Privacy Policy

INFI-TECH is a technology company based in Lilongwe, Malawi. We operate the INFI-TECH Affiliate platform — a web dashboard and a companion Android and iOS mobile app that let people promote INFI-TECH products and partner products, earn commissions, and withdraw their earnings.

This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have. It covers both the web dashboard and the mobile app.

The platform is multi-company. When you register as an affiliate you join one or more companies, and that company is the party that reviews your identity documents, approves your commissions, and authorises your payouts. INFI-TECH operates the platform on that company’s behalf.

We collect the following categories of personal information.

Account information

• Your full name
• Your email address
• Your phone number
• Your country
• Your password, which we store only as a salted argon2id hash and never in readable form
• Verification status for your email address and phone number

Identity verification (KYC) information

Before you can earn or withdraw commissions, the company you have joined must verify your identity. For this we collect:

• Your national identity number
• Photographs or scans of your national identity document, which you may upload from your photo library or capture with your device camera
• The date you submitted your documents, the outcome of the review, and the reason for any rejection

Payout information

• Your chosen payout method — mobile money or bank transfer
• The account or mobile money number the payout should be sent to, which we store in masked form

Activity and financial records

• Your affiliate code and the referral links generated for you
• Clicks and conversions attributed to your links
• Commissions earned, cleared, or reversed
• Your wallet ledger and balance
• Withdrawal requests and their status
• Training materials you have opened and completed

Device and technical information

• A push notification token and the platform it belongs to (iOS or Android), if you grant notification permission. This identifies your device to the notification service, not you personally.
• Authentication tokens stored securely on your device to keep you signed in
• Server logs containing IP address, request time, and error information, kept for security and debugging

We do not collect your precise location, your contacts, your microphone audio, your browsing activity outside our platform, or advertising identifiers. We do not use third-party advertising or analytics trackers in the mobile app.

• To create and operate your affiliate account and keep you signed in
• To verify your identity, which is a condition of earning and being paid
• To attribute referrals, calculate commissions, and maintain your wallet ledger
• To process withdrawal requests and send payouts to the account you nominate
• To notify you about commissions, withdrawal status, and account changes — by push notification, email, or SMS
• To send one-time codes for email and phone verification and for password resets
• To provide training materials and track your progress through them
• To detect and prevent fraud, abuse, and duplicate or fraudulent commission claims
• To meet legal, tax, accounting, and anti-money-laundering obligations

We do not sell your personal information. We do not use it to build advertising profiles, and we do not share it with data brokers.

We rely on the following grounds:

• Performance of a contract — to run your affiliate account, calculate what you have earned, and pay you
• Legal obligation — identity verification, financial record-keeping, and tax reporting
• Legitimate interests — securing the platform, preventing fraud, and improving the service
• Consent — for push notifications and for access to your camera and photo library, each of which you can grant or refuse, and withdraw later in your device settings

We share personal information only in these situations:

• The company you have joined. Its administrators, finance staff, and product managers can see your profile, KYC submission, commissions, wallet, and withdrawals — this is how approval and payout work. Companies on the platform are isolated from one another; a company can never see affiliates belonging to another company.
• Payment and mobile money providers. When you request a withdrawal, we pass the payout details necessary to complete the transfer to the relevant mobile money operator or bank.
• Notification providers. Push notifications are delivered through the Expo push notification service. Verification codes and payment alerts may be delivered by an SMS provider or an email provider.
• Infrastructure providers. Hosting, database, and file storage providers process data on our behalf under contract, and may not use it for their own purposes.
• Authorities, where we are legally required to disclose information, or where disclosure is necessary to protect our rights or someone’s safety.

Some of these providers operate outside Malawi. Where information is transferred abroad, we take reasonable steps to ensure it remains protected to a comparable standard.

• Account and profile information — for as long as your account is active, and for a period afterwards to handle disputes and legal claims.
• Identity documents — retained after review for as long as financial regulations require us to evidence that verification was carried out.
• Commission, wallet, and withdrawal records — these are financial records and are append-only by design. They are retained for the period required by tax and accounting law and cannot be edited or erased retrospectively, because doing so would break the integrity of the ledger.
• Push tokens — until you revoke notification permission, sign out, or uninstall the app.
• Server logs — kept for a short period for security and troubleshooting.

• Passwords are hashed with argon2id and are never stored or transmitted in readable form.
• All traffic between the app, the dashboard, and our servers is encrypted in transit over HTTPS.
• Authentication tokens are held in your device’s secure storage, not in plain application storage.
• Sessions use short-lived access tokens with rotating refresh tokens, so a stolen token expires quickly.
• Access is controlled by role. Staff at a company see only what their role requires, and every company’s data is isolated from every other company’s at the database query level.
• Administrative actions on your account are recorded in an audit trail.

No system is perfectly secure. Please use a strong, unique password, keep your device locked, and tell us immediately if you believe your account has been accessed without your permission.

• Access and correction. You can view and update your name, phone number, and payout details in the app or dashboard at any time.
• Deletion. You may request that we delete your account. We will do so except where we are legally required to retain financial or verification records, which we will keep for the required period and then delete.
• Withdrawing consent. You can turn off push notifications, camera access, and photo library access in your device settings at any time. The app will continue to work, though you will not be able to submit identity documents without camera or photo access.
• Objection and restriction. You may ask us to stop or limit certain processing, subject to our legal obligations.
• Complaint. If you believe we have mishandled your information, contact us first at privacy@infi-tech.net, and you may also raise the matter with the relevant data protection authority.

To exercise any of these rights, email privacy@infi-tech.net. We will respond within 30 days. We may ask you to verify your identity before we act on a request.

The platform is not intended for anyone under 18. Affiliates must be old enough to hold a national identity document and a mobile money or bank account. We do not knowingly collect information from children. If you believe a child has registered, contact us and we will delete the account.

The mobile app asks for the following permissions, each only when the relevant feature is used:

• Camera — to photograph your national identity document for verification. Images are uploaded only when you confirm the submission.
• Photo library — to let you choose an existing photograph of your identity document. We access only the file you select.
• Notifications — to alert you when a commission is earned or a withdrawal changes status.

Declining any of these will not prevent you from signing in and using the rest of the app.

We may update this policy as the platform develops or as the law changes. The date at the top of this page always reflects the current version. If a change materially affects how we handle your information, we will notify you in the app, by email, or both, before it takes effect.

For any question about this policy or about your personal information:

• Email: privacy@infi-tech.net
• Post: INFI-TECH, Lilongwe, Malawi

For general enquiries, use the contact page.