing. We never see your payment instrument details.

• Legal & Compliance

We may disclose information where required by law, regulation, or valid legal request.

How We Protect Your Data

All data is transmitted over encrypted HTTPS/TLS connections. Data at rest is stored on access-controlled servers with encryption. Access is limited to authorized personnel who need it to operate and support the service. We implement industry-standard security practices including regular backups, access logging, and vulnerability monitoring. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Data Retention & Deletion

We keep your account and business data for as long as your account is active. If you delete your account, we remove your personal information and business data from our servers within 30 days, except where we are required to retain records by law (e.g., financial records for tax compliance). Mobile app local data is removed when you uninstall the app or log out. Meta SDK attribution data is retained by Meta per their Data Policy (approx. 90 days for attribution, longer for aggregated analytics). Firebase data is retained per Google's retention policies. You can request deletion at any time by emailing us.

Your Choices & Rights

You have the following controls over your data:

• In the App

Review and edit your profile details; manage notification preferences; export your business data (PDF/Excel); delete your account (Settings → Account → Delete Account).

• Device-Level Controls

Revoke camera, storage, location, or notification permissions in device settings; opt out of Advertising ID (Android Settings → Google → Ads); disable FCM notifications; clear app cache/data.

• Google Account

Revoke NexaTracker's access to your Google account at any time from your Google Account permissions page (https://myaccount.google.com/permissions).

• Meta (Facebook) Data

Manage off-Facebook activity and ad preferences in your Facebook/Instagram Settings → Apps and Websites. Request data deletion via Meta's Data Deletion Callback: https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback

• Direct Request

Email us at hello@nexatracker.com with 'Delete My Data' or 'Privacy Request' in the subject. We will respond within 30 days and honor your request per applicable law (GDPR, CCPA, Ethiopia Data Protection Proclamation).

Children's Privacy

NexaTracker is a business tool for professional use and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it immediately.

International Data Transfers

Our servers and service providers may be located outside Ethiopia (e.g., US, EU). By using NexaTracker, you consent to the transfer of your data to these jurisdictions. We ensure appropriate safeguards (Standard Contractual Clauses, adequacy decisions) per applicable data protection laws.

Changes to This Policy

If we change this policy, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you in the app and/or via email. Continued use after changes constitutes acceptance.

Contact Us

Questions about this policy or a request to delete your data? Email us at hello@nexatracker.com or write to us at Bole Road, Addis Ababa, Ethiopia. Phone: +251 900 000 000.

Contact us

Questions about this policy or a request to delete your data? Email hello@nexatracker.com or write to us at Bole Road, Addis Ababa, Ethiopia.