Legal Hub — Privacy Policy & Terms of Service

A. Information Provided Directly by the User

Depending on which application or website you interact with, we may collect the following user-submitted information:

• Account Identity: Full name, username, email address, phone number, profile photo, and securely salted/hashed passwords (stored using modern bcrypt or Argon2 cryptographic hashing).
• User-Generated Content: Messages sent through contact forms, AI prompts submitted in assistant interfaces, resume details inputted into MyBGR (work experience, education, skills), or event reservations submitted in Rhodium.
• Customer Support & Feedback: Records of correspondence, bug reports, and diagnostic descriptions provided when requesting assistance.

B. Information Collected Automatically (Telemetry & Device Diagnostics)

To maintain service stability, prevent fraudulent abuse, and optimize performance across device form factors:

• Network and Device Identifiers: Anonymized IP addresses, browser user agent, device model, operating system version, and system language settings.
• App Performance & Crash Logs: Stack traces, memory usage events, and session anomalies collected via privacy-conscious telemetry tools (e.g. Firebase Crashlytics) to repair software bugs.

C. Payment and Transactional Information

For applications featuring event ticketing (Rhodium), donations (Jecontribue), or premium digital upgrades:

• Credit card and debit payments are processed directly by certified PCI-DSS Level 1 payment providers (such as Stripe). We NEVER collect, see, or store full credit card numbers or security CVV codes on our servers.
• Mobile Money payments (e.g. Airtel Money, MTN Mobile Money) are transacted through licensed telecom API aggregators. Only transaction reference IDs, status tokens, and timestamps are retained for receipt delivery.
• In-App Purchases on mobile are processed exclusively by Apple App Store (In-App Purchase) or Google Play Billing.

Camera Access (NSCameraUsageDescription / CAMERA)

Used strictly when you choose to scan a physical resume/document (e.g. MyBGR OCR engine), scan a QR entrance badge (e.g. Rhodium Ticket Scanner), or take a live profile picture. Photos are processed locally or uploaded only upon your direct confirmation.

Photo Library / Storage (NSPhotoLibraryUsageDescription / READ_MEDIA_IMAGES)

Allows you to select and upload an existing document, avatar image, or PDF file into the app, or to save an exported file (such as an ATS-compliant resume from MyBGR or an event ticket receipt from Rhodium).

Push Notifications (APNs / Firebase Cloud Messaging)

Used to send transactional alerts, such as event booking confirmations, critical security notices, tournament start notifications (Koyeba), or customer service updates. You may revoke push notification permissions at any time in your device settings.

Location Services (NSLocationWhenInUseUsageDescription / ACCESS_COARSE_LOCATION)

Where applicable (e.g. event discovery nearby in Rhodium), coarse or fine location is requested strictly while the app is in use to show venues within your geographic vicinity. Background location is NOT collected.

Hosting, Edge Compute & Security

Cloudflare Inc. (Global CDN, SSL/TLS termination, DDoS mitigation, R2 storage) and AWS / Render / IONOS (cloud virtual machines and managed microservices).

Database & Backend Storage

PostgreSQL, Turso / LibSQL (distributed edge SQL), Redis (caching and pub/sub), and Supabase. All databases feature hardware encryption at rest and mandatory TLS in transit.

Mobile Services & Push Infrastructure

Google Firebase (Firebase Authentication, Cloud Messaging FCM, Crashlytics) and Apple Push Notification service (APNs).

Payment Gateways

Stripe Inc. (for card processing) and telecom Mobile Money operators (Airtel Money, MTN Mobile Money). Payment handling is restricted to PCI-DSS certified conduits.

Rights Under GDPR (European Union & UK Citizens)

Under Regulation (EU) 2016/679, you hold the following rights:

• Right of Access (Art. 15): Obtain confirmation of whether your data is processed, and receive a portable copy.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
• Right to Erasure / 'Right to be Forgotten' (Art. 17): Request permanent deletion of your data when no longer necessary.
• Right to Restriction of Processing (Art. 18): Restrict processing during verification of data accuracy or objections.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format (JSON/CSV).
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with an official Supervisory Authority (such as the CNIL in France, the ICO in the UK, or your local data protection agency).

