How Mutual Africa Pay handles your information

01 Who we are

Mutual Africa Pay is a business operating system built for African small and medium enterprises, covering invoicing, expense tracking, customer relationship management (CRM), payroll, a business marketplace, and MAP Circles, a professional network for MAP users.

Mutual Africa Pay, registered at 90 Rivonia Road, Sandton, Gauteng, South Africa, is the entity responsible for the information described in this policy — referred to here as "MAP," "we," "us," or "our."

Questions about this policy or your data can be sent to provacy@mutualafricapay.com.

02 Scope of this policy

This policy covers the MAP web app, mobile app, and any related services we operate under the MAP name. It applies to:

• Business owners and staff who create a MAP account.
• Team members added to a business's payroll or CRM by an account holder.
• Visitors who view public marketplace listings or Circles profiles.

It doesn't cover third-party websites or services you reach through links on MAP, including client sites linked from invoices or marketplace listings.

03 Information we collect

What we collect depends on which parts of MAP you use. Broadly, it falls into these categories:

3.1 Account & business information

Name, email address, phone number, business name, business registration or tax number (if provided), physical address, profile photo, and your password, stored in hashed form.

3.2 Invoicing & expense data

Invoices, receipts, and expense records you create; the names and payment details of your clients and vendors; and bank or mobile-money details used to collect payment through MAP.

3.3 CRM data

Contact details, notes, and pipeline or deal information for your customers and leads, as entered by you or your team.

3.4 Payroll data restricted access

Employee names, national ID or passport numbers, banking details, tax numbers, salary and leave records, and other HR information your business enters for payroll processing. This is among the most sensitive data on MAP and is scoped so only authorized users within your business can access it.

3.5 Marketplace data

Your business profile, listings, pricing, and any contact details you choose to publish so other MAP users can find and reach you.

3.6 MAP Circles data

Your professional profile, posts, connections, and messages within MAP Circles. Depending on your visibility settings, some of this is viewable by other members of the network.

3.7 Usage & device data

Log data, IP address, browser and device type, pages and features used, session timestamps, and crash or error reports.

3.8 Cookies & similar technologies

Session cookies to keep you signed in, and basic analytics to understand which features are used. You can control cookies through your browser settings; blocking session cookies will affect your ability to stay logged in.

04 How we use your information

• Provide and operate the invoicing, expense, CRM, payroll, marketplace, and Circles tools.
• Run payroll for your business and generate payslips and reports.
• Facilitate invoicing and payment collection between you and your clients.
• Power CRM features such as reminders, pipeline tracking, and reporting.
• Display your marketplace listing and Circles profile according to your visibility settings.
• Send service communications, such as security alerts, payment confirmations, and feature updates.
• Send marketing communications where permitted, with an option to opt out at any time.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Meet legal, tax, and financial recordkeeping obligations.
• Understand aggregated, de-identified usage patterns to improve MAP.

05 Our legal basis for processing

MAP serves businesses across multiple African countries, so more than one data protection law can apply to a given account — for example Zimbabwe's Cyber and Data Protection Act, South Africa's POPIA, Nigeria's NDPR, Kenya's Data Protection Act, or the EU/UK GDPR where relevant. Where a lawful basis is required, we rely on one or more of the following:

• Performance of a contract — running the MAP tools you've signed up to use.
• Legitimate interests — keeping the platform secure, preventing fraud, and improving the product.
• Legal obligation — meeting tax, financial, and employment recordkeeping requirements.
• Consent — for optional features and marketing communications, which you can withdraw at any time.

06 How we share information

• Within your business: team members you invite to payroll or CRM see data according to the roles and permissions you assign them.
• Publicly, if you choose: marketplace listings and Circles profiles are visible to other MAP users and, in some cases, visitors — because that's the point of those features.
• Service providers: infrastructure and database hosting (including Supabase and its underlying cloud providers), payment processors, and email or SMS delivery providers, all bound by confidentiality and data-processing terms.
• Legal and safety reasons: to comply with the law, respond to lawful requests, or protect the rights, safety, and security of MAP, our users, or the public.
• Business transfers: if MAP is involved in a merger, acquisition, or sale of assets, with notice to affected users.

We do not sell personal information to third parties for their own marketing purposes.

07 Storage & international transfers

Your data is stored with our infrastructure and database providers, which may process information in countries other than the one your business operates in. Where data crosses borders, we work with providers that maintain appropriate technical and organizational safeguards for that transfer.

08 Security

• Encryption in transit (TLS) and at rest, where supported by our infrastructure provider.
• Role-based access control, so payroll and CRM data is limited to authorized users within your business.
• Row-level security policies that prevent one business's data from being accessible to another.
• Access reviews and audit logging for sensitive actions, such as payroll changes.

No platform can guarantee perfect security. Keep your password confidential and let us know immediately at provacy@mutualafricapay.com if you suspect unauthorized access to your account.

09 Data retention

• Account and business data: retained while your account is active, and for a period afterward to meet legal and tax obligations.
• Financial records: typically retained in line with applicable tax law in your jurisdiction — commonly five to seven years, subject to your local requirements.
• Payroll data: retained according to the employment and tax recordkeeping laws that apply to your business.
• Marketing data: retained until you opt out.

We delete or anonymize data once retention obligations expire, unless a legal hold requires us to keep it longer.

10 Your rights and choices

Depending on where you're based, you may have the right to access a copy of your data, correct inaccurate information, request deletion, restrict or object to processing, request portability, and withdraw consent where processing relies on it. To exercise any of these, contact us at provacy@mutualafricapay.com.

Some data — such as financial records required for tax compliance — may need to be retained even after a deletion request, where the law requires it.

If you've entered data about your own employees or customers into payroll or CRM, MAP holds that information as a processor acting on your instructions. You're responsible for responding to data rights requests from your employees or customers about the information you've put into MAP; we'll support you in fulfilling them.

11 Children's privacy

MAP is a business platform intended for people 18 and older who own or work for a business. We don't knowingly collect information from children. If we learn that a child's data has been submitted — for example, mistakenly through CRM — we'll take steps to delete it.

12 Third-party links and services

Marketplace listings, payment processors, and other integrations may link to third-party websites or services with their own privacy practices. This policy doesn't cover those third parties, and we encourage you to review their policies separately.

13 Changes to this policy

We may update this policy as MAP's features evolve. Any update will be posted here with a new effective date, and where a change is material, we'll give additional notice — for example, in the app or by email.

14 Contact us