Privacy Policy

ManuTrack (“we”, “us”, “our”) is operated by Alex Mensah Tenkorang, trading as ManuTrack, based in Accra, Ghana.

Contact: privacy@manutrack.app

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use ManuTrack — our cloud-native manufacturing product tracking platform — accessible at manutrack.app.

We are committed to privacy standards consistent with the Ghana Data Protection Act, 2012 (Act 843), Nigeria's NDPR (2019), and the EU General Data Protection Regulation (GDPR) where applicable. By creating an account or using ManuTrack, you agree to the practices described in this Policy.

1. Who this policy applies to

This policy applies to:

• Organisation administrators and users — individuals who create an account and use ManuTrack on behalf of their manufacturing organisation.
• Team members — individuals added to a ManuTrack organisation by their employer or manager.
• Visitors — people who visit the ManuTrack website without creating an account.
• Buyers and end users — individuals who scan a ManuTrack QR code and visit the public product verification page (/verify/[serial]).

It does not apply to the employees of organisations that use ManuTrack unless those individuals also have a user account on the platform.

2. Data we collect

2.1 Account and organisation data

When you sign up or set up an organisation on ManuTrack, we collect:

• Full name and email address
• Company name, industry, and location
• Phone number (optional)
• Organisation logo and brand colour (if uploaded)
• Payment information — processed by Paystack. We store only your subscription plan, billing status, and Paystack transaction reference. We never store card numbers or bank account details.

2.2 Platform usage data

When you use the ManuTrack dashboard, we store the data you enter to operate the platform: product and batch records, QC results, inventory levels, dispatch records, uploaded documents, and shift and operator data. This operational data belongs to your organisation. We process it on your behalf as a data processor. You remain the data controller for this data.

2.3 QR scan data

When a product QR code is scanned, we automatically collect the IP address, user agent, approximate location (country/city derived from IP), and date/time. We use this to detect counterfeit activity and provide scan analytics to the manufacturer. We do not identify individual scanners — all QR scan data is anonymous.

2.4 Technical and usage data

Log data (pages visited, features used, errors), browser type, device type, OS, time zone, and referring URL. Used to operate, maintain, and improve the platform.

2.5 Communications data

If you contact us by email, WhatsApp, or the contact form, we retain those communications to respond to your enquiry and improve support.

2.6 AI-processed data

Some features use the Anthropic Claude API (defect classification, compliance report drafting, daily digest). When we call the Anthropic API, relevant data is sent to Anthropic for processing. We do not use your data to train AI models. See anthropic.com/privacy for Anthropic's own policy.

3. How we use your data

• Operate and provide the platform — processing your data, generating QR codes, running analytics, and delivering all features.
• Process payments — initiating and verifying Paystack transactions, managing subscriptions, and sending billing notifications.
• Send transactional emails — welcome emails, trial notices, payment confirmations, daily digests, and alerts. Sent via Resend.
• Provide customer support — responding to requests and resolving issues.
• Improve the platform — analysing aggregated, anonymised usage patterns. We do not use your manufacturing data for this purpose.
• Comply with legal obligations — if required by applicable law or a lawful order.

We will not use your data for purposes beyond those listed above without your explicit consent.

4. Who we share your data with

Service providers

• Clerk (clerk.com) — authentication and user management
• Railway (railway.app) — PostgreSQL database hosting
• Cloudinary (cloudinary.com) — file and image storage
• Resend (resend.com) — transactional email delivery
• Paystack (paystack.com) — payment processing
• Vercel (vercel.com) — platform hosting and deployment
• Anthropic (anthropic.com) — AI processing for applicable features

All service providers are bound by data processing agreements and are required to process data only on our instructions.

QR CODED GH

If you use QR CODED GH (qrcodedgh.com) as your label printing partner, batch data required to print labels may be shared with QR CODED GH. This sharing is initiated by you and is subject to QR CODED GH's own privacy policy.

Legal and regulatory disclosures

We may disclose data if required by applicable law, a court order, or a regulatory authority in any jurisdiction where we or you operate.

Business transfers

If ManuTrack is acquired or merged, your data may be transferred as part of that transaction. We will notify affected users in advance.

5. International data transfers

ManuTrack serves users across Africa and beyond. Our service providers (listed in §4) may process data in the United States, European Union, and other jurisdictions. We ensure that any international transfer is subject to appropriate safeguards — including standard contractual clauses — consistent with applicable data protection law.

6. Data retention

• Account and organisation data: retained for the duration of your active subscription, plus 90 days after account closure for re-activation or data export.
• Operational platform data (batches, products, QC records): same as above. Export available at any time from the platform.
• QR scan logs: 24 months from the date of scan.
• Payment records: 7 years, in compliance with applicable tax and accounting regulations.
• Support communications: 2 years.

After the applicable retention period, data is permanently deleted from our systems and those of our service providers.

7. Data security

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Database access is restricted to authorised systems only, with no direct public exposure.
• Authentication is handled by Clerk with industry-standard security and MFA options.
• File storage uses Cloudinary's access-controlled infrastructure.
• Our systems are hosted on Vercel and Railway, both of which maintain SOC 2 compliance.

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@manutrack.app.

8. Your privacy rights

Depending on where you are based, you have rights under applicable data protection law. These include:

• Right of access — request a copy of the personal data we hold about you.
• Right of correction — request that inaccurate personal data be corrected.
• Right to object — object to processing of your personal data in certain circumstances.
• Right to erasure — request deletion of your personal data, subject to legal retention obligations.
• Right to data portability — export your operational platform data (batches, products, QC records) as CSV at any time from within the dashboard. No formal request needed.
• Right to restrict processing — request that we limit how we use your data while a dispute is resolved.

These rights apply under the Ghana Data Protection Act 2012 (Act 843), Nigeria's NDPR, the EU/UK GDPR, Kenya's Data Protection Act 2019, and equivalent legislation in other African countries — as applicable to your location.

To exercise any of these rights, contact: privacy@manutrack.app. We will respond within 21 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In Ghana: dataprotection.org.gh.

9. Cookies

Strictly necessary

Session cookies used by Clerk to maintain your login state. Required for the platform to function — cannot be disabled.

Analytics

Vercel Analytics uses anonymous, cookie-free analytics. No personally identifiable information is collected through this service.

We do not use advertising cookies or third-party tracking cookies. You will not see a cookie consent banner because we do not use cookies that require consent under applicable law.

10. Children's privacy

ManuTrack is a business-to-business platform intended for adults (18 years and over) acting on behalf of manufacturing organisations. We do not knowingly collect personal data from anyone under the age of 18.

11. Changes to this policy

When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Send a notification email to all account holders
• Display an in-app notice for 30 days after the change

Your continued use of ManuTrack after a policy update constitutes acceptance of the updated policy.

12. Contact