Privacy Policy

Galaxy is a business management platform (ERP) operated by Trackalways ("we", "us"). This policy explains what we collect, why, who we share it with, and the choices you have. It applies to the Galaxy web app and the Galaxy mobile apps for Android and iOS.

Galaxy is a tool businesses use to run their operations. Much of the information in the app is entered by a business about its own customers, staff, and finances. For that information, the business is the data controller and we act as a processor on its behalf.

Information we collect

• Account details — your name, email address, phone number, and a securely hashed password. We never store your password in plain text.
• Business data you enter — contacts and leads (CRM), invoices and payments, accounting records, inventory, suppliers and purchases, projects, help-desk tickets, and, where you use the HR/payroll modules, employee records (which can include salary, tax, and statutory identifiers).
• Files you upload — receipts, product photos, business logos, documents, and chat attachments.
• Location — only when you use attendance clock-in, to record where a clock-in happened. We do not track your location in the background.
• Camera & photos — only when you choose to capture or attach an image (receipts, product photos, attachments).
• Microphone — only during a video meeting you join.
• Device & push tokens — a push-notification token so we can deliver alerts, and basic device/diagnostic information.
• Usage & crash data — technical logs and crash reports used to keep the service reliable.

Biometrics stay on your device

If you enable fingerprint or Face ID unlock, the biometric check is performed by your device's operating system. Galaxy never receives, stores, or transmits your fingerprint or face data — we only receive a yes/no result from the device.

How we use information

• To provide the service — sign-in, running the modules, and syncing your data.
• To send transactional messages (invoices, invitations, reminders, notifications).
• To process payments you initiate (for example M-Pesa).
• To secure the service, prevent abuse, and diagnose and fix problems.
• To meet legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use it for advertising.

Service providers we share data with

We use a small set of processors strictly to run the service. Each receives only what it needs for its function:

• Safaricom M-Pesa (Daraja) — to process mobile payments you initiate.
• Object storage (Contabo) — to store files you upload.
• ZeptoMail — to send transactional email.
• TextSMS — to send SMS where you enable it.
• LiveKit — to power in-app video meetings.
• Sentry — to collect crash and error reports.
• ExchangeRate-API — to fetch currency exchange rates.

We may also disclose information where required by law, or to protect the rights, safety, and security of our users and the service.

Security

Data is encrypted in transit (HTTPS/TLS). Access and refresh tokens are held in your device's secure keystore, and offline data cached on the mobile app is encrypted at rest with AES-256-GCM. Access to business data is scoped so that one business cannot see another's.

Data retention

We keep your information for as long as your account is active and as needed to provide the service and meet legal, tax, and accounting requirements. When you delete your account, we remove or anonymise your personal data as described below, subject to records we are legally required to retain.

Deleting your account and data

You can request deletion of your account and associated personal data at any time. See our Account & Data Deletion page for how to do this from within the app or by contacting us.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these, contact us at privacy@trackalwaysafrica.com. If the data belongs to a business that uses Galaxy, we may direct your request to that business as the controller.

Children

Galaxy is a business tool and is not directed to children. It is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, an in-app notice.

Contact us

Questions about this policy or your data: privacy@trackalwaysafrica.com.