Privacy policy

1. Who controls your data

X - True West Media Consult is the data controller for the personal data described here. We process personal data in accordance with Ghana's Data Protection Act, 2012 (Act 843).

2. Data we hold about you, our customer

Account data

Your name, business name, email address, phone number and country. Collected at registration so we can identify your account and contact you. Kept while your account is open.

Authentication data

A one-way hash of your password (we never store the password itself), password-reset tokens, and your API key. Kept while your account is open.

Billing data

Your message-credit balance, every top-up and every charge, with references and timestamps. We are required to keep financial records, so this is retained for six years after your account closes. We do not store your card number, expiry date or CVV; those go directly to our payment provider.

Message data

The content of the messages you send, the recipient numbers, and the delivery outcome for each. This is needed to deliver the message, to bill you accurately and to resolve disputes. Retained for 12 months, then deleted.

Contact lists

Any phone numbers and names you save into contact groups. These stay yours. We use them only to send the messages you ask us to send, and we delete them when you delete them or close your account.

Technical and security data

Your IP address and a record of sign-ins, sign-in failures and significant account actions. Used to detect fraud and abuse. Kept for 12 months.

3. Data about your message recipients

When you upload or paste phone numbers, you are the controller of that data and we are your processor. We act on your instructions only. You are responsible for having a lawful basis to message those people, and for holding their consent where consent is required. See our acceptable use policy.

We do not sell recipient numbers, do not use them to market anything of our own, and do not share them with other customers. If a recipient contacts us directly, we will tell them which of our customers sent the message so they can exercise their rights with you.

4. Why we are allowed to process this data

• To perform our contract with you: running your account, sending your messages, taking payment.
• Legal obligation: keeping financial records, and responding to lawful requests from the National Communications Authority, the police or a court.
• Legitimate interest: securing the service against fraud and abuse.

We do not use your data for advertising, and we do not do any automated decision-making that produces legal effects for you.

5. Who we share data with

• Our SMS delivery partner, which receives the message text, the sender ID and the recipient number, because that is what delivering a message requires. They in turn pass it to the recipient's mobile network.
• Our payment provider, which receives your email and the amount in order to take payment. They handle your card details; we never see them.
• Our hosting provider, which stores the data on our behalf.
• Regulators and law enforcement, where we are legally required to.

We do not sell personal data to anyone, ever.

6. Where your data is held

Data is stored on servers operated by our hosting provider. Some of our providers process data outside Ghana. Where that happens we rely on contractual protections requiring them to keep the data secure and to use it only for the service they provide to us.

7. How we protect it

• Traffic is encrypted in transit using HTTPS.
• Passwords are stored only as bcrypt hashes and cannot be reversed by us.
• API keys can be revoked and reissued by you at any time.
• Sign-in attempts are rate-limited, and account actions are logged.
• Access to production data is restricted to staff who need it to run the service.

8. Your rights

Under Act 843 you may ask us to: confirm what data we hold about you; give you a copy of it; correct anything inaccurate; delete data we no longer have a lawful reason to keep; or stop a particular kind of processing.

Email support@kwiksend.app from your account address. We respond within 30 days. If you are not satisfied, you may complain to Ghana's Data Protection Commission.

Note that we cannot delete billing records before the six-year retention period ends, because we are required by law to keep them.

9. Cookies

We set one cookie, a session cookie, so that you stay signed in while you use the app. It is removed when you sign out or when the session expires. We do not use advertising cookies, and we do not run third-party trackers on the signed-in areas of the site.

10. Changes and contact

If we change this policy we will post the new version here and notify account holders by email where the change is material. Questions go to support@kwiksend.app or the address on our contact page.