Privacy Policy

CodeXtra Technologies Ltd operates XtraKit. This policy covers our website, shared account service and connected business applications: XtraAuth, XtraKit, XtraPOS, XtraHR, XtraClock, XtraStore, XtraPay, XtraSupport and XtraLeads, together with their mobile apps, APIs and administration tools. It applies when you visit, register, use a connected feature or contact us. A product-specific notice or written agreement may give additional details.

We determine how account, billing, platform-security and our own support data are used. When a business uses XtraKit to manage its customers, employees, applicants, shoppers or social audiences, that business generally determines the purpose of that processing; we process the records to provide its selected services. Contact the relevant business about its own practices, and contact us for questions about our platform.

The information depends on the products and features you use. You may provide it directly, your business may upload it, or a connected service may return it after authorization.

• Account and business information: names, email addresses, phone numbers, business profiles, roles, invitations, verification information, account settings and authentication records.
• Business operations: products, stock movements, supplier and customer records, invoices, receipts, orders, sales, expenses, accounting entries and uploaded documents.
• Workforce information: employee and applicant details, employment records, payroll and payslip information, leave, attendance and device or location information supplied with clock-in records. Your employer decides which workforce features to use.
• Commerce and payments: shopper contact and delivery information, order details, transaction references, wallet ledgers, settlement or payout details, and identity or business-verification documents where required for a payment feature. Payment providers collect the payment credentials needed for their checkout or processing services.
• Support: ticket and chat content, attachments, feedback, visitor identifiers, pages visited through an enabled support widget, and technical information used to troubleshoot requests.
• Social tools: connected Page, profile and channel identifiers, authorized access tokens, posts, engagement counts, comments and conversations made available by the network, and lead records or outcomes you choose to capture.
• Technical records: IP addresses, browser and device information, access and error logs, usage events, push-notification identifiers, and cookie or browser-storage values described in our Cookie Policy.

We use information to create and secure accounts, share authorized sign-in across XtraKit apps, apply business and team permissions, and provide the workflows you request. We also use it to process subscriptions and SMS purchases, reconcile payment and settlement records, deliver notifications, support users, investigate misuse and improve product reliability.

Our grounds for processing depend on the circumstances and applicable law: providing requested services or performing a contract, complying with legal obligations, consent where required, and legitimate purposes such as security and service improvement where these do not override your rights. Providing a phone number or connecting a social profile does not authorize unrelated marketing.

Business owners must establish a lawful basis for the personal information they upload and the messages they send. They must give appropriate notices and honor applicable consent and opt-out requirements. We do not authorize unsolicited outreach merely because a contact can be recorded in XtraLeads or imported into CRM.

XtraLeads uses the platform's shared integrations. A business authorizes the profiles it manages through the network's connection flow; it does not need to give us its personal social password. Access depends on network permissions, approval, availability and the features implemented in XtraLeads. TikTok is marked Coming soon and is not an active connection.

Disconnecting a profile stops future use of that connection in XtraLeads. You can also revoke permissions in the network's settings. Disconnecting alone does not erase records already created in your business workspace or content already published to the network; request deletion or use the relevant product controls where available.

When a user chooses to analyze selected Facebook Page posts, XtraLeads sends selected post text, identifiers, publication times, aggregate engagement and aggregate recorded lead outcomes to the configured Anthropic service. This analysis excludes private conversations and customer names. Its suggestions may be inaccurate and do not prove sales attribution.

An enabled XtraSupport AI assistant can send the chat history needed to answer a conversation to Anthropic. Do not include passwords, payment secrets or unnecessary sensitive information in a chat. AI processing is feature-specific; the limits stated for social-post analysis do not imply that support-chat content is excluded from support AI.

Review AI output before acting on it. Provider processing and retention are governed by the applicable service configuration and provider agreement; this policy does not promise zero provider retention or make an unverified claim about model training.

Authorized members of your business can access records according to their permissions. Relevant details are shared with shoppers, invoice recipients, employees, counterparties or social networks when you choose a workflow that requires them. Public links, storefront pages and published posts can be viewed by their intended or public audience; check what you share.

We use service providers for infrastructure, hosting, file storage, payment processing, identity checks, email or SMS delivery, analytics, push notifications and enabled AI features. Examples present in our applications include Paystack and other configured payment providers, TextCus, PostHog, OneSignal, Anthropic, Meta, LinkedIn and Telegram. The providers involved depend on your product and configuration. Independent payment and social providers may process information under their own policies.

We may disclose necessary information for a lawful request, to protect rights or investigate fraud, or as part of a business transfer subject to appropriate safeguards. We do not give business users a right to sell or reuse another business's data. Cross-app sign-in does not mean that every member can access every workspace.

Records are processed in the databases, storage services and infrastructure used to operate the platform and its connected features. Browser and mobile apps may also keep preferences, session information or cached records locally. Service providers can process information outside Ghana; the location depends on the provider and configuration.

We use access controls and other technical and organizational measures appropriate to the service. No network or storage system is completely secure. Keep devices and sign-in credentials protected, restrict team access and report suspected unauthorized access promptly. We handle security incidents and required notifications under applicable law.

Where international-transfer or contractual safeguards are required by applicable law, they must apply to the relevant processing. Contact us for information about a particular integration or processing arrangement; this notice is not a certification of every provider's practices.

We retain personal information for the period needed to deliver the selected services, manage the business relationship, resolve disputes, maintain security and meet applicable accounting, payment and legal obligations. The necessary period varies by record and product. A business's own legal duties may require it to keep copies of invoices, payroll or employment records.

Account closure, connection revocation and record deletion are different actions. Some transaction, audit or security records may need to remain after closure, and provider records may follow their own retention rules. Backup copies can persist until their normal replacement or deletion cycle. We do not promise that every record disappears immediately when a user disconnects an app.

Request the retention information applicable to your record or ask for deletion at info@xtrakit.com. We will explain any applicable restriction rather than applying an invented universal deadline.

Depending on applicable law, you can request access to your personal information, correction, deletion where permitted, restriction or objection to processing, and withdrawal of consent for processing based on consent. You can object to direct marketing. Withdrawal does not affect lawful processing already carried out, and some information is required to provide a requested service or meet a legal obligation.

Use the available account, notification, export and integration controls, revoke network permissions, or contact info@xtrakit.com. We may ask for proportionate verification to protect the account. If we process information for your employer or another business, we may refer the request to that business or assist it in responding. You can raise an unresolved data-protection concern with Ghana's Data Protection Commission or another competent authority.

Business administration accounts are intended for people who can lawfully enter the relevant agreement. Our platform is not intended for children to create independent business accounts. An organization that records information about minors, such as a school, must have the required authority and appropriate safeguards.

We update this policy when our products or processing change and identify the update date here. Where a change requires a further notice or consent, we will use the appropriate channel. Contact CodeXtra Technologies Ltd at info@xtrakit.com or +233 30 298 1736 for privacy questions. Do not send passwords, tokens or full payment credentials.