Privacy Policy

Introduction

Welcome to HummingByte ("we," "our," or "us"). HummingByte is the name under which Humming Byte, a registered business name (Business Name Registration Number 8932514), operates. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://hummingbyte.org or use our services.

This Privacy Policy applies to:

• Website visitors: people who browse our public website or read our blog
• Enquirers: people who contact us through the contact form or by email
• Clients: the people and organisations we build software for, including their contacts who follow a project or pay an invoice through our project tracking pages
• Dashboard users: HummingByte team members who sign in to our internal dashboard, including those who sign in with Google or connect a Google Analytics or Google Search Console account to it

Section 3, Google User Data, explains exactly what we access through Google's APIs, why, and how you can revoke that access.

By accessing or using our services, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our services.

Information We Collect

Information You Give Us

• Contact form and enquiries: your name, email address, phone number (optional), company (optional), the service and timeline you are interested in, the subject and content of your message, and when you agreed to us contacting you
• Client projects and billing: the names, email addresses and phone numbers of client contacts, project details, documents and files shared with us, invoices, and records of payments
• Dashboard accounts: name, work email address, password (stored only as a one-way hash), profile photo (optional), role, two-step verification settings, and your preferences

Information Collected Automatically

• Server and security logs: IP address, browser and device type, the page requested, and the date and time. For dashboard sign-ins and changes made in the dashboard, we also record the approximate location (city, region and country), worked out from the IP address using a location database held on our own server; the IP address is not sent to anyone else for this
• Blog reading statistics: when an article is read or shared, we count it. To count unique readers, we keep a one-way hash of your network (the first part of your IP address) and browser, together with an approximate location, rather than your IP address itself
• Cookies and similar technologies: described in section 10, Cookies and Similar Technologies
• Website analytics: if Google Analytics is turned on for our public website, Google collects information about your visit on our behalf, as described in section 5, Website Analytics

Information from Connected Services

• Google: when a dashboard user signs in with Google or connects Google Analytics or Google Search Console (section 3)
• Paystack: when you pay an invoice online, Paystack tells us the transaction reference, amount, currency, status, payment method type and the time it was paid. We never receive or store your full card or bank account details
• Slack: when a dashboard user connects Slack, we receive access to post operational alerts to a chosen channel and to list channel names

Google User Data

This section describes the information our dashboard obtains from Google through Google's APIs, what we do with it, and how to withdraw access. It applies only to HummingByte dashboard users who choose to sign in with Google or to connect a Google account to the dashboard. Visitors to our public website and our clients are never asked to connect a Google account.

In short:

• What we access: your Google sign-in details, and read-only Google Analytics and Google Search Console information (Google Analytics, Google Search Console)
• How we use it: only to provide and improve the dashboard features described below, which our team uses to look after the websites we build
• Who it is shared with: no one outside HummingByte, other than the service providers that run our systems (Sharing and Limited Use). We never sell it or use it for advertising
• How we protect it: encryption, access limited by role, and two-step verification (How We Protect It)
• How long we keep it, and how to delete it: see How Long We Keep It and How to Revoke Access and Ask for Deletion

Sign in with Google

Dashboard users can sign in with their Google account instead of a password. We request the openid, email and profile permissions, which give us your Google account identifier, your email address and whether Google has verified it, and your first and last name.

• How we use it: only to confirm that you are the person who owns an existing dashboard account, or the person an invitation was sent to. Signing in with Google gives no more access than signing in with a password, and two-step verification still applies
• What we store: your Google account identifier and email address, linked to your dashboard account, and when you last signed in with Google. The token Google issues during sign-in is used once to read these details and is not stored

Google Analytics (analytics.readonly)

An authorised HummingByte administrator can connect a Google account to the dashboard's Google Analytics integration. We request the https://www.googleapis.com/auth/analytics.readonly permission, together with openid and email to show which Google account is connected. This permission is read-only: we cannot change your Google Analytics settings, properties, or data.

What we access:

• The email address of the connected Google account
• The names and identifiers of the Google Analytics accounts and properties that the Google account can see
• For the properties an administrator selects, aggregated reporting data: active users, sessions, page views, engagement rate and conversions, broken down by traffic source, landing page, device category, country or event name, for a chosen date range
• The number of people active right now, by page or screen name (the real-time view)

Google Analytics reports are aggregated statistics about visits to a website. They do not identify individual visitors to that website, and we do not request or receive information that would.

