Privacy policy

The club’s data and ours#

Most of the personal data in Kwessa belongs to a club: its members’ register, their payments and loans, its documents. For that data the club is the data controller: it decides who joins, what it records and why. Kwessa is the processor: we hold and process it only to provide the service the club has asked for, on the club’s instructions, and never for our own purposes.

Kwessa is the controller of a smaller set of data that we need to run our own business:

• messages, demo requests and sign-ups sent through our website;
• the accounts of club officers and other users, so far as we need them to sign people in, keep the service secure and support them;
• billing: the club’s plan, invoices and payments to us;
• the accounts of our own staff who operate the service.

If you are a member of a club and want to see, correct or remove your details, please ask your club first: it holds the relationship with you and decides what is recorded. We will help the club answer you, and you can always contact us directly (see Your rights).

We never hold your money#

Kwessa keeps records; it does not receive, hold or move a club’s money. Members pay into the club’s own mobile money and bank accounts, and the club pays out from them. If a club takes Mobile Money payments online, they go through its own Paystack account, straight to the club.

What Kwessa holds about a payment is the record of it: who paid, how much, when, by which method and reference, and the receipt it produced.

What we hold#

For clubs (the club is the controller)#

• Members’ register: names, phone numbers, email addresses, and whatever else the club chooses to record, such as date of birth, address, occupation, nationality and ID document (for example a Ghana Card number), next of kin or nominees, and mobile money or bank account numbers for paying members out.
• Photos: a member’s or user’s photo, if the club or the person adds one.
• Money records: contributions, payments and their receipts, fines, loans and repayments, savings, investments, dividends, payment vouchers, bank statements the club imports, and the club’s ledger.
• Governance: meetings and who is coming, minutes, resolutions and votes, polls, and the club’s documents such as its constitution.
• Payment reports: when a member reports a payment on WhatsApp by pasting a mobile money or bank SMS, or sending a screenshot or PDF receipt, we keep the text, the file, the number it came from and the details read from it, for the treasurer to confirm or reject.
• Joining requests: if the club lets people apply or complete their details on WhatsApp, the answers they give, kept as a request until an officer approves or refuses it.
• The audit trail: a record of who did what in the club’s books and when, with the device’s IP address and browser.

For users of the app#

Your name, email address (confirmed by a link we email, or by Google if you sign up with it), phone numbers if you add them, your role in each club, a password we store only as a one-way hash, your two-step sign-in settings if you turn it on (the secret encrypted), the devices you are signed in on, and when you last signed in.

From our website#

When you book a demo, sign up or send us a message, we keep what you type into the form: your name, email, and optionally your phone number, your club or organisation, its size and your message. Signing up also opens a club with you as its first administrator.

If you subscribe to our newsletter (at the foot of each page, by ticking the box on one of these forms, or in your Profile in the app), we keep your email address, where you subscribed, and when you confirmed and when you unsubscribed. Nothing else: not your name, and not whether you open the emails.

Only if you accept it on the banner, we count your visit with our analytics provider: the pages you view, the site or campaign link that brought you, which buttons you click (such as “Sign up” or “Book a demo”), whether a form went through, and your browser, device type and rough country. It also records how you move through each page (where you click and scroll, and the page as you saw it) so we can see where the site is confusing; anything you type into a form is hidden in these recordings. It then keeps a random id in a cookie, so a later visit counts as the same visitor, and if you then send a form, that id goes with it so we can see which visits lead to sign-ups. It never receives what you type into a form, and your IP address is not kept. The same consent lets Google Ads know when a visit that came from one of our ads ends in a sign-up, so we can see which ads bring clubs: Google receives that a sign-up happened, never your name, email or anything you type, and we don’t let it personalise ads with it. If you decline, nothing is sent; you can change your mind at any time with “Cookie settings” at the foot of each page.

When you use the service#

Our servers keep short technical logs of requests, including IP addresses, to keep the service secure and find faults; they are rotated automatically and overwritten after a short time. When something goes wrong, an error report is sent to our error-tracking service with the technical details and the ids of the club and user involved, never names, amounts, phone numbers, passwords or what was typed.

In the app, we record how it is used, to see which parts help clubs and where people get stuck: which pages are opened, setup steps started, imports run, searches used and features switched on, with the ids of your account and club and your role. These usage records go to our analytics provider, never with your name, email, phone number, amounts or anything you type, and the app sets no cookie or browser storage for them. We also record how the app is used on screen (where people click and scroll, and which pages they move between) to see where they get stuck: in these recordings every word, figure, photo and anything typed is hidden, so they show the shape of each page, never a name, an amount or a member’s details. Nothing is recorded while Kwessa’s support staff are viewing a club with its permission.

