Privacy Policy

This policy explains what personal data [PaalTech registered company name] ("PaalTech", "we") handles in PaalChat, why, and your rights. It applies from [date]. We are registered with Ghana's Data Protection Commission ([Data Protection Commission registration number]) and follow the Data Protection Act, 2012 (Act 843).

Two kinds of data

• Account data - about the businesses and team members who use PaalChat. For this, PaalTech is the data controller.
• Customer data - the messages, contacts and conversations of the people your business talks to. For this, your business is the controller and PaalTech processes it on your behalf under our Data Processing Terms.

Account data we collect

• Name, work email, phone number, business name, and the role of each team member.
• Sign-in information: password (stored only as a hash), two-step sign-in settings, sign-in times and IP addresses for security.
• Billing details: plan, invoices and payment status. Card and mobile-money details are handled by Paystack; we never see full card numbers.
• How you use PaalChat: actions in the dashboard and API calls, kept in audit and request logs.

We use it to provide and secure PaalChat, verify accounts, prevent abuse, bill, support you, and tell you about changes to the service. The legal bases are our contract with your business, our legitimate interest in a secure service, and legal obligations.

Customer data we process for businesses

• Contact details (phone number, name, email), message content, delivery statuses, tags, notes and consent records.
• Message text is kept for one year by default; each business can choose between 7 days and 10 years. After that the text is removed and only who, when and delivery status remain.
• PaalChat operators at PaalTech can see counts and statuses for support - not message text.

Who we share data with

Only as needed to run the service:

We do not sell personal data. We may disclose data when the law requires it.

Transfers outside Ghana

Some providers above process data outside Ghana. We use providers that protect personal data to standards comparable to Ghanaian law and limit what they receive.

Security

Data is encrypted in transit; message content, access tokens and secrets are also encrypted at rest. Access is limited by role, sign-ins can use two-step verification, and actions are logged.

Your rights

Under the Data Protection Act you can ask to access, correct or delete your personal data, object to its processing, or ask what we hold. For customer data, contact the business you messaged - we will help them answer. For account data, write to privacy@paaltech.org. You can also complain to the Data Protection Commission of Ghana.

Contact

[PaalTech registered company name], [registered address], Ghana. Privacy questions: privacy@paaltech.org.