Privacy policy

The controller of personal data collected via africwebhosting.com is:

• M-Roots Technology LLC — a Wyoming, USA limited liability company (see Legal Notice)
• Email: contact@africwebhosting.com

Any request regarding your data can be sent directly to the email above. Where GDPR applies to you (EU/EEA residents), you retain the rights described below; M-Roots Technology LLC implements appropriate safeguards for transfers of data outside the EU.

We collect only data strictly necessary to provide the service:

• Account data: name, business email, company name (entered at checkout)
• Payment data: managed exclusively by Stripe; we never access card numbers. We only keep the Stripe Customer ID for subscription management
• Subscription data: chosen plan, number of users, options (auto-archive, migration), subscription/renewal dates
• Technical data: IP address, browser, locale, sign-in events (server logs). Retained 90 days for diagnostics.
• Business data (emails, files): never hosted by us; it lives only in Microsoft / Google datacenters.

Purpose	Legal basis
Contract performance (provisioning, billing)	Contract performance (art. 6.1.b GDPR)
Magic-link authentication	Contract performance
Transactional notifications (welcome, invoices)	Contract performance
Security (logs, anti-bot Turnstile, rate limiting)	Legitimate interest (art. 6.1.f GDPR)
Accounting and tax obligations	Legal obligation (art. 6.1.c GDPR)

No commercial prospecting. We send no marketing email without explicit consent (dedicated opt-in checkbox).

• Account and subscription data: throughout the contract, then 3 years after termination for potential follow-up
• Invoices and accounting data: 10 years (French legal obligation)
• Technical logs: 90 days
• Audit logs: 12 months
• Session cookies: 30 days (NextAuth session lifetime)

To provide the service, we rely on the following sub-processors. All offer an adequate level of protection (standard contractual clauses or EU-US Data Privacy Framework for US operators).

Sub-processor	Role	Location
OVHcloud (infrastructure)	VPS + Mail hosting	North America
Cloudflare	DNS, CDN, Turnstile	USA (DPF)
Stripe Payments Europe	Payments	Ireland
Microsoft	Resold M365 service	EU / USA (DPF)
Google	Resold Workspace service	EU / USA (DPF)

Whatever your jurisdiction, you may exercise the following rights over your data:

• Access: obtain a copy of your data
• Rectification: correct inaccurate information
• Erasure (right to be forgotten): subject to legal obligations (invoices retained 10 years)
• Restriction: suspend certain processing
• Portability: retrieve your data in a structured format
• Objection: refuse certain processing on legitimate grounds

If you reside in the EU/EEA, you additionally have the rights provided by the GDPR, including the right to lodge a complaint with your data protection authority (e.g. the CNIL in France, cnil.fr).

To exercise these rights, write to contact@africwebhosting.com with proof of identity. Response within 1 month maximum.

Technical and organisational measures in place:

• TLS 1.3 encryption on all web traffic
• Password-less authentication (unique magic link, 24h expiry)
• PII hashing in logs (no plain-text email/message)
• Strict input validation (Zod, anti-injection)
• Cloudflare Turnstile anti-bot on forms
• Redis rate limiting on sensitive endpoints
• Daily encrypted database backups
• Audit log of critical events

The site uses Umami, an open-source analytics solution self-hosted on our infrastructure (analytics.africwebhosting.com). Umami is designed to respect privacy:

• Data collected: aggregated page views, referrer (source domain), device type, browser, country — no individual identifier, no stored IP address, no tracking cookie
• Location: data stored exclusively on our own infrastructure (OVHcloud, North America), outside third-party Cloud
• Legal basis: consent (art. 6.1.a GDPR & PECR) — the Umami script is only loaded after explicit acceptance via the consent banner displayed on first visit
• Withdrawal of consent: you may refuse via the banner on first visit, or delete the afh_cookie_consent cookie (or the localStorage entry with the same name) at any time from your browser settings — the script will no longer be loaded

In the absence of consent, no analytics script is injected into the page.

When providing Microsoft 365 and Google Workspace services, AfricWebHosting (M-Roots Technology LLC) acts as a data processor within the meaning of Article 28 GDPR on Customers' tenants, which remain data controllers of their employees' data.

In this capacity, we commit to:

• Acting only on documented instructions from the Customer (Data Controller)
• Ensuring the confidentiality of access credentials and data transiting through our administration interface
• Implementing appropriate technical and organisational security measures
• Notifying the Customer without undue delay (and within a maximum of 72 hours) of any personal data breach likely to affect their tenants
• Assisting the Customer in responding to data subject rights requests from their users
• Deleting or returning data at the end of the contract as instructed by the Customer

Authorised sub-processors: Microsoft Corporation (M365 administration), Google LLC (Workspace administration), EU cloud provider (infrastructure hosting), Cloudflare Inc. (CDN/DNS), Resend Inc. (transactional emails — backup). All operate under adequate safeguards (EU SCCs or EU-US DPF).

Data Processing Agreement (DPA): any Customer subject to GDPR may request a signed Data Processing Agreement. See the DPA template at the Data Processing Agreement page and write to contact@africwebhosting.com (processing time: 5 business days).

The service, previously operated by BaoProd, is now operated by M-Roots Technology LLC (Wyoming, USA) as of July 2026. This policy may evolve (updates to sub-processors or purposes); any substantial change will be notified by email to active Customers at least 30 days before taking effect.