Privacy Policy

APPSTRACT LABS LTD, registered in Ghana under company registration number CS072030426. Registered office: No. 2 Peach Street, Accra, Ga East, Greater Accra, Ghana. Digital address: GE-310-1533.

This policy explains how APPSTRACT LABS LTD (“AppStract”, “we”, “us”) handles personal data when you use AppStract SMS, our website, dashboard and API. We handle it in line with the Data Protection Act, 2012 (Act 843) of Ghana.

We act in two roles. For information about you and your account, we decide why and how it is used, so we are the data controller. For the phone numbers and message content of your Recipients, you decide why and how it is used, so you are the controller and we process it on your behalf and on your instructions.

• Account details you give us: your name, email address, mobile number, business name, and a password (we store only a one-way hash of it). If you turn on two-factor authentication we store the secret and recovery codes in protected form.
• Business and identity documents: when you request a Sender ID or when we need to verify you, the documents you upload, for example business registration or identification.
• Payments: we record the amount, date, reference and status of each top-up. Payments are handled by our payment processor, and we do not store your card or mobile-money PIN details.
• Messages: the recipient phone numbers, message text, sender name, time, status, cost, network and delivery reports for messages you send, together with your references and webhook activity.
• Support: the tickets you open and what you write in them.
• Technical data: IP address, browser or device type, API keys’ identifiers and usage, and logs of sign-ins and account actions that we keep for security.
• Cookies: we use a small cookie that keeps you signed in. We do not use advertising cookies.

• To provide the Services: create and secure your account, send your messages, track delivery, bill you and give you support. (Reason: to perform our contract with you.)
• To keep the Services safe and to prevent fraud, spam and abuse, including reviewing suspicious traffic. (Reason: our legitimate interest in protecting the Services, and our legal obligations.)
• To meet legal, regulatory and mobile-network requirements, including identity checks and record keeping. (Reason: legal obligation.)
• To send you service messages, such as verification codes, receipts, low-balance and security notices, and replies to your tickets. (Reason: contract and legitimate interest.)
• To tell you about our own products and offers, which you can opt out of at any time. (Reason: your consent or our legitimate interest.)
• To improve the Services using aggregated or anonymous statistics. (Reason: legitimate interest.)

We do not sell your personal data, and we do not use your Recipients’ phone numbers for our own marketing.

We share personal data only where we need to, and we ask those who receive it to keep it confidential and secure:

• Messaging partners and mobile network operators, who need the recipient number, sender name and message text to deliver a message.
• Service providers that help us run the Services, such as payment processing, email delivery, hosting, file storage and the tools we use to alert our team.
• Authorities and regulators, courts and law enforcement, when the law requires it or to protect rights, property or safety.
• A buyer or successor, if our business is reorganised or sold, subject to this policy.

Some of these providers may process data outside Ghana. When they do, we take steps to make sure the data stays protected in line with the law.

We keep personal data only as long as we need it for the purpose we collected it for, and then delete it or anonymise it so that it can no longer identify anyone. Specifically:

• Message text is removed from our records 90 days after the message is sent. We keep the record that a message was sent, with its recipient, cost and status, for as long as we need it for billing, disputes and legal or regulatory reasons.
• One-time-password request records are deleted after 30 days.
• Webhook delivery logs are deleted after 30 days.
• Account and security activity logs are kept for 2 years.
• Account details, payments and tickets are kept while your account is open and afterwards for as long as the law and our accounting obligations require, then deleted or anonymised.

You can ask us for more detail about retention periods using the contact details below.

We use encryption in transit (TLS), store passwords only as one-way hashes, protect stored provider and account secrets, offer two-factor authentication, limit staff access to what they need, and keep logs of sensitive actions. No system is completely secure, and no transmission over the internet can be guaranteed to be 100% secure, so please also protect your own password, API keys and devices.

If we become aware of a breach that affects your personal data, we will tell you and the authorities as the law requires.

Under Act 843 you have the right to:

• be told what data we hold about you, how we use it, how long we keep it and who we share it with;
• ask for a copy of the data we hold about you;
• correct data that is wrong or incomplete;
• ask us to delete your data in certain circumstances;
• ask us to restrict how we use your data;
• object to certain uses, such as direct marketing;
• ask us to move your data to another provider where this applies.

To use any of these rights, open a support ticket or email [email protected]. We may need to confirm who you are first. If you are not happy with how we handle your request, you may complain to Ghana’s Data Protection Commission.

If you are a Recipient of a message, the business that sent it decides why your number was used. Please contact that business first. We will help them respond to you.

The Services are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will delete it.

We send service messages that you need to run your account. You can stop marketing emails by clicking the unsubscribe link or by contacting us. You cannot opt out of essential service and security messages while you have an account.

We may update this policy. We will post the new version here and, for changes that matter, email you or tell you in the dashboard. If you keep using the Services after the change, you accept it.

APPSTRACT LABS LTD. Privacy and data requests: [email protected]. General support: [email protected].