The WhatsApp assistant#

Clubs can let members use Kwessa on WhatsApp: ask their balance, what they owe or what the constitution says, get a receipt, report a payment, and, where the club turns these on, vote, answer polls, pay by Mobile Money or apply to join. The assistant recognises a member by the phone number the club has on record, and answers only from that club’s records and only with the member’s own figures. Officers who are allowed to see the club’s finances can also ask about them.

• No conversation history: we do not keep a record of what is said to the assistant. The software that connects WhatsApp keeps message texts for at most an hour (poll messages for a month, so votes can be counted), then deletes them. What we do keep is what the club needs: reported payments, votes, joining requests, and a member’s choice to stop messages.
• Voice notes: a member may ask a question by voice note. It is turned into text by Amazon Transcribe, answered as a question, and neither the recording nor the words are kept.
• Personal figures stay private: if someone asks about their own figures in a group, the answer is sent to them directly, not to the group.
• It does not write first, except for messages the club has chosen to send: an invitation to join, when the club’s officers invite that member; receipts, reminders, meeting notices and votes, only if the club turns them on (a member can reply STOP to stop them); notes to officers, such as a reported payment for the treasurer; and answers to a joining request.
• The AI cannot change anything: the language model only reads and answers. Anything that changes the club’s records, such as a reported payment, a fine or a vote, follows fixed steps, is checked by Kwessa against the person’s role, and where it involves money waits for an officer to confirm it.

To write an answer, the question and the facts needed to answer it (for example the member’s first name and balance, or a passage of the constitution) are sent to a language model on Amazon Bedrock, run by Amazon Web Services. Bedrock does not keep them or use them to train models, and we have not turned on any logging of these requests. The text of a payment screenshot or PDF is read by Amazon Textract, not by the language model.

Messages sent on WhatsApp travel through WhatsApp, a service run by Meta. A club connects its own WhatsApp number either by linking it to software we host ourselves, or through Meta’s WhatsApp Business Platform (the Cloud API). Either way, WhatsApp’s own terms and privacy policy apply to messages on its network.

Why we use it#

• To provide the service to clubs: keeping their records, producing receipts, statements and reports, sending the emails and WhatsApp messages the club has set up, and answering members’ questions. We do this under our contract with the club, and on its instructions.
• To run accounts and keep them secure: signing people in, protecting against misuse, keeping the audit trail. This is necessary for the contract and in our legitimate interest in a secure service.
• To reply to people who contact us through the website, and to follow up a demo request or sign-up. You started the conversation; we use what you sent only for it.
• To send our newsletter, only to people who asked for it, with their consent: an address typed on the website gets nothing until it confirms with the link we email to it, and every issue has a link to unsubscribe in one click. We never add anyone to it because they contacted us, signed up or use the app.
• To understand and improve Kwessa: counting visits to our website, with your consent, and how the app is used, in our legitimate interest in making a service clubs find useful. Neither is used to advertise to anyone.
• To bill clubs for their subscription, and to keep the accounting records the law requires of us.
• To meet legal obligations, such as a lawful request from a regulator or court.

We do not sell personal data, rent it out, or use it for advertising. We do not use members’ data to train AI models.

When our staff see club data#

Our staff run the service from a separate operations console that shows each club’s account, its officers, its billing and the health of the service, not its books or members’ register. To look at a club’s records, for example to help with a problem, a club administrator must first grant support access in Settings, for 1, 24 or 72 hours. Even then it is read-only, lasts at most 30 minutes at a time, and every page viewed is written to the club’s audit trail.

Who helps us run Kwessa#

We use a small number of service providers. Each handles personal data only to provide its service to us:

• Amazon Web Services (AWS): our servers, the database and search index on them, file storage for photos, logos and documents, and our backups. AWS also provides Amazon Bedrock (the WhatsApp assistant’s answers and searching the club’s documents), Amazon Textract (reading payment screenshots and receipts) and Amazon Transcribe (voice notes).
• Resend: sends our emails, such as receipts, statements, password links, invoices and our newsletter.
• Meta (WhatsApp): carries WhatsApp messages and, for clubs that choose it, provides the WhatsApp Business Platform.
• Paystack: takes clubs’ payments of their Kwessa invoices online. A club that takes Mobile Money payments from members uses its own Paystack account, under its own agreement with Paystack.
• Sentry: receives the error reports described above, with personal details removed.
• Google (sign-in): only if you choose “Continue with Google” to sign up or sign in. Google tells us your name and confirms your email address; we never get your Google password, and Google’s script loads only on the sign-up and sign-in pages.
• Google (Google Ads): only with your consent on the website, learns when a visit from one of our ads ends in a sign-up, as described above.
• Our analytics provider (EU): counts website visits and records how pages are used (only with your consent), and records how the app is used, with the masked recordings described above, on servers in the European Union.

