Privacy Policy

Mosiflow, Bujumbura, Burundi, is the controller of personal data on our website and for account and billing data. For the customer, sales and stock data you enter into MosiShop, you are the controller and we act as your processor. Contact: privacy@mosiflow.com.

• Account data: name, email, phone, business name, country, role and login credentials (passwords are stored hashed; PINs stay protected on the device).
• Business data you enter: products, prices, stock, sales, purchases, expenses, staff and customer records.
• Billing data: plan, add-ons, payment status and references. Card details are collected by Paddle, not by us. For mobile money we receive the payment reference, amount and the payer's phone number.
• Device and usage data: device identifiers for trusted devices, app version, error logs and basic analytics.
• Messages: what you send us through contact, support and demo forms.

• to provide, sync and secure the Service, including offline sync and trusted-device login;
• to bill you, activate plans and prevent payment fraud;
• to give support and send service messages such as receipts and security alerts;
• to improve the product and fix errors;
• to send product news, only where allowed, with an unsubscribe in every email;
• to meet legal and tax obligations.

Card payments are handled by Paddle.com Market Limited, our Merchant of Record. Paddle receives your name, email, billing country, payment details and order information to take payment, calculate tax, prevent fraud and issue invoices. Paddle acts as an independent controller for that data under its privacy policy. We receive from Paddle only what we need to manage your subscription: order and subscription status, plan, amount, currency and a customer reference.

Mobile money payments are confirmed through your operator's payment message to our merchant account. See our Payments & Refund Policy.

We do not sell personal data. We share it only with:

• payment providers: Paddle, and mobile money operators for confirmation;
• infrastructure and service providers that host the Service, send email and provide authentication and error monitoring, under contracts that limit their use of the data;
• AI model providers, when you use the AI assistant, with business names and personal identifiers pseudonymized and without retention for training;
• authorities, when the law requires it.

Data is encrypted in transit; each business is isolated from others; access is role-based; sensitive actions are logged; and staff devices can be locked with a PIN and revoked. No system is perfectly secure. If a breach affects you we will tell you without undue delay.

We keep account and business data while your account is active. After deletion or end of service we remove it within a reasonable period, except records we must keep for tax, accounting or dispute purposes, and backups that expire on a fixed cycle.

Our providers may process data in other countries. Where required, we rely on contractual safeguards for such transfers.

We use essential cookies to keep you signed in and remember preferences, and analytics cookies to understand how the site is used. You can block cookies in your browser; some features may not work without the essential ones.

You can ask to access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. Email privacy@mosiflow.com; we reply within 30 days. If you are a customer of a MosiShop merchant, contact that merchant first, as they control your sales records. You may also complain to your local data-protection authority.

The Service is for businesses and is not directed to children under 16.

We will post updates here and change the date shown on this page; for material changes we will also notify you. Contact: privacy@mosiflow.com or dpo@mosiflow.com.