Privacy Policy

1. Introduction

Hutstack Technology Limited (“Hutstack”, “we”, “our”, or “us”) provides a suite of operational software products — including Hutstack Work, Hutstack PMS, and Hutstack Dwell (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal and organisational data when you access or use any of our Services.

This policy applies regardless of whether you use a single product or multiple products, and regardless of your plan tier. By accessing or using any Hutstack Service, you acknowledge that you have read, understood, and agree to the practices described in this policy. If you do not agree, please discontinue use of the Services.

2. Products Covered by This Policy

This Privacy Policy governs data handling across all Hutstack products:

3. Information We Collect

We collect information in the following categories:

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain all Hutstack products and features you subscribe to
• Process transactions, generate invoices, and send payment confirmations
• Send technical notices, security alerts, product updates, and administrative messages
• Respond to support requests, questions, and feedback across all channels
• Analyse usage patterns to improve product design, performance, and reliability
• Send promotional and educational communications where you have consented to receive them
• Personalise your experience based on the products and features you use
• Detect, investigate, and prevent fraudulent transactions, abuse, and security incidents
• Comply with legal obligations and enforce our terms of service

5. Data Sharing & Disclosure

We do not sell, rent, or lease your personal data to third parties. We may share your information only in these limited circumstances:

• Service Providers: Trusted third-party vendors who help us operate the platform — cloud hosting, payment processing, email delivery, and analytics. Each provider is contractually bound to protect your data and use it solely for the purpose we specify.
• Business Transfers: In connection with a merger, acquisition, reorganisation, or sale of assets, your information may be transferred to the successor entity under the same protections.
• Legal Obligations: When required by applicable law, regulation, legal process, or enforceable governmental request, we may disclose relevant information.
• Protection of Rights: To protect the rights, property, or safety of Hutstack, our users, employees, or the public — including to prevent fraud, abuse, or security threats.
• With Your Consent: In any other scenario, we will ask for your explicit consent before sharing your information.

6. Data Security

We implement and maintain industry-standard technical and organisational safeguards to protect your data. These include AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls with least-privilege principles, multi-factor authentication, automated daily backups with tested recovery procedures, and immutable audit logging. Our infrastructure undergoes regular security assessments, vulnerability scanning, and annual independent penetration testing. While we invest heavily in these protections, no method of electronic storage or transmission is 100% secure. We strongly recommend that you enable two-factor authentication on your account, use a strong and unique password, and promptly report any suspected security issues to [email protected].

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you, including which products it relates to.
• Correction: Request that we correct inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations and active service commitments.
• Portability: Request your data in a structured, machine-readable format for transfer to another provider.
• Objection: Object to processing based on legitimate interests, including direct marketing. We will stop processing unless we demonstrate compelling legitimate grounds.
• Restriction: Request restricted processing while a dispute about accuracy or lawfulness is resolved.
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days and may ask you to verify your identity before processing your request.

8. Cookies & Tracking Technologies

We use cookies, local storage, and similar technologies to authenticate sessions, remember your preferences, understand how you navigate the platform, and improve our products. Cookies are small text files placed on your device. We use session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired) for authentication, security, preference storage, and product analytics. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of certain features. For analytics, we use privacy-respecting, first-party tooling wherever possible and do not deploy third-party advertising trackers within the authenticated product experience.

9. Data Retention

We retain personal data for as long as your account is active or as necessary to provide the Services you have subscribed to. Specific retention practices:

• Active accounts: data is retained for the lifetime of your account.
• Cancelled or expired accounts: your core data is retained for 90 days, during which you can export it or reactivate your account. After 90 days, it is permanently deleted from our systems.
• Backups: data may persist in encrypted backups for up to an additional 60 days before being fully purged.
• Legal holds: we may retain certain information beyond these periods when required by law, to resolve disputes, or to enforce our agreements.

You can export your data from each product at any time through the account settings or by contacting support.

10. International Data Transfers

Hutstack is based in Nigeria and our primary infrastructure is hosted in regions serving West Africa. If you access our Services from outside Nigeria, your data may be transferred to, stored, and processed in Nigeria or other jurisdictions where our service providers operate. We ensure that any such transfers are governed by appropriate safeguards — including standard contractual clauses, data processing agreements, and technical measures — to provide a level of protection consistent with this policy and applicable data protection laws.

11. Children's Privacy

Our Services are intended for business and professional use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected data from a child, we will promptly delete it. If you believe a child has provided us with personal information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, products, or legal obligations. When we make material changes, we will notify you by email (to the address associated with your account), through an in-app notice, or by updating the “Last Updated” date at the top of this page at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised policy. We encourage you to review this page periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, reach out: