Privacy Policy — CampusFlow

Your privacy matters. CampusFlow only collects what it needs to run the platform. We do not sell your data. Ever.

1. Who We Are

CampusFlow is a student services marketplace connecting students across Zambia, Zimbabwe and South Africa. We are operated by Courage Mazinyane. Contact: couragemazinyane@gmail.com | support@campus-flow.online

2. What Data We Collect

We only collect what is strictly necessary to provide the service.

Data	Why we collect it	How long we keep it
Name & email	Account creation and login	Until you delete your account
Phone number	Providers contact clients via WhatsApp	Until you delete your account
University / campus	Show relevant listings near you	Until you delete your account
Profile photo	Display on your public profile	Until you remove it or delete your account
Booking details	Match clients with providers, track status	12 months after booking completes
Listing content	Display your services/items/rooms to other users	Until you remove the listing
Messages	In-app chat between users	6 months
Usage analytics	Understand site traffic (Google Analytics — anonymised)	Per Google's retention policy (26 months)

We do not collect: home addresses, ID numbers, payment card details, or any data we do not need to run the platform.

3. How We Use Your Data

To create and manage your account
To connect clients with service providers
To send booking confirmations and notifications
To display your listings to other users
To detect fraud and keep the platform safe
To send platform updates (you can opt out any time)

We do not use your data for advertising to third parties, sell it, or share it outside the services listed below.

4. Third-Party Services We Use

Service	Purpose	Their privacy policy
PocketBase (self-hosted)	Database & authentication — runs on our own server	No third party — your data stays on our server
Cloudinary	Image storage and optimisation	cloudinary.com/privacy
Resend	Transactional email (booking confirmations)	resend.com/legal/privacy-policy
Cloudflare	Hosting, DNS, DDoS protection	cloudflare.com/privacypolicy
Google Analytics	Anonymous site traffic statistics	policies.google.com/privacy

5. Data Security

Encryption in transit: All data between your browser and our servers is encrypted via HTTPS (TLS 1.3) — enforced by Cloudflare.
Encryption at rest: Our server storage (Hetzner, Germany) is encrypted at the hardware level.
Access control: Only you can read and edit your own data. Admins cannot view your password (it is hashed). Role-based access rules are enforced server-side.
No secret keys in the browser: Our frontend code does not contain any database secret keys.
Backups: Daily encrypted backups are stored on the same server and rotated every 7 days.

6. Your Rights

You have the right to:

Access: See all the data we hold about you — email support@campus-flow.online
Correct: Update your name, phone, photo or any detail from your account dashboard
Delete: Delete your account and all associated data at any time from your account settings — or email us and we will do it within 7 days
Portability: Request a copy of your data in a readable format
Withdraw consent: Stop using the platform at any time

7. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies. Google Analytics uses anonymised cookies to count page views — no personal identifiers are attached.

You can clear cookies at any time in your browser settings. Clearing them will log you out of CampusFlow.

8. Children

CampusFlow is intended for university students aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it immediately.

9. Data Transfers

Your data is stored on a server in Nuremberg, Germany (Hetzner). Images are stored via Cloudinary (US). By using CampusFlow you consent to this transfer. Both locations apply strong data protection standards.

10. Changes to This Policy

If we make significant changes to this policy, we will notify you by email or via the announcement bar on the site. The date at the top of this page will always reflect the most recent update.

11. Contact Us

For any privacy questions, data requests, or to delete your account: