Privacy notice

Who provides Mataki

Mataki is provided by Scalentric Limited, which also runs the server that hosts it (your account, your sign-ins and the optional tracking relay). The server is hosted by Hostinger under Hostinger’s data processing agreement, and may be located outside Nigeria. Questions about this notice or your data: info@scalentric.org.

What this tool is

Mataki runs in your web browser. Assessments and analyses are stored on the device you use, in browser storage, and remain there until you delete them or clear the browser. Assessments are not uploaded. Two parts use the server: your account and its sign-ins, and the optional tracking link, both described below.

Your account and sign-ins

To create an account you give your name, email, password, the level you work at (health facility, ward, LGA, state, or national or partner organization) and the place that goes with it, and, if you wish, your job title and institution. Your password is sealed in the browser to the server’s public key before it is sent, on top of the encrypted (https) connection, and the server keeps only a bcrypt hash of it. The server emails you a link to confirm the address; the link asks for the password you chose, and an account not confirmed within 48 hours is erased. An administrator for your area (or the super administrator) then approves the account: administrators see the name, email, job title, institution, level and place of the accounts in their own area, and the super administrator sees every account. For each sign-in the server keeps a random identifier, a one-way hash of its secret, the device name your browser reports (for example "Android, Chrome"), and when it started, was last used and ends. A sign-in lasts at most 90 days. It is removed from the server at once when you sign out, change your password, delete your account, or an administrator ends it. The server also keeps salted one-way hashes of the networks your account signed in from (the latest 20), to let you in during an attack on your account.

Signing in with your organization

If your organization has set up single sign-on with Mataki, you can sign in through its own sign-in page (OpenID Connect or SAML 2.0). Mataki then receives from your organization only your email address, a stable identifier for you at your organization and, if your organization chooses, your name. It never receives your organization password. An account created this way has no Mataki password, and when your organization first signs in an account that had one, that password stops working, so your organization alone controls access. Your assessments on each device are locked with a data passphrase you choose, which Mataki never sees.

Your account page

Account settings shows everything you gave at registration. You can edit your name, job title and institution at any time; a new level or place applies once an administrator for that place approves it. You can delete your account there: every sign-in ends at once, you receive a data report of everything the server held about you, everything on the server that names you is erased, and an email confirms it. Assessments on your devices are not deleted with it; they stay encrypted on each device until you remove them in Data and privacy.

When an administrator deletes an account

The super administrator can delete an account. It is then deactivated at once and can be restored for 60 days; after 60 days it is erased completely, as when you delete it yourself, and you are told by email. You can ask for complete erasure sooner by writing to info@scalentric.org.

Records the server keeps

The server keeps a log of sign-ins, sign-outs, failed sign-ins, account actions and changes to tracking links, with the account email, who acted, the account’s level and place, and a salted one-way hash of the network address. Administrators see the log for their own area. When the server or the app meets a fault, the server records what failed, where in its code, the request (its address and kind, never the values you typed) and which account was signed in (an account key, never the email); the app’s own reports have emails and phone numbers removed. The firewall records refused requests by network hash. The server also times its own operations, without personal data.

How long records are kept

Unconfirmed registrations: 48 hours. Sign-ins: at most 90 days. Accounts deleted by the super administrator: 60 days, then erased. Single sign-on attempts: 10 minutes. Sign-in and request counters: one hour to one day. A ban on a network that attacked the server: one day. The audit, fault and timing logs keep their most recent entries, about 12 MB of audit entries and 6 MB of each of the others, and drop the oldest; when an account is erased, its email and account key are replaced in every log, so nothing that names the person remains. Daily timing counts: 30 days.

The tracking link

If you set up a tracking link, two things are stored on the server: for each place with a code, a summary of what was agreed there and its latest figures; and every tracking update sent with a code. Both are encrypted in the browser before they are sent, the summary on your device and each update on the sender’s phone, with keys that come from the tracking codes. The server receives a code id and a proof, both derived one way from the code, and never the code or the keys. It records when each update arrived, which code id sent it, and which account set up the link, so that deleting the account deletes its links. Withdrawing a code stops it working; the updates it sent stay on the server until the link is deleted. Deleting the link, or the assessment it belongs to, removes everything the server holds for it. Codes carry roles, not names.

