AjumaFlow is operated by DenniDigital, a software company registered in Ghana. This Privacy Policy explains how we collect, use, and protect information when you use AjumaFlow. It is written in plain English and complies with Ghana's Data Protection Act, 2012 (Act 843).
1. Information We Collect
a) Account Information
When you create an account, we collect:
- Phone number — used as your primary login identity via SMS one-time code
- Email address — if you choose email login or add a recovery email
b) Business Information
During setup and as you use the app, we collect:
- Business name, type (industry), and physical location
- Business logo you upload
- GRA Tax Identification Number (TIN) if entered on invoices
c) Financial & Operational Data
AjumaFlow is a business management tool. The core of what we store is the data you enter to run your business:
- Income and expense records, cashbook entries
- Invoices, quotes, and sales orders
- Stock items, inventory movements, and valuations
- Customer and supplier profiles, credit balances, and contact details
- Payroll records including staff salaries, SSNIT contributions, and PAYE calculations
- Staff accounts, roles, and PIN credentials
- Industry-specific records (e.g. salon appointments, restaurant orders, tailor measurements)
d) Usage Data
We automatically collect limited technical data to keep the service running:
- Browser type, device type, and operating system
- Pages visited and features used within the app
- IP address and approximate location (country/region)
- Error logs to diagnose crashes and bugs
We do not use third-party advertising trackers or sell your data to advertisers.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve AjumaFlow
- Authenticate you securely via SMS or email OTP
- Generate financial reports, invoices, payslips, and other documents for your business
- Send you important account notifications (security codes, subscription alerts)
- Respond to your support requests
- Comply with legal obligations under Ghanaian law
- Detect and prevent fraud, abuse, or unauthorised access
We do not use your financial or business data for any purpose beyond operating the service for you. We do not mine or profile your business data for marketing or resale.
3. Data Sharing & Processors
We do not sell your data. We share it only with the following sub-processors who help us deliver the service, each bound by data processing agreements:
| Processor | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, file storage | All business & account data |
| Vercel | Application hosting & delivery | Request logs, IP addresses |
| Paystack | Subscription billing | Name, email, payment amounts |
| SMS providers (Arkesel / Hubtel / mNotify) | Bulk SMS campaigns you initiate | Phone numbers you provide |
| WhatsApp Business API | WhatsApp campaigns you initiate | Phone numbers you provide |
We may also disclose information if required by Ghanaian law, court order, or a lawful request from a government authority.
4. Data Security
We take security seriously and implement the following measures:
- All data is encrypted in transit using TLS 1.2+
- Data at rest is encrypted by our database provider (Supabase / PostgreSQL)
- Authentication is passwordless — no passwords are stored
- Row-level security (RLS) ensures each business can only access its own data
- Staff accounts are PIN-protected with role-based access controls
- We do not store full payment card numbers — billing is handled entirely by Paystack
No system is 100% secure. If you suspect unauthorised access to your account, contact us immediately at legal@ajumaflow.com.
5. Data Retention
We retain your data for as long as your account is active. If you close your account:
- Your data is soft-deleted and inaccessible within 30 days
- Financial records (invoices, payroll, tax reports) may be retained for up to 7 years to meet Ghanaian tax and accounting regulations
- Backups are purged on a rolling 90-day schedule
You can request early deletion of personal data (excluding legally required records) by contacting legal@ajumaflow.com.
6. Your Rights
Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate or incomplete data
- Deletion — request deletion of your personal data (subject to legal retention requirements)
- Objection — object to how we process your data in certain circumstances
- Portability — request your business data in a machine-readable format
To exercise any of these rights, email us at legal@ajumaflow.com with your account phone number or email. We will respond within 21 days as required by Act 843.
You also have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe we have mishandled your data.
8. Children's Privacy
AjumaFlow is a business management platform intended for adults running businesses. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with data, contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via an in-app notice or email at least 14 days before the changes take effect. Continued use of AjumaFlow after the effective date constitutes acceptance of the updated policy.
The date at the top of this page always reflects the most recent revision.
10. Contact Us
For privacy questions, data requests, or concerns: