Comprehensive Privacy Notice & Cookie Policy

1. Privacy-by-Default Architecture & Scope Visibility

In accordance with privacy-by-default principles, all user accounts—including those created via Google Social OAuth—are provisioned with a default visibility mode of PRIVATE. Users are never discoverable globally by default. Directory search and caller identification functions operate strictly through blind HMAC-SHA256 phone hashing. Contact visibility is restricted solely to members of groups, companies, or organizations explicitly authorized via server-issued membership tables. The "Who Can See Me Now" security dashboard enables real-time auditing and instant, one-click revocation of visibility scopes.

2. Exact Categories of Personal Data Collected

We collect and process only the minimal personal data required for platform operations: • Account Credentials: Name, primary email, verified phone number, Argon2id password hash, and W3C WebAuthn public keys (passkeys). • Contact Metadata & Uploads: Encrypted contact records (AES-256-GCM) with client-derived blind hashes. Raw phone numbers and unencrypted vCards are never stored in plaintext on persistent database storage. • Device & Session Information: Host-bound IP address, user agent string, session ID, cryptographic token families, and device fingerprint metadata for fraud prevention. • Tamper-Evident Security Audit Logs: Structured JSONL audit events capturing authentication attempts, password resets, and session revocations to protect accounts against credential stuffing and unauthorized takeover.

3. Legal Bases for Processing

Our processing activities are grounded in the following lawful bases: • Affirmative Consent (GDPR Art. 6(1)(a) & Proc. 1231/2021 Art. 5): Explicit consent is obtained prior to contact uploads, phonebook synchronization, and optional WebAuthn registration. • Contract Performance (GDPR Art. 6(1)(b)): Required to provision your central IDP SSO account, authenticate cross-subdomain access, and deliver certified aviation calculations. • Legitimate Interests & Security Defense (GDPR Art. 6(1)(f)): Required to protect platform integrity, prevent brute-force and credential-stuffing attacks, enforce rate limits, and maintain tamper-evident audit records. • Legal Compliance (GDPR Art. 6(1)(c)): Compliance with statutory aviation recordkeeping and tax accounting mandates.

4. Retention Schedules & 30-Day Backup Purge SLA

Personal data is retained only for as long as strictly necessary: • Encrypted Contact Blobs: Automatically deleted 30 days following upload. • Active Sessions: Expire after 30 days of inactivity or upon explicit logout. • Tamper-Evident Audit Logs: Retained for 90 days for operational incident response, with cryptographic checksums retained up to 2 years for regulatory verification. • Backup Purge SLA: All rolling database snapshots and operational backups cycle and permanently purge deleted data within 30 days (documented in our Backup Purge SLA).

5. User Rights: Access, Portability & Verified Account Erasure

Regardless of your geographical location, you possess comprehensive data subject rights: • Right of Access & Portability: Download a complete copy of your personal data in machine-readable JSON or CSV format at any time via the IDP settings. • Right of Erasure ("Right to Be Forgotten"): Request complete, irreversible erasure of your account, credentials, contacts, and sessions via our transactional deletion endpoint (/v1/account/delete). • Right to Revoke Visibility: Modify or withdraw visibility permissions instantaneously from your account dashboard. • Right to Revoke Sessions: Terminate individual device sessions or invoke global logout across all subdomains.

6. Cookie Notice & Tracking Technologies

We maintain a strict anti-tracking cookie policy. We DO NOT employ third-party advertising cookies, cross-site trackers, or behavioral profiling pixels. Our cookies are strictly functional and security-oriented: • Session Cookies: Host-only, HttpOnly, Secure, SameSite=Lax cookies maintaining authenticated state. • PKCE & CSRF Cookies: Cryptographically random nonces (SameSite=Lax, Secure) validating login handoffs and preventing Cross-Site Request Forgery. • Theme & Locale Cookies: Client preferences (dark/light theme, language selection) stored locally.

7. Sub-processors & Cross-Border Data Transfers

We execute formal Data Processing Agreements (DPAs) incorporating standard contractual clauses with our infrastructure providers: • Google Cloud Platform & Firebase: Authentication services and device attestation (App Check), restricted strictly within free-tier resource bounds. • Plesk & Hostinger Infrastructure: High-security Linux server hosting and isolated MySQL 8.0 databases located in tier-III certified data centers. • Transactional Email Provider: Automated password reset and email verification relays secured via mandatory TLS. Data transfers outside Ethiopia or the European Economic Area are safeguarded by Standard Contractual Clauses (SCCs) and encryption at rest and in transit.

8. Jurisdictional Disclosures: Ethiopia, GDPR & CCPA/CPRA

• Ethiopia Proclamation No. 1231/2021: Users enjoy full protection under Ethiopian personal data privacy laws, including the right to lodge complaints with the competent regulatory authorities. • European Union (GDPR): EU residents may exercise rights under Articles 15–22 by contacting our DPO or lodging a grievance with an EU supervisory authority. • California (CCPA/CPRA): We do not sell or share personal information for behavioral advertising. California consumers have the right to notice of collection and non-discrimination for exercising privacy rights.

9. Data Protection Officer (DPO) Contact

For data protection inquiries, erasure requests, or DPA documentation requests, please reach our Data Protection Officer at: Email: dpo@newandu.et / privacy@newandu.et Physical Address: newandu Digital Solutions, Bole Sub-City, Addis Ababa, Ethiopia.

10. Data Deletion Instructions, Retention Schedules & Revocation Procedures