Privacy Policy

Inclusive App craft ("we", "us", "our") is a technology company registered in Ghana, operating from Accra. This Privacy Policy explains what personal information we collect through this website and our services, how we use it, who we share it with, and the rights you have. It applies to visitors of inclusiveappcraft.com, subscribers to our newsletter, and prospects or clients who engage us for consulting, design, engineering, training, or product access.

We comply with the Ghana Data Protection Act, 2012 (Act 843), and, where applicable to visitors from Europe, the EU/UK GDPR. Where these regimes differ, we apply the stricter standard.

1. Data controller

The data controller is Inclusive App craft, contactable at [email protected] or +233 59 986 8755. Postal address: University of Ghana IT Directorate (UGITD), ATL Building, Legon, Accra, Ghana.

2. Information we collect

• Information you give us — your name, email, phone, organisation, role, and the contents of any message when you use our contact form, request a quote, subscribe to the newsletter, join a waitlist, register for a course, or apply for a role.
• Account information — if you create an account (for example to access a course, admin dashboard, or client portal), we store your email, hashed password (managed by our authentication provider), profile details, and role.
• Payment information — payments are processed by our payment partners (currently Paystack, and Stripe / Paddle where enabled). We receive transaction metadata (amount, currency, status, last four digits of the card, or mobile-money provider) but never full card numbers or mobile-money PINs.
• Technical information — IP address, browser type and version, device type, referrer, pages visited, and timestamps, collected through server logs and privacy-respecting analytics.
• Cookies — see section 7.

3. How we use it and our lawful basis

• Respond to enquiries and provide quotes — performance of a contract or steps taken at your request prior to a contract.
• Deliver services, courses, and product access you have purchased — performance of a contract.
• Send transactional emails (receipts, account, security, service updates) — performance of a contract and our legitimate interest in operating the service.
• Send marketing emails and newsletters — your consent, which you may withdraw at any time using the unsubscribe link.
• Improve the site, prevent abuse, and keep the service secure — our legitimate interests balanced against your rights.
• Comply with tax, accounting, and other legal obligations in Ghana — legal obligation.

4. Who we share it with

We do not sell your personal information. We share it only with the following categories of processors, under written agreements that require confidentiality and appropriate security:

• Hosting & infrastructure — Cloudflare (edge and DNS), and our managed backend provider for database, authentication, storage, and background jobs.
• Email delivery — our transactional email provider for receipts, sign-in links, and newsletters.
• Payments — Paystack for card and mobile money in Ghana, and Stripe or Paddle where enabled for international payments.
• Analytics — a privacy-first analytics provider that does not use third-party advertising cookies.
• Professional advisers — our accountants, auditors, and lawyers where strictly necessary.
• Authorities — where required by a lawful order under Ghanaian law.

Some of these providers are located outside Ghana (including in the United States and the European Union). Where we transfer personal data internationally, we rely on the provider's standard contractual clauses and security certifications.

5. How long we keep it

• Contact-form messages: up to 24 months, then deleted or anonymised.
• Newsletter subscribers: until you unsubscribe, plus 30 days to process the request.
• Account data: for as long as the account is active, plus 12 months.
• Invoicing and payment records: at least 6 years, as required by Ghana Revenue Authority rules.
• Server logs: 90 days, unless we need to keep them longer for security investigations.

6. Security

We apply appropriate technical and organisational measures: TLS on all connections, encryption at rest for databases and object storage, hashed passwords, role-based access control, row-level security policies on user-owned data, audit logging, principle-of-least-privilege for staff access, and regular dependency and vulnerability scanning. No system is perfectly secure — if we experience a personal data breach affecting your rights, we will notify you and the Data Protection Commission of Ghana as required by law.

7. Cookies

We use the minimum cookies needed to run the site: a strictly-necessary session cookie for authentication and CSRF protection, a preference cookie for your chosen theme, and — where enabled — a privacy-first analytics cookie that does not identify you personally. We do not use third-party advertising cookies. You can clear or block cookies in your browser at any time; some site features may not work without the strictly-necessary ones.

8. Your rights

Under the Ghana Data Protection Act and the GDPR (where it applies to you), you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data when it is no longer needed;
• object to or restrict certain processing;
• withdraw consent for marketing at any time;
• receive your data in a portable format;
• complain to the Data Protection Commission of Ghana ( dataprotection.org.gh) or, if you are in the EU/UK, your local supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Children

Our services are not directed at children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of the page and, for material changes, notify subscribers by email at least 14 days in advance.