Why we request it and which features depend on it: we build and look after websites for our clients. Connecting Google Analytics lets our team see how those websites, and our own, are performing without leaving the dashboard. The following features use it, and none of them work without it. We use Google Analytics data for these features and nothing else:

• Matching each Google Analytics property to the client project it belongs to
• The Analytics reports and real-time view in the dashboard
• Saved reports, which remember a report's settings so it can be run again
• Exporting a report as a CSV file
• Connection health checks, which warn our team when a property can no longer be read or has stopped receiving data

What we store, and where: in our application database, which runs on servers we rent from our hosting provider, and in the encrypted backups of that database:

• The authorisation (refresh token) Google issues when the account is connected, encrypted. Short-lived access tokens are requested from Google when needed for a piece of work, used for that work and then discarded; they are not stored
• The connected account's email address
• The list of properties (names and identifiers), the account each belongs to, and which project each one is matched to
• The settings of saved reports (the metric, breakdown and date range), but not the figures
• The latest results of health checks, for example that a property received no data in the last 48 hours
• Entries in the dashboard's activity log: when the integration was connected (with the Google account's email address) or disconnected, and when a report was exported (naming the property or its project, the measure, the breakdown and the date range, but not the figures)

Report figures are requested from Google each time a report is opened and are shown to the person who asked for them; they are not saved in our database or our backups. To check that a property is still receiving data, the health check asks Google for the number of active users in the last two days and keeps only the result of the check, not the number. A CSV export is downloaded to the device of the administrator who requested it.

Google Search Console (webmasters.readonly)

An authorised administrator can also connect Google Search Console, with the read-only https://www.googleapis.com/auth/webmasters.readonly permission (and openid and email). We read the list of websites the Google account is a verified owner or user of, so each site can be matched to a client project and its access checked. We store the connected account's email address, the encrypted authorisation, the site addresses and their matched projects, and the results of connection checks.

Who Can See Google User Data

Only HummingByte team members whose dashboard role allows them to view analytics reports or manage integrations can see the data described above. It is not shown to our clients or on our public website. We do not let people read Google user data except where needed to provide these features, with the connected user's agreement, for security purposes (such as investigating abuse), or to comply with the law.

Sharing and Limited Use

We use Google user data only to provide and improve the user-facing dashboard features described in this section. We do not sell Google user data. We do not use it, or transfer it to anyone, for advertising (including personalised or retargeted advertising), for building user profiles, to sell to or share with data brokers or information resellers, or to decide anyone's creditworthiness or eligibility for a loan. We do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models, and we do not give it to anyone else to do so.

Google user data is disclosed only to the following, and only so that the features above work:

• Google: our requests to Google's APIs carry the authorisation, the property identifiers and the report settings, so that Google can answer them
• Our hosting provider: the servers that run our dashboard and its database hold the information listed under "What we store". The provider runs the servers for us and does not use the information for its own purposes
• Our backup storage provider: receives copies of our database for disaster recovery, encrypted on our servers before they are sent, so the provider cannot read them
• Our email delivery provider and, if our team has connected it, Slack: when a connection health check fails, the alert sent to our team by email and posted to our team's Slack channel says what failed, for example the name of a property that has stopped receiving data or can no longer be read. Alerts never contain report figures

We do not otherwise transfer Google user data to anyone, except where the law requires it, or as part of a merger, acquisition, or sale of assets, in which case the information would remain protected by this policy. Google user data is not shown to our clients or on our public website.

HummingByte's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Protect It

• Encryption at rest: the Google authorisation is encrypted (Fernet: AES in CBC mode with an HMAC-SHA256 integrity check) before it is saved. The encryption key is kept in the server's configuration, separately from the database, so a copy of the database alone cannot be used to read it
• Encryption in transit: every request between your browser and our dashboard, and between our servers and Google, uses TLS (HTTPS)
• Encrypted backups: backups of the database are encrypted with AES-256-GCM before they leave our servers
• Access control: only signed-in team members whose role includes viewing analytics reports or managing integrations can see Google user data, and only those allowed to manage integrations can connect, match, or disconnect a Google account. Dashboard accounts are protected by a password and two-step verification, which we can require for every role, and repeated failed sign-in attempts are limited
• Read-only permissions: we ask Google only for read-only access, so the dashboard cannot change anything in your Google Analytics or Search Console account
• Accountability: connecting, disconnecting, matching, and exporting are recorded in the dashboard's activity log

How Long We Keep It

• The authorisation is kept only while the account is connected. When an administrator disconnects the integration, we ask Google to revoke the authorisation, delete our stored copy, and delete the connection's health check results
• Report figures are not kept: they are shown when a report is opened and are gone when the page is closed
• The connected account's email address, the list of properties and sites, their matched projects, and saved report settings stay in the dashboard after a disconnection, so they can be reused if the account is connected again. Connecting a different Google account replaces the email address. An administrator can delete saved reports at any time, and you can ask us to delete the rest
• Activity log entries are kept as the dashboard's record of who did what, for security and accountability, until you ask us to delete them and we no longer need them for that purpose
• Alerts: dashboard notifications are deleted 30 days after they are dismissed. Alert emails and Slack posts stay in the receiving mailbox or channel until our team deletes them
• Your sign-in link to Google is kept until the dashboard account is removed, or until you ask us to remove it
• Backups: information deleted from the database stays in our encrypted backups until those backups reach the end of their retention period and are deleted automatically. By default, a backup is deleted once it is 30 days old, as long as at least seven newer backups exist

