End User License Agreement & Terms of Service

Effective Date: October 15, 2026 · Version 2026.2

Welcome to newandu Digital Solutions (newandu.et). By creating an account, authenticating via our Central Identity Provider (IDP), or utilizing any services across our multi-subdomain ecosystem—including contact.newandu.et, bluebook.newandu.et, and loadsheet.newandu.et—you enter into a binding legal agreement subject to these Terms.

1. Central Identity Provider (IDP), WebAuthn & Session Security

Your newandu central account provides single sign-on (SSO) authentication across all affiliated portals. In addition to password credentials, our platform supports W3C WebAuthn Level 3 hardware passkeys. You are solely responsible for safeguarding your credentials and devices. Multi-tenant sessions, OIDC tokens, and OAuth authorizations are subject to strict per-session revocation and device monitoring. Centralized logout terminates active sessions across all subdomains simultaneously.

2. Contact Discovery, Privacy by Default & Scope Visibility

Our contact discovery engine enforces privacy-by-default. All newly provisioned accounts, including Google OAuth accounts, default to PRIVATE visibility. Users may selectively grant visibility only to verified members of specific groups, companies, or organizations through server-issued membership tables. We do not permit global raw directory lookups. All contact searches use blind HMAC-SHA256 indexing; raw phone numbers are never stored in plaintext or exposed to third parties.

3. Data Categories Collected & Purpose Limitation

We collect only the minimum personal data necessary to deliver authenticated services: (a) Account Data: Primary email, verified phone, cryptographic password hash, and WebAuthn public keys; (b) Encrypted Contact Data: Uploaded contacts are encrypted client-side with AES-256-GCM and stored temporarily; (c) Session & Device Data: IP address, user agent, login timestamps, and device identifiers; (d) Tamper-Evident Security Logs: Append-only audit events recorded to prevent credential stuffing and unauthorized account takeovers.

4. Retention Limits, 30-Day Purge SLA & Account Erasure

Encrypted contact payloads are subject to a strict 30-day automatic purge schedule. In accordance with our Backup Purge SLA, database backups are cycled within 30 days. You retain the absolute right to request immediate export of your personal data (in machine-readable JSON or CSV format) or execute total account deletion via our authenticated erasure endpoint (/v1/account/delete), which transactionally deletes all contacts, sessions, and credentials.

5. Platform Quotas, App Check & Rate Limiting

To protect our shared infrastructure, prevent abuse, and comply with strict operational ceilings, our services enforce automated rate limiting, daily action caps, and Google Firebase App Check device attestation. If an account or IP exceeds safety thresholds, operations may be temporarily restricted or placed into a degraded read-only state.

6. Aviation Suite, Aeronautical & Weather Telemetry (BlueBook & Loadsheet)

Calculations provided by the BlueBook aviation portal and the Aircraft Load and Trim Sheet are derived from certified Airline Airport Handling Manuals (AHM 560). Aerodrome coordinates, runways, and facilities are indexed from open datasets including OurAirports (CC0 Public Domain). Aircraft type designators and fleet registrations are compiled from OpenFlights (ODbL) and OpenSky Network (CC BY 4.0). Meteorological observations (METAR), aerodrome forecasts (TAF), and aviation hazard bulletins (SIGMETs, AIRMETs) are ingested from the U.S. NOAA Aviation Weather Center and international exchanges. All aeronautical and weather telemetry is provided strictly for pre-flight situational awareness and educational reference, and is NOT FOR PRIMARY NAVIGATION OR OPERATIONAL DISPATCH. The Pilot-in-Command (PIC) and licensed flight dispatchers retain ultimate statutory responsibility for gross takeoff mass, center of gravity limits, fuel planning, certified weather briefings, and safe flight execution.

7. Sub-processors & Infrastructure

We engage trusted sub-processors under formal Data Processing Agreements (DPAs): Google Cloud Platform / Firebase (Authentication & App Check attestation), Hostinger/Plesk (Managed Linux infrastructure and MySQL 8.0 databases), and TLS-encrypted transactional email relays. We do not sell, rent, or share personal information with third-party data brokers or advertising networks.

8. Governing Law, Jurisdiction & Ethiopian Proclamation No. 1231/2021

These Terms and all platform processing activities are governed by and construed in accordance with the laws of the Federal Democratic Republic of Ethiopia, including Personal Data Protection Proclamation No. 1231/2021. Any unresolved disputes arising hereunder shall be subject to the exclusive jurisdiction of the competent courts in Addis Ababa, Ethiopia.

