Privacy Policy

This Privacy Policy explains how CREEDBOX TECHNOLOGIES LTD ("Creedbox", "we", "us", or "our") collects, uses, stores, and shares personal data when you use Zyncable (the "Service"), including our website at https://zyncable.com, related dashboards, and the Zyncable mobile application.

By accessing or using the Service, you acknowledge this Policy. If you do not agree, do not use the Service. This Policy should be read with our Terms of Service and Cookie Policy.

1. Who we are

Zyncable is operated by CREEDBOX TECHNOLOGIES LTD, a company registered in Nigeria (CAC RC 9677801), with registered office at NO 10 Ikot Okubo, Offot, Uyo, Akwa Ibom State, Nigeria.

For privacy requests, contact legals@creedbox.com.

2. Roles: employers, employees, and Creedbox

Zyncable is a multi-tenant human resources information system (HRIS). In most cases:

• The customer organisation (your employer or the company that subscribes) decides why and how employee HR data is processed in Zyncable. That organisation is typically the data controller (or equivalent under Nigerian data protection law).
• Creedbox provides the platform and processes personal data on the customer's instructions as a data processor (or equivalent), except where we process data for our own purposes (for example account administration, security, billing, and product improvement as described below).
• If you are an employee or invited user, your employer's policies and instructions also apply. Direct many HR data requests (corrections to employment records, access to personnel files) to your employer first.

3. Personal data we process

Depending on how the Service is used, we may process:

3.1 Account and organisation data

• Names, email addresses, phone numbers, and login identifiers
• Organisation profile details (company name, branding, settings, office locations)
• Roles, permissions, and membership within an organisation

3.2 Employee and HR records

• Employment details (staff ID, department, job role, grade, manager, work schedule, employment status)
• Biodata and related profile fields configured by the organisation (which may include contact, family, education, financial identifiers, or similar information). The organisation chooses which fields are collected and which employees may update via self-service or profile-update approval workflows.
• Documents uploaded to the Service (identity or HR documents as configured by the organisation)
• Leave requests, balances, approvals, relief assignments, and calendar data
• Payroll-related configuration and outputs the organisation chooses to process when payroll features are available and enabled in their workspace (for example pay groups, structures, runs, or payslips)
• Announcements, acknowledgements, and related engagement records
• In-app notifications and related activity metadata within the Service
• Administrative audit-trail metadata (for example who changed access, people, leave, or organisation settings, and when)

3.3 Mobile and device data

• Push notification device tokens and device metadata (for example platform, app version, device identifiers used for registration) when you grant OS notification permission
• Technical logs needed to operate and secure the mobile app and API

Features such as location-based services or biometric unlock (for example device Face ID / fingerprint) may be offered in the product experience. Where used, location or biometric data is processed only after you grant the relevant OS permission, and biometrics used for device unlock typically remain on your device unless we clearly state otherwise before collection.

3.4 Technical and usage data

• IP address, browser or device type, timestamps, and security/event logs
• Authenticated realtime connection metadata used to deliver in-app updates (for example refreshing notifications or announcements), using your session token—not a separate advertising tracker
• Product analytics on the website and web dashboards (for example event data, technical diagnostics, and identifiers such as user id or email when you are signed in) via PostHog, subject to our Cookie Policy and your consent choices for non-essential analytics cookies
• Cookies and similar technologies as described in our Cookie Policy

4. How we collect data

• Directly from you (registration, login, profile updates, support requests)
• From your organisation's administrators (employee onboarding, bulk imports, role assignment)
• Automatically through the Service (auth sessions, logs, realtime connections, analytics when permitted, push registration when permitted)
• From service providers that help us operate the Service (see Section 7)

5. Purposes and legal bases

We process personal data to provide, secure, and improve Zyncable, including to:

• Create and authenticate accounts and organisations
• Deliver HR workflows (employees, organisation structure, leave, documents, announcements, approvals, audit/admin controls, and payroll-related features the customer enables when available)
• Send transactional email (invites, verification, notifications)
• Deliver push notifications when you have granted OS permission and a device is registered
• Deliver realtime in-app updates over authenticated channels
• Analyse product usage and reliability (web analytics) to improve the Service, where required after you consent to analytics cookies
• Prevent abuse, debug incidents, and maintain security
• Comply with applicable law and enforce our terms
• Communicate about the Service (for example operational or product notices)

Under Nigerian data protection requirements, we rely on appropriate lawful bases such as performance of a contract, legitimate interests (for example securing the Service), legal obligation, and—where required—consent (for example certain optional device permissions, and non-essential analytics cookies on the website). Where we act as processor for a customer, the customer is responsible for ensuring it has a lawful basis to instruct us.

6. Push notifications

Push notifications depend on permission granted in your device operating system settings. We do not treat a database preference flag as the source of truth for that permission. If you grant permission, we may store a push token and related device metadata to deliver messages (for example leave or approval alerts). You can revoke permission at any time in your device settings; doing so may stop push delivery even if a token remains until it expires or is deactivated.

7. Sharing and processors

We do not sell personal data. We share data with service providers who process it on our behalf to run the Service, which may include:

• Supabase — authentication, database, and file storage
• Resend — transactional email delivery
• Expo / Firebase Cloud Messaging (FCM) — mobile push delivery infrastructure
• PostHog — product analytics on the website and web dashboards (when you allow analytics cookies)
• Hosting and infrastructure providers — cloud hosts used to serve https://zyncable.com and related APIs (which may include providers such as Render), and background job infrastructure used for certain asynchronous tasks (for example Inngest where enabled)

We may also disclose data if required by law, to protect rights and safety, or in connection with a corporate transaction (merger, acquisition, or asset sale), subject to appropriate safeguards.

Customer administrators within an organisation can access employee and operational data for that organisation according to roles they assign.

8. International transfers

Service providers may process data in countries other than Nigeria (for example analytics or hosting regions). Where personal data is transferred internationally, we take steps consistent with applicable Nigerian data protection requirements (including contractual and technical measures) to protect it.

9. Retention

We retain personal data for as long as needed to provide the Service to the customer organisation, comply with law, resolve disputes, and enforce agreements. When an organisation ends its subscription or requests deletion, we delete or anonymise data in accordance with our retention practices and any written agreement with that customer, unless a longer retention period is required by law.

10. Security

We implement technical and organisational measures designed to protect personal data, including access controls, encryption in transit where appropriate, and monitoring. No method of transmission or storage is completely secure; please use strong credentials and report suspected incidents promptly to legals@creedbox.com.

11. Your rights

Subject to applicable Nigerian data protection law, you may have rights to request access, correction, deletion, restriction, or objection to certain processing, and to lodge a complaint with the relevant supervisory authority (including the Nigeria Data Protection Commission / applicable NDPR framework, as updated from time to time).

Employees should generally contact their employer for HR record requests. You may also contact us at legals@creedbox.com. We may need to verify your identity and, where we act as processor, redirect or coordinate the request with the customer organisation.

For website cookie preferences, use Cookie settings in the footer or see our Cookie Policy.

12. Children

The Service is intended for workforce and organisational use by adults. It is not directed to children. We do not knowingly collect personal data from children for Zyncable.

13. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated through the Service or by email where appropriate. Continued use after an update constitutes acceptance of the revised Policy where permitted by law.

14. Contact

CREEDBOX TECHNOLOGIES LTD
CAC RC 9677801
NO 10 Ikot Okubo, Offot, Uyo, Akwa Ibom State, Nigeria
Email: legals@creedbox.com