Privacy and Data Handling

This page says, in plain terms, what AfriHex stores when you call the API, who can read it, and when it is deleted. Use it to answer your own users' questions and to write the privacy notice for your app.

If your app asks a user for location, a phone number or an ID, tell them why at the point you ask. Unexplained data collection is the most common reason people stop trusting an addressing app.

Location monitoring

Background location features only work for a customer you have registered consent for.

• Consent first. Grant consent with POST /v2/consent/grant before sending pings. A ping without a valid consent token is rejected. Check consent with GET /v2/consent/status.
• Revoking. POST /v2/consent/revoke stops collection: later pings for that customer are refused.
• Erasure. POST /v2/consent/delete-data deletes a customer's collected location pings and drift events. See Delete a customer's location data.
• Tenant isolation. Exports only return customers whose consent was registered by your account.

Identity and address verification (KYC)

A verification record keeps the location result: coordinates, the hex and postal code, region, district and area, a quality score and risk flags. It also keeps the request's IP address and device ID for fraud checks. It does not store identity document numbers.

Address registry (pilot)

The address registry links a household's address profile to a physical place and its reviewed gates.

• Public reads return only places and gates marked public. Access instructions, landmark directions and field observations are removed.
• Private places can only be read with the owner's edit token or an unexpired guest link. Moving the profile to a new location revokes existing guest links.
• Field evidence from a site visit is only accepted with the resident's explicit consent. Road reports need consent to publish.
• Not an official address. Every registry response says the location identity is not an official government address or proof of land ownership.

How long data is kept

A retention job runs every 6 hours and deletes data older than these periods:

Data	Kept for
Location pings	90 days
Location drift events	6 months
KYC verification records	1 year
Revoked or expired location consents	1 year
Audit log	2 years
Billing records	6 years (financial records)
Address registry field-evidence details	90 days after the decision
Address registry review and contribution details	Personal details removed 1 year after the record stops being valid
Address registry change history	Personal details removed after 2 years

Address registry evidence is held back while a dispute about that place is open, so the dispute can be reviewed.

Logs and audit records

The audit log records which account called which endpoint, when, from which IP, and the status code. It does not store request bodies. Address registry audit entries also leave out credentials, household handles, IP addresses, raw GPS fixes and access instructions.