We use no social media trackers, and none in the app. On the website, Google Ads’ conversion cookie (only with your consent) is the one advertising service, and it is not used to show you ads.

Data outside Ghana#

Kwessa is hosted outside Ghana: our servers and storage are in AWS’s EU (Ireland) region, with a copy of our backups in its EU (Frankfurt) region, and Bedrock, Textract and Transcribe run in its UK (London) region. Our email, payment, WhatsApp and error-tracking providers may also process data in other countries; our analytics provider keeps it in the European Union. We choose providers that protect data to a standard at least as high as Ghanaian law requires, and we rely on their contractual commitments to do so. By choosing Kwessa, a club instructs us to host its data in this way.

How long we keep it#

Club records are financial records, and a club’s books must be complete to be trusted. So Kwessa does not erase them in the ordinary course: when a member leaves, they are marked as having left and their history stays in the club’s books; a user who no longer needs access is disabled, not deleted. The audit trail is never altered or deleted.

• While a club uses Kwessa: we keep its records for as long as it is a customer, including while it is read-only for unpaid fees.
• When a club leaves: it is given a full export of its records first. We then keep them for 7 years from the day it closes, as financial records are kept, so that it can ask for a copy, and delete them after that unless the law requires us to keep them longer.
• Backups: copies of the database are kept for 30 days. Earlier versions of files (photos, logos, documents) are kept for 30 days after they are replaced.
• Exports: a full export a club downloads is kept for 30 days.
• Audit anchors: a signed fingerprint of each club’s audit trail, which holds no personal data, is kept for seven years in storage that cannot be changed.
• Website messages and requests: kept while we are in touch with you about them, and deleted when you ask us to.
• Newsletter: your address is kept while you are subscribed. After you unsubscribe we keep only the address and that you unsubscribed, so that you are never sent it again by mistake; ask us and we will delete that too. An address that never confirms is deleted on request.
• Server logs: rotated automatically and overwritten, usually within days.

How we protect it#

Connections are encrypted, disks and storage are encrypted at rest, passwords are hashed, every club’s data is kept apart from every other’s, and the books are tamper-evident. Our security page explains each measure. If a breach of security puts your personal data at risk, we will tell the club, and where the law requires it the Data Protection Commission and the people affected, as soon as we reasonably can.

Your rights#

Under the Data Protection Act, 2012 (Act 843) you have the right to:

• be told whether we hold personal data about you, and get a copy of it;
• have inaccurate, out-of-date or incomplete data corrected, and data held unlawfully deleted;
• object to processing that causes you damage or distress;
• stop your data being used for direct marketing: our newsletter is the only marketing we send, only if you asked for it, and its unsubscribe link stops it at once;
• not be subject to decisions made purely by automated means that significantly affect you (Kwessa makes none: the club’s officers make every decision about members);
• complain to the Data Protection Commission.

If you are a club member, ask your club first: it controls your data, can correct most of it straight away and can give you a copy of everything it holds about you. If it cannot help, or you prefer, contact us and choose “Privacy or data request”. We will answer within the time the law allows, and may need to confirm who you are first. Where your data belongs to a club, we will pass your request to the club and help it answer.

Because a club’s books must stay complete, some requests to delete financial records may be refused where the club or we must keep them by law. We will tell you why.

Children#

Kwessa is not for anyone under 18: users of the app and of the WhatsApp assistant must be adults. A club that records details about a child, for example as a member’s next of kin or nominee, is responsible for having a lawful basis to do so.

Changes to this policy#

We will update this policy when the service or the law changes, and change the date at the top. If a change affects how we handle club data, we will tell each club’s administrators by email before it takes effect.

Contact us#

For anything about privacy or your data, send us a message with the topic “Privacy or data request”, email hello@kwessa.club, or call +233 20 682 4855.

If you are not satisfied with our answer, you can complain to the Data Protection Commission of Ghana.