Privacy Policy

TsWorldTech acts as the data controller for information processed through the License Portal and report APIs. We collect only what is necessary to operate billing, quota enforcement, fraud prevention, and customer support.

• Account email, name, company name, company size, and country preference
• Billing records and invoice history (payment data is handled by Flutterwave; we store only processor references and transaction IDs)
• Aggregated daily usage reports: event counts by type, registered domains, package version, and optional webhook-hit summaries
• Standard server logs: IP address, user agent, and request timestamps for Portal and API routes
• Supabase auth session tokens and magic-link delivery metadata via Resend

Once per day, your server sends a bundled report to TsWorldTech containing aggregated event counts, domain metadata, and any domain-mismatch events detected by your own webhook endpoint. This is the only server-to-server contact between your infrastructure and ours. The report is authenticated via your FLUX_LICENSE_SECRET. Mismatch telemetry is first received by your webhook, aggregated by your own backend, and only the summary is forwarded to us.

Each project has its own ES256 keypair. The public half is stored in our database and served through the CDN edge. When an end user opens your app, the browser fetches the project’s public key (cached 3 days in the browser’s IndexedDB) and verifies the license JWT signature locally using native WebCrypto. No license state, usage data, or personal identifiers are transmitted during this process.

When you rotate your token — by adding or removing a domain, changing webhook config, or manually regenerating — a new keypair is issued, the CDN edge is purged immediately, and the old public key is removed from origin. You must redeploy the updated FLUX_LICENSE_TOKEN to your environment. New visitors receive the current token and fetch the current public key. Returning visitors with the old public key cached in IndexedDB may continue to verify the old token for up to 3 days, after which the cache expires and they fetch the new key. If a visitor arrives with an outdated token after the CDN purge, verification fails gracefully and the app degrades to free-tier behavior.

We share data only with the following sub-processors required to operate the service. All are bound by contractual obligations to protect your data.

License tokens are ES256-signed JWTs verified offline via the WebCrypto API once the project public key is cached. The private signing key never enters any client bundle. License Secrets are random strings generated per project, distinct from the token, and are never embedded in client-side code. All Portal traffic is served over HTTPS. We do not store plaintext credentials or payment card numbers.

Account data and daily reports are retained while your account is active. Upon account deletion (initiated in Portal Settings), your profile, keys, and project metadata are permanently erased after a 30-day grace period. Invoice records may be retained longer where required by Nigerian tax law. You may export billing history from the Portal at any time.

As a Nigerian-registered data controller, TsWorldTech respects your rights under the Nigeria Data Protection Regulation (NDPR 2023). Depending on your jurisdiction, you may also have rights under GDPR or other local laws.

Your data is hosted on Supabase and Vercel infrastructure, which may process data in regions outside Nigeria. We rely on the adequacy of Supabase’s and Vercel’s standard contractual clauses and security certifications to ensure your data receives equivalent protection. Daily reports and billing data are processed in accordance with NDPR cross-border transfer requirements.