How to Revoke Access and Ask for Deletion

• From the dashboard: open Integrations, choose Google Analytics or Google Search Console, and select Disconnect. This revokes the authorisation with Google and deletes our stored copy straight away
• From your Google Account: visit Third-party apps and services in your Google Account settings and remove HummingByte's access. The dashboard can then no longer read any data from that account, and shows that the connection needs attention
• Deletion: to have any remaining Google user data deleted, such as the connected account's email address, the list of properties and sites, saved reports, activity log entries, or your Google sign-in link, email [email protected] from the address concerned, or ask a HummingByte administrator. We will delete it and confirm within 30 days, apart from anything the law requires us to keep, which we will tell you about. Copies in backups are removed as those backups expire

How We Use Your Information

Service Delivery

• Respond to enquiries and prepare proposals
• Plan, build, deliver, and support client projects
• Send project updates, renewal notices, invoices, receipts, and payment reminders
• Let clients follow their project and pay invoices online through our project tracking pages
• Show our team analytics for the websites we look after, as described in section 3

Running and Protecting Our Services

• Sign dashboard users in, including with two-step verification, and manage what each role can do
• Keep an activity log of changes made in the dashboard, and alert our team to sign-ins from new devices
• Protect the contact form against spam and automated abuse
• Monitor errors and keep our systems working, and make encrypted backups
• Count article views and shares, and measure visits to our website

Legal and Security

• Comply with legal obligations, including tax and accounting record-keeping
• Protect our rights, privacy, safety, and property
• Prevent, detect, and investigate fraud and illegal activities
• Enforce our terms and conditions
• Resolve disputes and troubleshoot problems

We do not use your information for advertising, and we do not send marketing emails. We contact you about your enquiry, your project, your invoices, or your dashboard account.

Website Analytics

We may use Google Analytics, a service provided by Google, to understand how visitors use our public website, such as which pages are read and how people find us. When it is turned on:

• Google collects the pages you visit, the page that referred you, your browser, device and screen size, your approximate location, and how you interact with pages, such as scrolling and following links to other sites. Google uses your IP address to estimate your approximate location
• Google Analytics sets cookies named _ga and _ga_ followed by an identifier, which last up to two years
• It runs only on our public website. It is not loaded on our project tracking pages, where clients follow their projects and pay invoices, or in our dashboard
• We do not send Google your name, email address, or any other information that directly identifies you
• We turn off Google signals and ad personalisation for this measurement, so it is not used for advertising
• If your browser sends a Global Privacy Control signal, we do not load Google Analytics at all

You can also prevent Google Analytics from collecting information about your visits by blocking cookies in your browser or by installing the Google Analytics opt-out browser add-on. Learn more about how Google uses information from sites that use its services at policies.google.com.

How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

Service Providers

We use the following kinds of service providers, who process information on our behalf to run our services:

• Hosting and storage: the servers and storage that run our website, dashboard, and database
• Backup storage: cloud storage for our backups, which are encrypted before they leave our servers
• Email delivery: the service that delivers the emails we send
• Payments: Paystack, which processes online invoice payments
• Cloudflare: carries traffic to our website and provides Turnstile, which checks that the contact form is sent by a person. Cloudflare processes technical information about your browser and connection to do this
• Google: sign-in, Google Analytics, and Google Search Console, as described in sections 3 and 5
• Slack: operational alerts for our team, if connected
• Sentry: error monitoring, which tells our team about errors in the software we run

Each provider receives only the information it needs to provide its service to us. Their handling of information is also governed by their own privacy policies.

Business Transfers

If we are involved in a merger, acquisition, sale of assets, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

Legal Requirements

We may disclose your information if required by law or in response to legal processes, law enforcement requests, or circumstances where disclosure is necessary to protect our rights or the safety of users or the public.

With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS (HTTPS)
• Passwords stored only as one-way hashes, never in a readable form
• Two-step verification for dashboard users, and limits on repeated sign-in attempts
• Encryption of stored credentials for connected services, such as Google authorisations and payment provider keys
• Role-based permissions, so each team member can see and change only what their role needs
• An activity log of changes made in the dashboard
• Backups encrypted with AES-256 before they are stored

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activities that occur under your account.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In particular:

• Sign-in codes and one-time links are deleted within a day of expiring or being used
• Signed-in sessions are deleted once they expire
• Dismissed dashboard notifications are deleted after 30 days
• Google authorisations are kept until the integration is disconnected, as described in section 3, Google User Data
• Invoices and payment records are kept as long as tax and accounting law requires
• Backups are kept for the period set in our backup schedule and then deleted

Other information, such as enquiries and project records, is kept for as long as we need it for the purpose it was collected for. The retention period depends on:

• The nature of the information collected
• The purposes for which it is processed
• Legal, regulatory, tax, or accounting requirements
• Our legitimate business interests

When we no longer need your personal information, we will securely delete or anonymize it in accordance with applicable laws and regulations.

