Privacy policy
Last updated October 2026
Who is responsible for your data
Pinkapple handles two kinds of personal information, and the responsibility for each is different:
- Information our customers record about their own clients, members, patients, staff and suppliers belongs to that customer. The customer decides how it is used and is the data controller; Pinkapple processes it only on their instructions to provide the service
- Information about our customers’ users and the people who contact us, such as names, email addresses and phone numbers, is handled by Pinkapple as data controller under this policy
- Customers can request a Data Processing Agreement that sets out how we process personal data on their behalf
- If you are a member, patient or client of one of our customers, please contact that organisation first about your personal data; we will help them respond
Information we collect
We collect and process the following types of information to provide and improve our services:
- Company and business identification information provided during registration
- User account credentials, profile data and authentication records
- Financial transaction data including deposits, withdrawals and transfers
- Loan application, disbursement and collection information
- User activity logs and audit trails for security and compliance
- Device information, IP addresses and browser metadata
How we use your information
Your information is used strictly for the following purposes:
- Providing and maintaining core financial management services
- Processing transactions, loan disbursements and repayment tracking
- Generating financial reports, analytics and compliance documentation
- Account verification, multi-factor authentication and fraud prevention
- Communicating important updates about your account and services
- Improving platform performance, reliability and user experience
- Meeting legal, regulatory and audit requirements
Data security
We protect your data with measures that include:
- A separate database for each company, so your records are never mixed with another organisation’s
- Encryption of stored data on managed cloud infrastructure
- Role-based access controls with multi-level approval workflows
- Automated daily backups
- Audit trails that record changes to your data
- Ongoing review and improvement of our security controls
Where your data is processed
Pinkapple runs on managed cloud infrastructure, so your data may be stored and processed outside Uganda.
- We use established cloud providers with strong security for the data they host
- The security measures described in this policy apply wherever your data is processed
- Customers can ask us about hosting arrangements as part of a Data Processing Agreement
Data retention
We retain your data only as long as necessary for the purposes described in this policy:
- Active account data is retained for the duration of your service agreement
- Transaction records are retained per applicable financial regulations (typically 7 years)
- Audit logs are retained for a minimum of 5 years for compliance purposes
- Upon account closure, personal data is anonymized or deleted within 90 days
Your rights
As a user of Pinkapple, you have the following data protection rights:
- Right to access and obtain a copy of your personal data
- Right to rectification of inaccurate or incomplete information
- Right to erasure of your data (subject to legal retention requirements)
- Right to data portability in a structured, machine-readable format
- Right to restrict or object to certain types of data processing
- Right to withdraw consent at any time for consent-based processing
How to make a request
To use any of the rights above:
- Email info@statsolutionsnetwork.com with the subject “Data request” and tell us which right you want to use
- We may ask you to confirm your identity before acting on the request, to protect your data
- We respond without undue delay and within the time required by applicable law
- If your data is held for one of our customers, we pass your request to that organisation and support them in answering it
- If you are not satisfied with our response, you may complain to the data protection authority; in Uganda this is the Personal Data Protection Office
Third-party services
We may share limited data with trusted third-party providers for the following purposes:
- SMS and email notification delivery services
- Payment processing and banking integrations
- Cloud infrastructure and hosting providers
- We never sell your personal or financial data to any third party
Cookies and similar technologies
Our website keeps tracking to a minimum:
- We do not use cookies, advertising trackers or third-party analytics on this website
- We count visits ourselves: which pages and sections are viewed, which buttons are clicked and which videos are played, so we can improve the site
- These visit counts never store your IP address or name. A random code kept only for the open browser tab links one visit together, and a daily code we cannot reverse counts unique visitors per day
- If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your visit at all
- Visit counts are kept for up to 13 months and are never sold or shared
- Your browser’s local storage remembers essentials, such as your light or dark theme
- When you sign in to Pinkapple, your browser stores what is needed to keep you signed in securely
Changes to this policy and security reports
We keep this policy up to date and welcome reports that help us keep Pinkapple secure:
- We post any changes to this policy on this page and update the date at the top
- For significant changes, we notify our customers’ administrators in advance
- To report a security vulnerability, email info@statsolutionsnetwork.com with the subject “Security”, and please do not publish details until we have had a chance to fix it
- We investigate every report and keep the reporter informed of progress