Privacy Policy — Akonta AI

Plain language summary: We collect your business transaction data so we can power your bookkeeping, send payment links via messaging channels, and process payments via Paystack. We never sell your data to third parties. You can request deletion at any time by emailing privacy@akonta-ai.com.

Who we are

Amagold Technologies Ltd. ("we", "us", "our") is a technology company registered in Ghana. We operate Akonta AI — an AI-powered bookkeeping assistant that helps small business owners record transactions, track profit and loss, and build credit-ready financial records via chat.

Data controller: Amagold Technologies Ltd., Accra, Ghana. For privacy enquiries: privacy@akonta-ai.com

What data we collect

2.1 Data you give us directly

Data type	Examples	Where collected
Account information	Business name, email, WhatsApp number	Registration
Product catalogue	Product names, descriptions, prices, images	Vendor dashboard
Transaction records	Sales, expenses, stock purchases, credit sales, withdrawals	Chat logging, auto-sync from orders
Customer data	Customer WhatsApp/Telegram numbers, order details	Order flow
Team members	Name, role, phone/email of staff added to workspace	Team setup
Payment information	Bank account details for Paystack subaccount settlement	Onboarding

2.2 Data collected automatically

Data type	Purpose
Inbound messages (WhatsApp / Telegram)	Process orders and bookkeeping entries
Payment webhook events (Paystack)	Confirm payment status and update ledger
Device and browser information	Improve dashboard performance
Usage analytics (anonymised)	Understand how features are used
Error and crash logs	Fix bugs and improve reliability

2.3 Data we do NOT collect

We do not collect payment card numbers — all card processing is handled directly by Paystack.
We do not read private WhatsApp or Telegram conversations beyond messages sent directly to our platform number.
We do not collect location data unless you explicitly share it.

How we use your data

Purpose	Data used	Legal basis
Deliver the order and payment flow	Customer phone, order items, payment ref	Contract performance
Auto-log sales to Akonta bookkeeping ledger	Confirmed order amount, product, timestamp	Contract performance
Generate financial reports and AI insights	Ledger entries, expense records	Contract performance
Send payment links and receipts via WhatsApp/Telegram	Customer phone number, order amount	Contract performance
Process Paystack subaccount settlements	Bank account details, transaction refs	Contract performance
Provide credit-readiness score (Growth plan)	Ledger history, consistency, classification	Consent (explicit opt-in)
Send upgrade prompts and product notifications	Plan level, usage patterns	Legitimate interest
Improve our AI models and product features	Anonymised, aggregated usage data	Legitimate interest
Comply with legal obligations	Transaction records, identity	Legal obligation

Credit-readiness sharing requires your explicit consent. If you are on the Growth plan and wish to share your financial records with a lender or MFI, you will be shown a separate consent screen. We will never share your financial records without your active approval.

Who we share data with

We do not sell your data. We share data only with the following categories of parties, for the purposes described:

Party	What is shared	Why
Paystack	Transaction amount, reference, subaccount code	Payment processing and settlement
Meta (WhatsApp Cloud API)	Customer phone number, message content sent by our platform	Message delivery
Telegram	Chat ID, message content sent by our platform	Message delivery
Anthropic (AI inference)	Anonymised transaction context for insight generation	AI bookkeeping responses
Cloud hosting (Railway / Cloudflare)	All platform data	Infrastructure and storage
MFIs / Lenders	Consented financial report only	Credit-readiness — Growth plan, explicit consent required
Accountants	Read-only books access via sharing link	Growth plan feature — vendor controls access
Legal authorities	As required by law	Legal obligation

All third-party processors are bound by data processing agreements. We require them to handle data securely and only for the stated purpose.

How we store and protect data

Encryption in transit: All data is transmitted over HTTPS/TLS 1.2 or higher.
Encryption at rest: Database and file storage are encrypted at rest using AES-256.
Access controls: All data is scoped by tenant ID. No vendor can access another vendor's data. Access is enforced at the API middleware layer and verified at the database query layer.
Password security: Passwords are hashed using bcrypt with a minimum cost factor of 12. We never store plain-text passwords.
API authentication: All API access requires a signed JWT token. Webhook payloads from Paystack and Meta are verified using HMAC-SHA256 before processing.
Regular backups: Database backups are taken daily and retained for 30 days.
Breach notification: In the event of a data breach affecting your personal data, we will notify you and the relevant authority within 72 hours where required by law.

How long we keep data

Data type	Retention period	Reason
Account and profile data	Duration of account + 90 days after deletion	Allow reactivation; legal grace period
Transaction and ledger records	7 years from transaction date	Ghana tax and financial record requirements
Order and payment records	7 years	Financial and legal compliance
Customer WhatsApp/Telegram numbers	Duration of vendor account	Order history reference
Chat message content	90 days from message date	Dispute resolution; then purged
Error and crash logs	30 days	Debugging only
Anonymised usage analytics	Indefinite	Product improvement

When you delete your account, we begin a 90-day grace period. After 90 days, your personal profile and chat data are permanently deleted. Transaction records are retained in anonymised form for the statutory 7-year period.

Your rights

You have the following rights over your personal data. To exercise any of these rights, email privacy@akonta-ai.com. We will respond within 30 days.

👁 Access

Request a copy of all personal data we hold about you.

✏️ Correction

Request that inaccurate or incomplete data be corrected.

🗑 Deletion

Request deletion of your personal data (subject to legal retention obligations).

📦 Portability

Request your transaction data exported in CSV or JSON format.

🚫 Objection

Object to processing based on legitimate interest, including marketing messages.

🔒 Withdraw consent

Withdraw consent for credit-readiness sharing at any time without affecting other services.

To exercise any right: Email privacy@akonta-ai.com with the subject line "Data Request — [Your business name]". We will verify your identity and respond within 30 days.

WhatsApp and Telegram

Akonta AI operates via Meta's WhatsApp Cloud API and the Telegram Bot API. By using our services through these channels, you should be aware of the following:

Message routing: Messages sent to our platform numbers are received by our servers, processed, and responded to automatically. We do not read your conversations with other contacts.
Meta's data practices: WhatsApp and Meta have their own privacy policies governing the WhatsApp platform itself. Our policy covers only what we receive and process. See WhatsApp's Privacy Policy.
Telegram's data practices: Similarly, Telegram's privacy policy governs the Telegram platform. See Telegram's Privacy Policy.
Customer numbers: When a customer places an order via WhatsApp or Telegram, their phone number or chat ID is stored to enable order management, payment link delivery, and receipts. Customers may request deletion of their data by contacting the vendor, who can action the request through their dashboard.
24-hour window: For WhatsApp, we only send messages within the 24-hour customer service window or using pre-approved message templates, as required by Meta's policies.

Payments via Paystack

Payment processing is handled entirely by Paystack (a Stripe company). We integrate with Paystack in the following ways:

We create a Paystack subaccount for each vendor during onboarding to enable direct settlement to the vendor's bank account.
We generate Paystack payment request links and share them with customers via WhatsApp or Telegram.
We receive webhook notifications from Paystack when a payment is completed, which we use to update order status and auto-log the sale to the vendor's Akonta ledger.

We never see or store card numbers, CVVs, or full bank account details. All sensitive payment data is handled directly by Paystack under their PCI-DSS compliance. See Paystack's Privacy Policy.

Children's data

Akonta AI is a business tool intended for use by adults operating small businesses. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has registered an account, please contact us at privacy@akonta-ai.com and we will delete the account promptly.

Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Send a notification to your registered WhatsApp or Telegram number at least 14 days before the change takes effect.
For significant changes affecting how we use your data, request fresh consent where required.

Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

Questions about your privacy?

Reach our data protection contact directly. We respond within 2 business days.

✉ privacy@akonta-ai.com Support centre →

Amagold Technologies Ltd. · Accra, Ghana · Company Reg. No. [REG NUMBER]