9. User Rights & Data Protection Inquiries

Under applicable data protection laws, including GDPR, CCPA/CPRA, and Proclamation 1231/2021, you have the right to access, rectify, restrict, export, and delete your personal data, as well as to withdraw consent at any time without detriment. For privacy inquiries or to reach our designated Data Protection Officer, contact privacy@newandu.et or dpo@newandu.et.

10. Data Deletion Instructions, Retention Schedules & Revocation Procedures

At newandu Digital Solutions, we respect your right to privacy and total control over your personal data under Ethiopian Proclamation No. 1231/2021, the EU GDPR, and CCPA/CPRA. You have the unconditional right to request deletion of your data, revoke visibility permissions, or delete specific records at any time. A. What Data Can Be Deleted: • Account Profile: Full name, primary email address, verified phone numbers, profile avatar, authentication credentials, and WebAuthn credentials. • Contact Book & Address Book Blobs: Encrypted contact records, phone numbers, contact names, and associated metadata stored on contact.newandu.et. • Social Graph & Permissions: Shared contact lists, custom contact groups, reciprocity counters, and search privileges. • Proximity / Nearby Coordinates: Real-time GPS/geocoordinates used for ephemeral nearby discovery are processed in volatile memory with zero persistent retention and are automatically discarded upon session termination. • Active Sessions & Device Tokens: Cryptographic session cookies, refresh token families, OAuth authorization grants, and Firebase App Check attestation tokens. B. Step-by-Step Deletion Instructions: 1. Full Account Deletion (Self-Service via IDP Danger Zone): a. Sign in to your central account dashboard at https://newandu.et/idp. b. Navigate to the Danger Zone tab (https://newandu.et/idp?tab=danger). c. Click the 'Delete My Account' button. d. Confirm your intent by entering your current account credentials (password or WebAuthn passkey). e. Upon confirmation, your account status is immediately marked for deletion, active sessions across all subdomains (newandu.et, contact.newandu.et, bluebook.newandu.et, loadsheet.newandu.et) are revoked, and permanent transactional deletion is completed. 2. Contact-Only Deletion (via contact.newandu.et): a. Sign in to https://contact.newandu.et. b. In the 'Manage My Contacts & Sharing' panel, select individual contacts or use the bulk selection tool. c. Click 'Delete Selected' or choose 'Delete Synced Contacts' to wipe all synchronized phonebook contacts. d. Note: Reducing your public uploaded contact count below 200 immediately revokes reciprocal search access across the global directory under platform reciprocity rules. 3. Revoking Visibility Scopes: a. In contact.newandu.et or IDP settings, locate your visibility configuration. b. Switch your visibility scope from 'REGISTERED_USERS' or 'SPECIFIC_GROUPS' to 'PRIVATE'. c. Visibility revocation applies instantaneously across all caller-ID and directory query lookups. 4. Revoking Active Sessions: a. In IDP Security Settings, locate 'Active Devices & Sessions'. b. Click 'Sign out of all devices' to immediately invalidate all refresh tokens and active JWT sessions across all platforms. 5. Revoking Third-Party Provider Connections: a. In IDP Connected Accounts, review linked social identities (Google, Microsoft, Facebook, Apple, GitHub, X/Twitter, Yahoo). b. Click 'Unlink' next to any external provider to delete the identity binding and prevent future authentication via that provider. C. Explicit Retention Schedules & Purge Cycles: • Account Deletion SLA: Hard deletion from operational production databases is completed within 30 days of request submission. • Legal & Security Audit Logs: Security audit events (authentication attempts, privilege escalations, IP access logs) are retained for up to 365 days strictly for incident investigation and legal compliance, with direct identifiers pseudonymized. • Rolling Backup Cycle: Encrypted database backups rotate on a 30-day purge cycle. Deleted records are completely overwritten and purged from all backup archives within 30 days. D. Manual Deletion Requests & SLA: If you are unable to access your account or require manual assistance, you may submit a formal Data Deletion Request: • Email: contact@newandu.et (or privacy@newandu.et) • Subject Line: Data Deletion Request • Initial Response SLA: Within 7 business days. • Complete Processing SLA: Within 30 calendar days.

Back to Sign In Privacy Policy & Cookies