Privacy Policy

We collect information you provide directly to us, such as when you create an account, use our services, or communicate with us. This includes:

We use your information to provide, maintain, and improve our services, including:

• Processing transactions and payments
• Providing customer support
• Sending important notifications about your account
• Analyzing usage patterns to improve our services
• Ensuring security and preventing fraud
• Complying with legal obligations

We do not sell your personal data. We may share your information with the following categories of recipients, only as necessary to provide our Services:

• Service Providers: Payment processors, cloud hosting (Railway, Vercel), email delivery (Resend), and analytics providers — all bound by data processing agreements
• Logistics Partners: Delivery companies receiving order fulfillment details (name, address, phone) for shipments
• Marketplace Participants: Buyers and sellers see each other's names and contact details for transactions they are party to
• Legal Authorities: When required by law, court order, or government regulation, including anti-fraud and AML investigations
• Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred as a business asset

We never share your data for advertising purposes with third-party ad networks.

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: Data is retained while your account is active and up to 90 days after deletion request
• Transaction Records: Financial transaction data is retained for 7 years per Liberian financial regulations
• Marketplace Listings: Product listings are retained for 1 year after removal for dispute resolution
• Communications: Support tickets and messages retained for 2 years
• Analytics Data: Aggregated, anonymized analytics retained indefinitely; individual-level data deleted after 26 months
• Security Logs: IP addresses and access logs retained for 1 year for fraud prevention

Annita LLC is headquartered in Liberia, but our cloud infrastructure and third-party service providers may process data in other countries, including the United States, European Union, and South Africa.

• We ensure all international transfers comply with applicable data protection laws
• For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) for data transfers to non-adequate countries
• For users in countries with data localization requirements, we work to store data within the required jurisdiction where technically feasible
• You acknowledge that by using our Services, your data may be processed in countries with different data protection standards than your country of residence

Our Services are not directed to children under 18 years of age. We do not knowingly collect personal information from children under 18.

• If you are a parent or guardian and believe your child has provided us with personal data, contact us immediately at privacy@an-nita.com
• We will take steps to delete such information and terminate the child's account
• We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation (GDPR) provisions regarding minors
• For users aged 13-17 in jurisdictions where parental consent is required, we seek verifiable parental consent before collecting personal data

Our iOS and Android applications request certain permissions to provide full functionality. Below is a detailed explanation of each permission and how we use it:

• Camera: Used only when you choose to take photos for product listings, profile pictures, or support tickets. We do not access your camera without your explicit action
• Photo Library: Used only when you choose to upload existing photos. We do not browse your photo library without your permission
• Location: Used for location-based features such as finding nearby sellers, delivery address auto-fill, and marketplace discovery. You can disable this at any time in your device settings
• Push Notifications: Used for order updates, payment confirmations, and important account alerts. You can customize notification preferences in app settings
• Storage: Used for offline-first caching so you can browse listings and manage orders without an internet connection
• Biometric (Face ID/Touch ID/Fingerprint): Used for optional secure login. Biometric data never leaves your device and is not stored on our servers

SDK Disclosures: Our apps integrate the following third-party SDKs: Firebase (analytics, crash reporting), Sentry (error tracking), and Resend (email delivery). Each SDK collects data in accordance with its own privacy policy.

We implement industry-standard security measures to protect your data:

• Encryption of data in transit and at rest
• Regular security audits and penetration testing
• Access controls and authentication systems
• Secure data storage with reputable cloud providers
• Compliance with GDPR and other privacy regulations

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify affected users within 72 hours of becoming aware of the breach, in accordance with GDPR Article 34
• Provide details of the breach, the likely consequences, and the measures we are taking to address it
• Notify the relevant data protection authorities where required by law
• Take immediate steps to contain the breach, investigate its cause, and prevent recurrence
• Provide ongoing updates as new information becomes available

Our incident response plan is tested quarterly, and all staff are trained on breach reporting procedures.

Under GDPR and other privacy regulations, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability
• Withdraw consent

To exercise any of these rights, contact us at privacy@an-nita.com. We will respond to your request within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal data we collect
• Right to Delete: Request deletion of your personal data (subject to legal exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt-out of the sale or sharing of your personal data (we do not sell your data)
• Right to Limit: Limit the use of sensitive personal information for secondary purposes
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Submit CCPA/CPRA requests to privacy@an-nita.com with the subject line "CCPA Request."

As a Liberia-headquartered company serving users across Africa, we are committed to complying with emerging African data protection frameworks:

• Nigeria (NDPA 2023): We comply with the Nigeria Data Protection Act for Nigerian users
• Kenya (Data Protection Act 2019): We register cross-border data processing as required for Kenyan users
• South Africa (POPIA): We comply with the Protection of Personal Information Act for South African users
• Ghana (Data Protection Act 2012): We register with the Ghana Data Protection Commission as a data controller
• AU Convention on Cyber Security: We align with the Malabo Convention principles for data protection
• Liberia: We comply with all applicable Liberian data and telecommunications regulations

We use cookies and similar tracking technologies (web beacons, pixels, SDKs) to operate and improve our Services. For detailed information about the specific cookies we use and how to manage them, please review our Cookie Policy.

• Essential Cookies: Required for authentication, security, and core functionality
• Analytics Cookies: Help us understand how users interact with our Services (anonymized)
• Preference Cookies: Remember your language, theme, and display settings
• Mobile SDKs: Firebase and Sentry SDKs collect device-level analytics and crash data

We do not use cookies for targeted advertising. You can control cookies through your browser settings or our cookie consent banner.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do:

• We will update the "Last Updated" date at the bottom of this page
• Material changes will be communicated via email or in-app notification at least 30 days before taking effect
• The previous version will be available upon request
• Continued use of our Services after changes take effect constitutes acceptance of the updated policy

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data infringes applicable laws.