Privacy notice
How BK Mosala handles personal information.
Last updated: 1 January 2026
This is a starting point, not legal advice. It states what the application actually does (the accounts it stores, the records it keeps, how long it keeps them) so the page is true on day one. Have it reviewed against the law that applies to you before you launch, and update the retention table whenever you add a model that stores personal information.
What we collect
An account holds the name, email address and password hash you provide when you register, plus the two-factor secret if you enable it. Signing in records the time and the IP address the request came from.
Why we hold it
To identify you, to decide what you are allowed to do, and to keep an auditable record of changes made through the application. Access decisions and administrative changes are recorded in an append-only audit trail.
How long we keep it
| Record | Retained |
|---|---|
| Account profile | While the account exists |
| Sign-in sessions (refresh tokens) | Until they expire or are revoked |
| Audit events | Append-only; not deleted by ordinary use |
| Application logs | Per the retention set on the log store |
Your rights
You may ask what is held about you, ask for it to be corrected, and ask for it to be deleted where no legal obligation requires it to be kept. Contact the operator of this deployment.