Privacy & cookie policy

1. Who we are

The service is operated by Andystrategy (“we”, “us”). We are the controller of the personal information described in this policy, except where section 9 says otherwise.

You can reach us about anything in this policy at [email protected], and we will respond. Our registered company details are available on request.

2. The information we handle

Account and sign-in details

Your name or username, your work email address, a hashed password, your role, and the organisation you belong to. If you sign in with Google, we receive your name and email address from Google — never your password.

Organisation and workforce information

Where an organisation uses Andystrategy, its workspace holds information about its people and their work: employee names, job titles, grades, departments and locations; objectives, measures, targets and results; appraisal and review notes and scores; and any evidence files attached to them. Almost all of this is entered by the organisation itself, not by us. See section 9.

Public portal contributions

If you use the public portal we hold the account you create (email address, optional phone number, display name, and the area you follow), and whatever you submit — reports, feedback, comments, photographs or documents, and the location text you provide. We also store a one-way fingerprint derived from technical details of a submission, used to detect abuse; it cannot identify you on its own.

Organisation claims

If you claim an organisation's profile we hold your name, job title, department, employment type, staff identifier, official email address, optional phone number and manager details, your written authority statement, any supporting document you upload, and which verification methods you offered.

Payments

Paid plans are processed by Paystack, and optionally PayPal. They receive the payment details you give them and the billing information needed to take the payment. We do not receive or store your card number.

Technical and usage information

Like most services, our servers record the requests made to them, which includes IP addresses, browser and device information, the pages requested and the time. With your consent we also collect how the site is used through Google Analytics 4 — see section 3.

Live chat

The chat button is provided by Tawk.to, and it loads on every page of the service. Even if you never open a conversation, Tawk.to records the visit — the pages you view, your IP address and the approximate location derived from it, and your browser and device details — so an agent can see who is on the site and offer help. If you do start a conversation, we receive what you write, along with your name and email address if you give them. Section 3 lists the cookies this sets, and section 5 says who processes it.

3. Cookies and analytics

A cookie is a small file a site asks your browser to store. We use four things:

Name	What it is for	When it is set
PHPSESSID	Keeps you signed in and remembers your session as you move between pages. The application cannot work without it.	Always — essential
_ga _ga_*	Google Analytics 4 (G-NSJD3ETNQQ): counts visits and tells us which campaigns brought people here.	Only if you accept
andy-consent browser storage, not a cookie	Remembers the choice you made about the cookies above, so you are not asked again.	When you choose
__tawkuuid ss TawkConnectionTime set by the chat widget	Keeps a chat conversation going as you move between pages, and recognises a returning visitor so an agent does not start from nothing. Set by the live-chat widget, which loads on every page.	Always, when the page loads

Analytics only runs with your consent. The analytics tag is loaded in a mode that denies storage until you choose, so declining genuinely stops it rather than only hiding a banner — and we also suppress the advertising click identifiers that would otherwise accompany the request. When consent is denied, Google may still receive a limited, cookieless signal that a visit happened, which it uses to model traffic without identifying you; no cookies are set and nothing is stored on your device.

The chat widget is not controlled by that choice. It loads on every page, so the help button is there when somebody needs it, and it sets the cookies in the table above whenever it does — including when you decline analytics, and before you open a conversation. Tawk.to explains what it does with the information in its own privacy policy.

You can change your mind at any time using the Cookie settings link in the footer of any page.

This site also serves its typefaces from Google Fonts, which means your browser requests those files from Google.

4. Why we use it, and our basis for doing so

• To provide the service and the account you asked for — performance of our contract with you.
• To run an organisation's workspace on its instructions — performance of our contract with that organisation.
• To take payment and keep proper financial records — performance of a contract, and our legal obligations.
• To secure the service, prevent abuse and keep it working — our legitimate interests.
• To understand how the site is used and measure our advertising — your consent, which you may withdraw at any time.
• To provide live chat support — our legitimate interests in helping people who are using, or considering, the service. You are never required to use the chat, and section 3 explains what it records whether or not you do.
• To send you service messages, such as confirming your email address or resetting your password — performance of a contract. You can turn off non-essential emails in your settings.

5. Who we share it with

We do not sell personal information. We use a small number of providers who process it on our instructions:

• Cloudflare — DNS, content delivery and protection in front of the service, and inbound email routing for our domain.
• Google — Google Fonts, and Google Analytics 4 when you consent. We use analytics to measure our advertising campaigns.
• Tawk.to — provides the live chat widget, and holds the conversations and the visitor analytics it collects for us.
• Resend — delivers our transactional email: address confirmations, password resets and notifications.
• Paystack, and optionally PayPal — process payments.
• Our hosting provider — runs the servers the service sits on.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

6. Where your information goes

We are based in Nigeria. Some of the providers above store or process information outside Nigeria, including in the United States and the European Union. Where information is transferred out of Nigeria we rely on the safeguards those providers offer, such as standard contractual clauses.

Tawk.to processes everything in the United States, and relies on the EU–US Data Privacy Framework and standard contractual clauses for the information sent to it.

7. How long we keep it

We keep personal information for as long as the account or organisation it belongs to is active, and for a limited period afterwards where we need it to meet legal, accounting, tax or dispute-resolution obligations. When it is no longer needed, we delete it or make it anonymous.

Information an organisation puts into its own workspace is kept according to that organisation's instructions, including any retention period it sets.

8. Keeping it secure

Passwords are stored only as salted hashes, never in a form we can read back. Traffic to the service is encrypted in transit, access to the production systems is restricted, and payment card details never reach our servers. No system can promise perfect security, but we take these measures to protect the information we hold.

9. Where an organisation is the controller

When an organisation uses Andystrategy to manage its own people's performance, that organisation decides what is collected and why. We hold and process that information on its instructions and at its direction, and we do not use it for our own purposes.

If you are an employee and want to exercise your rights over information in your organisation's workspace, please contact your organisation first — it is best placed to answer, and we will help it do so. You can also contact us and we will pass the request on.

10. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to be informed, to access your personal information, to have inaccurate information corrected, to have it deleted, to restrict or object to certain processing, to data portability, and to withdraw consent at any time where consent is our basis. Withdrawing consent does not affect processing carried out before you withdrew it.

If you are in the European Economic Area or the United Kingdom, you have equivalent rights under the GDPR.

To exercise any of these, email [email protected]. We may need to confirm who you are first. If you are not satisfied with our response you can complain to the Nigeria Data Protection Commission, or — in the EEA or the UK — to your local supervisory authority.

11. Children

The service is built for organisations and is not intended for children. We do not knowingly collect personal information from children.

12. Changes to this policy

If we change this policy we will update the date at the top. Where a change is significant we will make it clear on the site rather than leaving you to notice.

13. Contact

Email [email protected] and we will respond. Our registered company details are available on request.