Your Privacy Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal information:

Access and Portability

• Request access to the personal information we hold about you
• Request a copy in a structured, machine-readable format
• Request transfer to another service provider

Correction and Update

• Request correction of inaccurate or incomplete information
• Dashboard users can update their own name, email address, photo, and security settings under My account

Deletion

• Request deletion of your personal information (subject to legal exceptions, such as invoices we must keep)
• Remove HummingByte's access to your Google account at any time, as described in section 3

Restriction and Objection

• Request restriction of processing in certain circumstances
• Object to processing based on our legitimate interests

Withdrawal of Consent

Withdraw your consent to processing at any time, where we rely on consent as the legal basis for processing.

To exercise any of these rights, email [email protected] or use the other contact details at the end of this Privacy Policy. We will respond to your request within 30 days.

We may request specific information from you to verify your identity before processing your request. We reserve the right to deny requests that are unreasonably repetitive, require disproportionate technical effort, risk the privacy of others, or are impractical.

Cookies and Similar Technologies

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and improve your browsing experience. Learn more in our Cookies Policy.

What We Use

• Session cookie (sessionid): keeps you signed in to the dashboard or to your project tracking page. Strictly necessary
• Security cookie (csrftoken): protects forms against cross-site request forgery. Strictly necessary
• Theme preference: if you choose a light or dark theme, your browser remembers the choice in its local storage. It never leaves your device
• Google Analytics cookies (_ga, _ga_): only when website analytics is turned on, as described in section 5
• Cloudflare and Paystack: Cloudflare Turnstile on the contact form, and Paystack when you pay an invoice, may store information on your device to protect against abuse and fraud

Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to view, delete, block cookies, or browse in private mode. Please note that blocking cookies may impact your user experience: you cannot sign in to the dashboard or your project tracking page without the session cookie.

Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) signals to websites. Our website does not currently respond to DNT signals, as there is no industry-wide standard for compliance. We do respond to Global Privacy Control: when your browser sends it, we do not load Google Analytics.

Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we discover that we have collected information from a child without parental consent, we will delete that information promptly.

International Data Transfers

We are based in Nigeria and may process your information in Nigeria or other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your country of residence.

When we transfer personal information outside of Nigeria or your country, we take steps to protect it as this Privacy Policy describes, including encrypting it in transit and choosing providers that protect the information they process for us.

Third-Party Links and Services

Our website may contain links to third-party websites, applications, or services that are not operated or controlled by us. This Privacy Policy does not apply to third-party websites or services. We are not responsible for the privacy practices or content of third parties.

We encourage you to review the privacy policies of any third-party websites or services you visit or use. Your interactions with third-party websites and services are governed by their respective privacy policies and terms of use.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will:

• Update the "Last updated" date at the top of this Privacy Policy
• Post the revised Privacy Policy on our website
• Notify you of material changes via email or website notice

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our services after changes are posted constitutes your acceptance of the revised Privacy Policy.

Jurisdiction-Specific Information

For European Union (EU) Residents

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local supervisory authority, the right to data portability, and enhanced rights regarding automated decision-making and profiling.

Our legal basis for processing your personal information includes: performance of a contract with you, compliance with legal obligations, your consent (which you may withdraw at any time), and our legitimate business interests.

For California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, use, and disclose, the right to request deletion of your personal information, and the right to opt-out of the sale of personal information (we do not sell personal information). You also have the right to non-discrimination for exercising your CCPA rights.

To exercise your CCPA rights, please contact us using the information provided below.

For Nigeria Residents

If you are located in Nigeria, your rights are protected under the Nigeria Data Protection Act 2023 (NDPA), which is enforced by the Nigeria Data Protection Commission (NDPC). We comply with NDPA requirements for lawful processing, data subject rights, security measures, and breach notifications.

Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria. Any dispute, controversy, or claim arising out of or relating to this Privacy Policy, including its formation, validity, breach, or termination, shall be subject to the exclusive jurisdiction of the High Court of Justice, Enugu State, Nigeria.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Registered business name: Humming Byte, which operates as HummingByte
• Business Name Registration Number: 8932514
• Email: [email protected]
• General Inquiries: [email protected]
• Phone: +234 904 022 2100
• Address: Plot 4, Anioma Layout, Abakpa Nike, Enugu State, Nigeria
• Website: https://hummingbyte.org
• Data Protection Officer: [email protected]

We will respond to your inquiries within a reasonable timeframe and in accordance with applicable law.