Cookies and storage on your device

Mataki sets one cookie: the sign-in cookie, which holds your session and is strictly necessary for signing in. Scripts cannot read it, it is sent only to this site over https, and it is removed when you sign out. Mataki uses no analytics, advertising or tracking cookies, and loads no third-party scripts. Your browser’s storage on this device holds your encrypted assessments, your account details (name, email, institution, role and place), a note of your sign-in (email, a session identifier and its dates), your PIN-locked key if you chose a PIN, consent records, the device’s own activity log and settings.

What data it holds

Only what you type and what signing in needs: your account details as described above, the programme data you enter (coverage figures, signals, barriers, notes, actions, and learning records) and, if you use the tracking link, the updates that code holders send. It does not collect location, contacts, analytics, or any hidden telemetry. Mataki has no artificial intelligence feature; if one is added, it will see only your own records and its answers will be screened before you see them.

Personal data

This tool is designed for aggregate programme data. You must not enter patient names, health-worker names, or any individual identifiers. Under the Nigeria Data Protection Act (2023), you and your institution are the data controllers for anything you input and are responsible for lawful basis, data minimization, retention, and data-subject rights. Scalentric Limited is the controller of the account and sign-in records it keeps to run the service, and processes them because they are needed to provide the service you asked for and to keep it secure. Institutions that use Mataki under an agreement with Scalentric Limited can sign its data processing agreement.

Your rights

Under the Nigeria Data Protection Act (2023) you can ask what the server holds about you and receive a copy (Account settings gives you the data report when you delete your account; you can also ask at any time), correct it (you can edit your details yourself), have it erased, restrict or object to its processing, and receive it in a portable format. Write to info@scalentric.org; we reply within 30 days. You can also complain to the Nigeria Data Protection Commission.

Security limits

Assessment records and the pilot tester name are encrypted at rest with AES-GCM (256-bit) under a key derived from your password (or data passphrase) with PBKDF2-SHA-256. The key is not stored unless you choose a four-digit PIN. With a PIN, the key is kept on this device locked with the PIN, so a reload or a locked screen asks for the PIN; five wrong tries remove it and the password is needed again, and signing out, or the sign-in ending, removes it. A four-digit PIN is a convenience: anyone who copies this browser’s storage could try every PIN, so use one only on a device you control. A forgotten password or passphrase cannot be recovered by anyone, and neither can the assessments it protects: an administrator can reset a password on the server, but data on a device stays locked with the old one. Account details kept on this device, the note of your sign-in, a sign-out waiting to be sent, consent records, the device’s activity log and settings are not encrypted. Encryption protects stored data, not an open session: lock the screen when you step away. Sign-ins are checked by the server: each lasts at most 90 days from when you signed in, its secret changes at least every hour while in use, an account can be signed in on at most three devices, and a sign-in that is ended is refused at once by the server and closes on the device as soon as the device next reaches the server. Offline, Mataki works for up to 7 days from the server’s last confirmation. A device that stays offline cannot learn that its sign-in was ended until it reconnects, so the encryption of its data, and its screen lock, are what protect it in that time.

Your control

You can delete any assessment from within the app or the Data and privacy screen, assessments not edited within the retention period are removed automatically, and you can clear all stored data by clearing your browser storage for this site. Assessments are never sent anywhere, so deleting them on your device deletes them completely. Tracking-link content is deleted from the server when you delete the link or the assessment it belongs to (at once when online, otherwise at the next chance), and the server drops the oldest updates once a link holds 5,000.

Changes to this notice

When this notice changes, the version number changes and Mataki asks you to read and accept it again before you continue.

Questions

Questions about this notice or your data: info@scalentric.org.