Privacy and data control

Privacy Policy

Effective August 29, 2026. This policy covers IGFirstERP's web, iPhone, support, integration, and assisted-service channels.

1. Information we collect

• Names, usernames, email addresses, phone numbers, roles, business details, and account-verification records.
• Business records entered into IGFirstERP, including inventory, sales, purchases, expenses, contacts, documents, staff actions, and audit trails.
• Subscription references and lifecycle information supplied by Apple, Google Play, Paystack, banks, or other payment providers. IGFirstERP does not need to store your full payment-card number.
• Records from integrations enabled by the business, plus device, diagnostic, security, usage, and support information.

2. Why we use information

We use information to provide and secure the service, authenticate users, preserve one controlled operational record, deliver reports and integrations, verify subscription access, reconcile provider events, prevent duplicate entitlements, respond to support, improve reliability, and meet legal, tax, security, and audit obligations.

3. Processors and disclosures

We do not sell personal data. We disclose only the information reasonably needed by cloud hosting and storage, email and messaging, monitoring and security, customer support, approved AI processing, store billing, payment, integration, and professional-service providers, or where the law requires disclosure.

4. Cortex and AI processing

Some Cortex workflows may send the minimum authorized records or files needed for an analysis to an approved AI processor. The business instructs IGFirstERP to perform that processing under this policy. Access controls still apply, evidence is treated as supporting material until validated, and AI output does not by itself make disciplinary findings.

Provider working files and isolated analysis environments may be retained for up to 30 days. Secured case files and audit receipts follow the business's normal record-retention obligations.

5. International processing

Some processors may handle data outside Nigeria. We use contractual, access, security, and vendor controls appropriate to the service and applicable data-protection law.

6. Retention and deletion

Account and operational information is normally retained while the service is active. After a verified deletion or termination request, eligible data is deleted or de-identified according to the request, backup cycle, contract, and law. Tax, accounting, security, fraud-prevention, dispute, and operational audit records may be retained where required, with identity minimized where appropriate.

7. Store billing

Apple or Google may process store purchases under their own policies. IGFirstERP receives the product, transaction identifiers, storefront, renewal dates, subscription state, and related lifecycle data needed to verify access. Deleting IGFirstERP data does not automatically cancel a store subscription.

8. Your rights

Subject to applicable law, you may request access, correction, portability, restriction, objection, or deletion of eligible personal data. Staff may request deletion of their login and eligible personal data. A verified owner may request deletion of an entire business account. Start at the account deletion page.

9. Security, children, and changes

We apply reasonable technical and organizational safeguards, although no system is risk-free. IGFirstERP is a business service and is not directed to children. Material policy changes will carry a new effective date and may also be communicated through the service.

10. Contact

Contact [email protected] for privacy requests or complaints. You may also contact the appropriate data-protection authority.