Privacy Policy
Last updated: 2026-10-28
In short
- We collect what we need to run your account and your business records.
- We never sell your data.
- We share it only with the named service providers listed below.
- You can ask to see, correct or delete your data at any time.
1. Who we are
BizApp is provided by Cactus Tech Solutions, Blantyre, Malawi ("we", "us"). We are the data controller for your account information and for the technical and payment records described below. For the customer, supplier and staff information that a business enters into its own workspace, the business is the data controller and we process that information on its behalf. This policy should be read together with our Terms of Service.
This policy is governed by the laws of the Republic of Malawi, including the Data Protection Act, 2024.
2. What we collect
- Account details: your name, email address, optional phone number, a hashed password, and a record of the date and version of the Terms and Privacy Policy you accepted.
- Business details: the business name, address, phone, email and tax number you enter.
- Business records: products, sales, purchases, expenses, customers, suppliers and staff information you enter.
- Payment records: the payment reference, plan, amount, status and the phone number the payment came from. We do not see or store your mobile money PIN or bank credentials — those are held only by PayChangu.
- Technical details: IP address, browser type and request logs, kept for security and troubleshooting.
3. Why we are allowed to process it
Under the Data Protection Act, 2024, we process your information on the following legal bases:
- Contract: to create and run your account and business workspace (for example, showing your sales and reports).
- Legal obligation: to keep accounting and tax records as required by Malawian law.
- Legitimate interest: to secure the service and prevent fraud and abuse.
- Consent: for any optional communication you opt into. You can withdraw consent at any time.
5. Where your data is stored
Our hosting provider, Render, stores application and database data in the United States (Oregon). We take steps to make sure personal data transferred outside Malawi is protected as the Data Protection Act, 2024 requires.
6. Security
Each business's records are stored in a separate database area, and inside a business, access is controlled by each user's role. Traffic is encrypted in transit with HTTPS, and passwords are hashed. No system is perfectly secure; if we become aware of a breach that is likely to affect your rights, we will notify the Malawi Communications Regulatory Authority (MACRA), and you where the risk to you is high, within the time the Act requires (currently 72 hours).
7. How long we keep it
We keep your account information while your account is active, and for as long as required to meet legal and accounting obligations after your account closes. Once those obligations are met, we delete or anonymise the data. You can ask us to delete your account and data at any time, subject to legal retention requirements.
8. Your rights
Under the Data Protection Act, 2024, you have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased when we no longer need it;
- object to, or restrict, certain processing;
- receive your information in a portable format;
- complain to the Malawi Communications Regulatory Authority (MACRA).
To exercise any of these, email info@bizapp.app. We will respond within 30 days. You can also complain directly to the Malawi Communications Regulatory Authority (MACRA).
10. Children
BizApp is a business tool. It is not intended for anyone under 18.
11. Changes
We may update this policy. The date at the top shows the latest version. If we make a material change, we will ask you to accept the updated policy the next time you sign in.
12. Contact
Cactus Tech Solutions
Blantyre, Malawi
Email: info@bizapp.app