California Consumer Privacy Act (CCPA / CPRA Disclosures)

If you reside in California, United States, California law grants specific protections:

• Right to Know & Access: Learn the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: Request deletion of personal information collected from you.
• Right to Correct: Request correction of inaccurate personal data.
• Do Not Sell or Share My Personal Information: We declare under penalty of perjury that we DO NOT sell personal information to third parties, and we DO NOT share your data for cross-context behavioral advertising.
• Non-Discrimination: We will never discriminate against you (deny services, charge different prices, or degrade quality) for exercising any of your CCPA rights.

Republic of the Congo (Law No. 29-2019 Protection)

In accordance with Law No. 29-2019 of October 10, 2019 on the Protection of Personal Data in the Republic of the Congo, all Congolese citizens and residents are guaranteed the right to confidentiality, human dignity, and secure processing of personal identifiers.

Children's Privacy Protection (COPPA & CalOPPA Compliance)

Our applications and services are not directed at children under the age of 13 (or under 16 within the European Economic Area). We do not knowingly collect personal information from minors. If you believe that a minor has provided us with personal data without parental consent, please contact [email protected] immediately, and we will delete the data without delay.

Method 1: Direct In-App Deletion

If you are using any of our mobile applications with user registration (e.g. Rhodium, Koyeba, MyBGR):

• 1. Open the mobile app on your iOS or Android device.
• 2. Navigate to Profile / Settings > Security & Account.
• 3. Tap 'Delete Account' (or 'Supprimer mon compte').
• 4. Confirm your selection. Your authentication credentials, profile information, and active tokens are purged immediately from production databases.

Method 2: Web & Email Self-Serve Deletion Request

If you cannot access your mobile device or prefer a web-based deletion request:

• Send an email to [email protected] with the subject line: 'Account & Data Deletion Request'.
• Include the name of the application (e.g. Volten AI, Rhodium, Koyeba, MyBGR) and your registered email address or username.
• Service Level Agreement (SLA): We acknowledge receipt within 48 hours and permanently delete all records within 30 days. You will receive a formal confirmation receipt once deletion is completed.

Data Retention & Post-Deletion Purge Details

Upon account deletion, all active databases immediately sever links to your identity. Encrypted system backups overwrite naturally on a rolling 30-day lifecycle, after which no copies remain.

License Grant

We grant you a personal, revocable, non-exclusive, non-transferable, non-sublicensable, limited license to download and run our applications on personal devices strictly for personal or authorized professional use, subject to these Terms.

Prohibited Uses & User Conduct

When using our applications or platforms, you agree that you will NOT:

• Reverse engineer, decompile, disassemble, or attempt to derive source code from any compiled binary, bytecode, or proprietary API without prior written consent.
• Deploy automated bots, scrapers, web spiders, or crawlers that disrupt service performance, bypass rate limits, or harvest user data.
• Exploit, scan, or probe software vulnerabilities or transmit viruses, worms, malware, or destructive code.
• Impersonate any person or entity, forge header tokens, or misrepresent affiliation with Inefable Koumba, MAZALA-FIRM, or partner entities.
• Utilize our services for illegal activities, illicit money laundering, distribution of abusive or unlawful material, or violation of third-party intellectual property.

Apple App Store & Google Play In-App Purchases

All digital purchases and recurring subscriptions conducted within our iOS or Android applications are processed through the official billing mechanisms of Apple Inc. (Apple Media Services Terms and Conditions) or Google LLC (Google Play Terms of Service). Subscriptions automatically renew unless canceled at least 24 hours prior to the end of the current billing cycle via your App Store or Google Play account management settings.

Mobile Money & Direct Web Purchases

For web-based services, event tickets (Rhodium), or donation transactions (Jecontribue), payment is executed via verified Mobile Money operators or authorized payment gateways. All prices are clearly quoted prior to order confirmation, including applicable taxes or telecom fees.

Refund Policy

For in-app purchases through mobile stores, refunds are governed strictly by Apple's or Google's respective refund policies. For direct transactions, refunds are granted if an event is cancelled by the organizer or if an unresolvable technical failure on our end prevented the delivery of the purchased service.

Official Contact & Data Protection Inquiries

For any privacy questions, exercise of GDPR/CCPA rights, app compliance verification, or legal notices:

• Full Name: Surprise Inefable KOUMBA MISSOUNDOU (Inefable Koumba)
• Professional Entity: MAZALA-FIRM / Inefable Koumba
• Location: Brazzaville, Republic of the Congo
• Direct Legal / DPO Email: [email protected]
• Response Time Guarantee: All legitimate privacy requests are answered and acknowledged within 48 hours and fulfilled within 30 days maximum.