Privacy and Data Protection at CoreStack

CoreStack may collect personal information that you provide directly, including your full name, business name, email address, phone number, project details, support messages, and any files or media you submit through forms, portals, or conversational channels.

We also collect operational and technical information generated by platform usage, such as session metadata, device and browser information, request logs, page navigation events, and service interaction timestamps for security monitoring, reliability, and product analytics.

There is an important distinction in this policy. For our own website, marketing and support, CoreStack is the data controller. For the records you and your staff enter into a CoreStack ERP tenant — your ledger, customers, suppliers, employees, stock and payroll — you are the controller and CoreStack acts as a processor on your instructions, under the terms of your service agreement.

That data is held in a tenant that is logically isolated from every other customer. We access it only to run the service, to resolve a support request you have raised, or where the law requires it. We do not sell it, we do not use it to train models for other customers, and we do not mine it for our own commercial purposes.

You can export your data at any time while your subscription is active, in a structured, machine-readable format. On termination we retain it for a wind-down window agreed in your contract so that you can complete an export, after which it is deleted from live systems and ages out of backups on the schedule described below.

We use personal information to deliver requested services, authenticate users, provide customer support, personalize product experiences, and communicate administrative, security, or contractual updates relevant to your account.

Where appropriate, we process usage patterns and system events in aggregated form to improve service quality, tune AI-assisted workflows, and develop safer automation features without using this data to identify individuals when aggregate reporting is sufficient.

KORA is our assistant. It answers questions on this website, and on WhatsApp it can quote insurance, build a website from a conversation, or handle a support request. When you message us on WhatsApp you are also using WhatsApp itself, so Meta processes that message under its own privacy policy before it reaches us. We hold what arrives.

We store the message content, your WhatsApp display name and phone number, timestamps and delivery status, and any files you send. The phone number is how we recognise you on the next message — without it the conversation restarts every time. If you are not already a customer, we create a lightweight profile keyed to that number so the thread holds together.

Conversations are handled by an automated agent, with a person able to read the thread and take over. Where the agent produces a quotation, a document or a website, it is working from what you told it: check the output before you rely on it. Automated replies are not professional, financial or legal advice.

You can stop at any time by replying STOP, or by asking for a human. To have a conversation deleted, message us or email the address at the end of this policy. Conversations are kept for two years so we can answer questions about what was agreed, unless you ask us to remove one sooner or the law requires us to keep it.

Depending on your jurisdiction, our lawful basis for processing may include performance of a contract, legitimate interests in operating and securing our services, legal compliance requirements, and consent where consent is required.

When consent is used as the legal basis, you may withdraw consent at any time, though certain services may be unavailable if processing is necessary for core functionality.

We use very few. There is no advertising network on this site and nothing here is shared with data brokers.

Two things are strictly necessary and are not optional: a session cookie set only when you sign in, which keeps you signed in and is inaccessible to scripts, and a small preference that remembers whether the admin sidebar is collapsed. Neither identifies you to anyone else and blocking them will break sign-in.

One thing is optional: a randomly generated identifier stored in your browser so we can count page visits and see which pages are useful. It is not created until you accept, nothing is sent before you accept, and declining removes it. There is no fallback tracking if you say no.

You are asked once, on your first visit. You can change your mind at any time using the Cookie settings link in the footer, which clears the identifier and asks again. Browser settings can also block all of it, at the cost of sign-in.

We do not sell personal data and we do not share it for anyone else’s advertising. We do use a small number of sub-processors to run the service, and they only receive what they need to perform their function.

Some sharing is a feature you have asked for rather than a disclosure. When you fiscalise an invoice, the invoice data goes to the Zambia Revenue Authority Smart Invoice service because that is the point. When you pay through mobile money, the transaction reaches the network operator. When you message us on WhatsApp, Meta carries the message. Each is doing a job you initiated.

We will disclose data where the law requires it — a court order, a tax authority request with proper basis, or a regulator acting within its powers. Where we are allowed to tell you, we will.

Accounting records have a legal life of their own. Where you use CoreStack ERP, ledger entries, invoices, payroll runs and tax filings are retained for the statutory period that applies in your market — in Zambia that is generally six years — because deleting them early would put you in breach, not protect you.

Everything else is kept only as long as it is useful: enquiry and support messages for two years, marketing contacts until you unsubscribe, and access logs for twelve months. When you close a tenant we delete live data after the wind-down window in your contract.

Backups are encrypted, taken daily, and restored on a schedule so we know they work rather than assuming it. Deleted data persists in backups until they age out, normally within thirty-five days. Data is encrypted in transit and at rest, access is role-based and logged, and staff access to a customer tenant requires a reason tied to a support request.

If a breach affects your personal data we will tell you and the relevant authority without undue delay, with what we know, what we are doing about it, and what you should do.

CoreStack is operated from Zambia and serves customers in Zambia and South Africa. Data is hosted with infrastructure providers whose facilities may sit outside those countries, and some sub-processors — messaging, email delivery, error monitoring — operate internationally.

Where data crosses a border we rely on the safeguards available to us: contractual protections with each provider, encryption in transit and at rest, and limiting what each provider receives to what its function requires. If you need your tenant pinned to a particular jurisdiction, raise it before onboarding and we will tell you plainly whether we can do it.

Subject to local law, you may have rights to access, correct, delete, restrict, object to certain processing, and request a portable copy of eligible personal information. You may also request details on how your information has been used.

To protect account security, we may verify your identity before processing rights requests. If a request cannot be fulfilled, we will provide an explanation consistent with legal requirements.

Our services are not directed to children, and we do not knowingly collect personal information from children below the age threshold defined by applicable law in your jurisdiction.

If you believe a child has provided personal information without appropriate authorization, contact us and we will take reasonable steps to investigate and remove that information where required.

We may revise this Privacy Policy to reflect legal, technical, or operational changes. When material updates occur, we will update the effective date and publish the revised version on this page.

Your continued use of the services after an update becomes effective indicates acceptance of the revised policy, unless local law requires additional notice or consent.

For privacy questions, rights requests, or data protection concerns, contact us at info@corestackpro.com. Include your account email, phone number, and request type so we can respond efficiently.

If your request concerns messaging records or WhatsApp interactions, provide the relevant phone number and approximate date range to help us locate records faster.