Draft — not yet reviewed by a lawyer. This document (version 2026-10-21-draft-8) was prepared as a starting point for legal review, grounded in Ghana’s Data Protection Act, 2012 (Act 843), and has not been approved by counsel. Do not treat it as final, and do not rely on it as legal advice or as proof of regulatory compliance until a qualified lawyer has reviewed it.

Privacy Policy

Version 2026-10-21-draft-8 · Draft prepared 2026-09-06 · Scope: Ghana

This Privacy Policy explains how Quantum Fin collects, uses, and protects personal data. It is written for Ghana, under the Data Protection Act, 2012 (Act 843), and the Data Protection Commission’s guidance. [If a Business or its own customers are located outside Ghana, this policy needs jurisdiction-specific revision — flagged already in PROJECT_BRIEF.md as an open decision, since Nigeria (CBN) is in scope for the product generally even though this draft covers Ghana only.]

1. Two kinds of personal data, two different roles

Quantum Fin handles personal data in two distinct capacities, and your rights differ depending on which applies to you:

1.1 Your account data — we are the controller

If you are a person who signs up for or is invited to a Business’s Quantum Fin account (an owner, admin, staff member, or other team role), we are the data controller for your own account data: your name, email address, role, and login activity. This Policy governs that data directly.

1.2 Customer Data your Business enters — you are the controller, we are the processor

If your Business uses Quantum Fin to record information about its own clients, borrowers, susu contributors, guarantors, shareholders, or staff (“Customer Data”), your Business is the data controller for that information under Act 843, and Quantum Fin is a data processor acting only on your Business’s instructions. If you are one of your Business’s own customers and have a question about your data, you should contact that Business directly, not Quantum Fin — we do not have an independent relationship with, or send communications to, a Business’s customers.

2. What we collect

Account data: full name, email address, password (stored hashed, never in plain text), business role, and login/session records.
Business data: business name, category (MFB/CB/CU/Last-Mile Provider), currency, and compliance details you record (capital figures, shareholding, transition-deadline status).
Billing data: billing contact email and transaction records (amount, date, status) from Paystack. We do not receive or store your card number, expiry date, or CVV — Paystack processes and stores that directly.
Customer Data you enter (processed on your Business’s instructions, see Section 1.2): identity documents and ID numbers, date of birth, residential and employment details, phone/email, financial information (income, banking relationships, loan/savings/susu transaction history), next-of-kin, guarantor, and beneficial-ownership details, and any AML/sanctions-screening status you record.
Usage and audit data: an append-only log of consequential actions taken in your account (e.g. who approved a loan, changed a team member’s role, or edited compliance data), kept for security and accountability.

3. Why we process this data (legal basis)

Performance of a contract: to create your account, run the Service, and process billing.
Legal obligation: where your Business records AML/KYC screening or recordkeeping data because Ghanaian law requires it of your Business, we process that data as your processor to help you meet that obligation.
Legitimate interest: to secure the Service, investigate misuse, and maintain the audit trail described above — balanced against your rights, and not used to build advertising profiles.

4. Who we share data with

We do not sell personal data. We share it only as needed to run the Service:

Paystack (payment processing) — receives billing contact details and payment amounts; card data goes directly to Paystack, not through us.
Supabase (database and authentication hosting) — stores all account, business, and Customer Data on our behalf, under access controls we configure (see Section 6).
Regulators (e.g. Bank of Ghana, the Data Protection Commission) — only where legally compelled, or where your Business asks us to support a regulatory inquiry into its own account.
Other members of your own Business, according to the role-based access your Business configures — a staff member does not see everything an owner sees, and vice versa where roles are scoped narrower.

5. Where data is stored

Our database infrastructure is currently hosted with Supabase in the European Union (Ireland). This means personal data, including Customer Data your Business enters, may be stored and processed outside Ghana. [This is a material fact a lawyer needs to assess directly against Act 843’s cross-border transfer provisions — Ghana’s Data Protection Act generally requires that data transferred outside Ghana receive an adequate level of protection, whether by the receiving country’s laws or by contractual safeguards. This draft does not itself establish that those safeguards are in place; confirm Supabase’s own data-processing terms and whether additional contractual measures (e.g. standard contractual clauses) are needed before this policy is published as final.]

6. How we protect data

Every Business’s data is isolated from every other Business’s at the database level (row-level security), not just hidden in the app’s interface.
Data is encrypted in transit (HTTPS) and at rest.
Access within a Business is role-based — for example, only an owner, admin, or compliance-role team member can see certain sensitive compliance and billing records.
An append-only audit log records who did what and when for consequential actions, and cannot be edited or deleted by users, including administrators.

No system is perfectly secure, and we cannot guarantee against all possible unauthorized access, but the measures above are designed to substantially reduce that risk.

7. How long we keep data

We retain account data for as long as your account is active, and Customer Data for as long as your Business keeps it in the Service, or as configured by your Business. Certain AML/KYC-relevant Customer Data may need to be retained for a minimum period under law applicable to your Business (Ghana’s current guidance contemplates five years from the end of a customer relationship or transaction) — your Business is responsible for its own retention obligations; we retain what you keep in the Service for as long as you keep it there, or as this Policy’s termination provisions describe. [Confirm exact retention-after-termination period with counsel — this draft assumes data remains exportable for 30 days after account termination before deletion, matching the Terms of Service.]

8. Your rights under Act 843

If we are the controller for your data (Section 1.1 — your own account data), you have the right to:

Access the personal data we hold about you;
Request correction of inaccurate data;
Request deletion of your account data, subject to what we must keep for legal or security reasons;
Object to processing based on our legitimate interest; and
Lodge a complaint with Ghana’s Data Protection Commission.

If your data is Customer Data a Business entered about you (Section 1.2), direct your request to that Business — they are the controller and are responsible for responding. We will support a Business in fulfilling a valid request about its own Customer Data.

9. Cookies and similar technology

We use only the cookies needed to keep you signed in and to operate the Service (session/authentication cookies). We do not currently use third-party advertising or analytics tracking.

10. Children

The Service is intended for business use by adults acting for a Business, not for children. We do not knowingly collect data about children through account registration. [Customer Data entered by a Business — e.g. a minor beneficiary on a next-of-kin record — is that Business’s responsibility as controller; confirm with counsel whether any additional safeguard is needed here.]

11. Changes to this Policy

We may update this Policy. A meaningful change will be tracked as a new version, and we will ask you to re-accept it before continuing to use the Service, the same way you accepted this version.

12. Contact

Questions about this Policy or a data request: support@quantumfin.app · 17K Freeman Close, Off School Junction Road, Adjiringano, East Legon, Accra, Ghana (GD-113-3089). You may also contact Ghana’s Data Protection Commission directly: Digital Address GA-076-8230, Accra · info@dataprotection.org.gh · +233 (0)30 2631 455 [verify the exact street address and phone number against dataprotection.org.gh/contact immediately before publishing — this draft’s two independent lookups agreed on the digital address and email but differed on the building/floor description, so the street address has deliberately been left out here rather than risk an inaccurate one in a legal document].