Ngumba Desk — Privacy

DRAFT — to be reviewed by counsel in Nigeria (NDPA 2023) and Cameroon (Law 2024/017) before the first customer's books are held.

Nothing on this page is in force yet. Words in square brackets are placeholders to be filled in and confirmed.

The short version. Your scans never leave your phone. Your books live in the Desk only if you put them there, and you can take all of them out any time. The phone is free for ever, and holds nothing of yours on our side.

This page is about Ngumba Desk ("the Desk"), the books on a desk at app.ngumba.com that a business pays for. The phone app has its own page, and what it says stays true: the phone collects nothing.

What the Desk holds

When you start an office, or someone adds you to one, the Desk holds:

• You. Your email address — the name you sign in with; we send nothing to it unless email is switched on, and never call it checked unless a code sent to it came back — and the name you give.
• How you sign in. Your password, kept only as an Argon2id fingerprint — a slow, salted one-way hash; we cannot read your password back, and neither could anyone who copied the database. Your ten recovery codes, kept only as keyed fingerprints. If you add a passkey, its public half and a name like Chrome on a Mac: the private half never leaves your device, and nothing about your fingerprint or face ever reaches us.
• Your books. What your business keeps in the Desk: invoices, quotes, receipts and credit notes, customers, items and prices, stock (what came in, what was counted, what moved between branches), statements.
• Your paper. The business's name, address, contact, ways to be paid, tax and terms, and the pictures it prints on: logo, letterhead, footing and stamp.
• Your team. Who is in the business, with which role, and since when.
• The audit. Who did what, and when: issued a bill, took a payment, voided, added someone, changed the paper. Every time someone at Ngumba opened your books is in it too.
• Billing. Your account, your trial, and each payment you made to us — the amount, how it came and its reference.
• What keeps it working. Your sessions (a fingerprint of the cookie, never the cookie); invitation and new-password links (a fingerprint of the link, never the link); a count of wrong sign-in tries for each email and of requests from each address, to slow down guessing (keyed fingerprints, never the email or the address, forgotten after a day); and, if email is switched on, a record of sign-in codes asked for (a keyed fingerprint, never the code).

What the Desk does not hold:

• Scans. The Desk is built so a scan cannot reach it: the phone and the Desk share one list of what may travel, and scans are not on it. A phone backup brought into the Desk leaves its scans behind.
• Anything about how you use the desk beyond the audit: no analytics, no advertising identifiers, no tracking of any kind.

When someone opens a paper you shared. If you share an invoice by link, the person who opens it sees that one paper and nothing else. If they say I've paid or accept a quote, what they said is kept beside the bill, with their note. We keep a count of requests from their address, as above.

Where it is

On servers we rent from DigitalOcean, in [region — fra1 (Frankfurt) or lon1 (London), to confirm]. Each night a copy of the books, encrypted to a key that is not on those servers, goes to DigitalOcean Spaces in the same region. Copies are kept for [35] days, then expire.

How it is kept

• Each business's books are encrypted at rest with a key of their own. That key is itself locked by a master key that is kept apart from the database. A copy of the database on its own reads nothing.
• So that lists can be sorted and searched, a few things about each record are kept beside it unencrypted: its number, the customer's name, its dates, its total and currency, whether it is paid or voided, its branch and item. The rest of the record — every line, note, address and payment — is only in the encrypted part.
• The paper's pictures (logo, letterhead, footing, stamp) are stored as pictures. They are printed on everything you send, so they are not treated as secret.
• The nightly copies are encrypted before they leave the server, to a key held offline by Ngumba.
• Everything between your browser and the Desk travels encrypted (HTTPS).

This is not end-to-end encryption, and we do not say it is. The Desk reads your books so it can search them, add them up, draw your paper and show your team the same thing. If a sealed tier ever exists, it will be its own choice.

Who can read it

• Your team, by role. The owner sees everything and decides who is in. A manager runs the business without changing the team or the billing. A cashier works at the branches the owner gives them. An accountant reads, and changes nothing. Team members and accountants are free.
• Ngumba staff, only when needed, and you will see it. Staff can open a business's books to answer a question you asked or to fix something broken. Every time they do, it is written into your own audit and shown in Settings: "Ngumba support opened this business on 3 Nov." Other products hide this. We show it.
• Nobody else, except as the law requires. If an authority demands your books, we will tell you before we answer unless the law forbids it, and we will hand over no more than the demand names.

We do not sell your data, rent it, or use it to advertise to you or to your customers.

Your customers' details

The names, contacts and addresses of the people you bill are yours. You decide what goes on an invoice; we keep it for you and use it only to run your books. In the language of the law, for your customers' details you are the controller and Ngumba is the processor. The terms set this out as a data processing agreement.

Leaving, with everything

• Take everything out, any time. One button in Settings writes the whole business as the same backup zip the phone restores — every live record, with the business's details beside it. It works on a lapsed account too: a missed payment never locks you out of your own books.
• Closing your account. Tell us, or close it in Settings when that button exists [to build]. We will ask you to take everything out first. [30] days after closing, the books, the paper and the team are deleted from the Desk; the nightly copies holding them expire [35] days after that. The billing record of what you paid us is kept for as long as tax law requires [period, to confirm per country].
• Inside the Desk, nothing is deleted while you use it: a bill is voided, not erased, and the void shows. That is a promise about your books, not a reason to keep them after you have gone.

Your rights

You can ask to see what the Desk holds about you, to correct it, to take it with you (the backup above), to object to how it is used, and to have it deleted when you leave. Write to the address below; we answer within [30] days. You can also complain to the Nigeria Data Protection Commission or to [Cameroon's authority under Law 2024/017 — to name].

Who else touches it

The companies whose services the Desk runs on. Each sees only what its job needs. The Desk works without email; until email is switched on, no email provider receives anything.

We will tell account owners at least [30] days before adding a new one.

If something goes wrong

If your books are exposed to someone who should not have them, we will tell the regulator within 72 hours of finding out, and tell you without delay: what happened, what it touched, what we have done, and what you should do.

Changes

When this page changes, the owner of every office is told on their desk (and by email, if email is switched on) before the change takes effect, and the date at the top changes. A change that lets anyone read more of your books will always be your choice to accept, never a paragraph that appears.

Contact

Questions about this page, or a request about your data: office@ngumba.com. Data protection officer: [name — to appoint]. Ngumba is [legal entity, registration number and address — to confirm].

Last changed: [date].