1. Controller and contact
KSquare GHInvest LTD is the data controller for GHInvest account, wallet, social-market and website data. Contact our privacy team at legal@ghinvest.app or write to KSquare GHInvest LTD, 25 Independence Avenue, Accra, Ghana.
2. Information we collect and its source
- Account information — information you provide, including name, email address, phone number, username, country and age confirmation.
- Identity verification (KYC) — if KYC is enabled and required, information you submit to our identity-verification or regulated brokerage partner, which may include government ID details and images, a selfie or liveness media, date of birth, address, nationality and financial profile. GHInvest is designed to retain the provider reference, result and timestamps rather than copies of ID or biometric media.
- Financial information — your wallet balance, transaction history, deposits, withdrawals, transfers, and the payment or payout methods you link. Card, bank and mobile-money details are handled by our payment partners.
- Activity and content — markets, trades, portfolio data, friends, reports and messages you create in the Service.
- Technical data — device/app identifiers, app version, IP address, security events, crash diagnostics and usage data collected from your device and our service providers. Optional website analytics is stored only as daily totals by page category and event.
- Launch-list information — if you join the early-access list on our website, your name, email address, consent choice, and signup time.
3. Why we process it and our authority
- Contract and requested services — to register and authenticate you, operate your account, process requested transactions, provide receipts and customer support.
- Legal obligations and permitted statutory purposes — identity, age, tax, accounting, anti-money-laundering, fraud investigation and regulatory reporting where applicable.
- Necessary security interests — to secure accounts, prevent abuse, diagnose failures and protect users and the Service, subject to your right to object where the law applies.
- Consent — optional marketing, optional scam-call monitoring, optional website analytics, and creation of a public receipt link. Consent can be withdrawn without affecting earlier lawful processing.
4. What is mandatory
Name, a valid email address and phone number, age eligibility and authentication information are required to create and secure an account. Transaction details and any legally required KYC information are required only when you use the relevant financial feature. If required information is not provided, we cannot create the account or provide that feature. Username and profile photo are optional. Discoverability, push notifications, marketing and scam-call monitoring are off until you enable them, and a public receipt exists only after you deliberately create a share link. Declining push notifications does not prevent you from viewing service notices in the app.
5. Recipients and service providers
We do not sell personal data. Depending on the feature you choose, data may be disclosed to:
- Google / Firebase for authentication, cloud storage/database, hosting, App Check and reCAPTCHA security, notifications, crash diagnostics, and storage of optional aggregate website analytics.
- Twilio/SendGrid and Meta/WhatsApp for email or phone verification and service communications.
- Paystack, banks, card networks and mobile-money providers for payments and payouts.
- Smile ID for identity verification, and IC Wealth or another identified licensed broker only if you choose a brokerage service.
- Professional advisers, auditors, courts and Ghanaian authorities, including the DPC, FIC, SEC, GRA or Bank of Ghana, where lawfully required.
6. Public and social information
Your username, display name, profile photo and public market content may be visible to other signed-in users according to your discoverability and sharing settings. A transaction receipt remains private when opened. If you choose “Create link & share” and confirm the warning, a limited receipt becomes accessible to anyone with its unguessable link or QR code for up to 30 days; you can revoke it from the receipt. Do not share the link with someone who should not see the amount or payment details.
7. International transfers
Some providers process data outside Ghana. We assess the destination and provider, limit the transferred data, and use contractual and security safeguards required by Act 843. Contact us for information about the safeguards relevant to a particular provider.
8. Retention and account deletion
Account and social data is kept while the account is active, then deleted when a valid deletion request completes. Public receipt links expire after approximately 30 days or earlier if revoked. Short-lived verification and security records expire under operational schedules. Optional aggregate website analytics expires after no more than 14 months. When law requires financial, accounting, AML, tax or claims records to remain after closure, GHInvest removes direct identifiers and keeps only a minimised record linked by a new random erasure reference for the approved retention period. Provider-held information is governed by the applicable provider agreement and retention schedule. We review and delete or irreversibly de-identify data when its purpose and legal retention period end.
9. Your rights
Subject to Act 843, you may ask whether we hold your data, obtain a copy and source information, correct or delete inaccurate data, object to particular processing, stop direct marketing, withdraw consent, and complain about an automated decision with a significant effect. The in-app export is a self-service copy of listed GHInvest data; use an access request for provider records, third-party data or material that requires legal review. Account deletion has a 24-hour cancellation period and may pause while a deposit or payout is still settling. Contact legal@ghinvest.app to exercise a right. We may verify your identity and will respond within the period required by law.
10. Security and breach notification
Controls include encryption in transit and at rest, role-based access, App Check, optional two-factor authentication, an optional in-app lock, logging and data minimisation. No system is completely secure; keep passwords and verification codes private. If personal data is accessed or acquired by an unauthorised person, we will notify the Data Protection Commission and affected people as soon as reasonably practicable where Act 843 requires it.
11. Optional scam-call monitoring
If you switch on Scam-call monitoring in Settings, Android asks for phone-state permission and tells GHInvest only whether a call is active so the app can display a warning. GHInvest does not receive the caller’s name or number, your contacts, or call audio. The feature is off by default and can be switched off at any time.
12. Website privacy choices and analytics
The website stores your analytics choice in your browser’s local storage so it can remember it; GHInvest’s analytics does not set an analytics cookie. Necessary App Check and reCAPTCHA protections may run when a form or public-data request needs protection, regardless of your analytics choice. Only after you select “Allow analytics” does the browser send an event name and a normalised page category to our own endpoint. We do not send names, email addresses, advertising identifiers, referrers, query strings, URL fragments, market IDs, receipt IDs or invitation tokens. Results are stored as daily totals rather than visitor-level records. Select “Privacy choices” on the website to change your decision; withdrawal stops future analytics events, although already aggregated totals cannot be linked back to you.
13. Children
GHInvest is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18.
14. Automated processing
Automated systems perform security and eligibility checks, calculate market prices and process supported transactions. These processes may affect access to services or financial outcomes. Contact legal@ghinvest.app to request an explanation, challenge an outcome or seek human review under the rights provided by Act 843. Live equity limit execution is not currently enabled.
15. Changes and complaints
We will show material changes before they take effect where required; consent is requested again when a new purpose requires it. You may complain to the Data Protection Commission of Ghana or contact our privacy team using the details in section 1.
16. Order records and service emails
Limit-order previews remain on the trade screen and are not accepted orders. For supported orders, we process account and transaction references, the market or security, side, quantity, price, status and timestamps to provide the requested service and maintain records. Service emails use your verified account email and our email provider; they are separate from optional marketing. Delivery records include event references and delivery status. Pending order records are private to the account and are not made public by trade-sharing preferences. Record retention and access requests follow sections 8 and 9. A future broker service will identify its recipient, safeguards and retention arrangements before activation.