Privacy Policy
Draft for review. This policy describes what Abonten Hub actually does with personal information today. It has been prepared with Ghana's Data Protection Act, 2012 (Act 843) in mind but has not yet been reviewed by legal counsel, and our registration status with the Data Protection Commission is still to be confirmed. Effective date: [EFFECTIVE DATE — TO BE CONFIRMED].
1. Who is responsible for your data
Abonten Hub ("Abonten", "we") operates the abontenhub.com website and the Abonten mobile app and decides how personal information collected through them is used. The data controller is Abonten Hub Ltd, a private company limited by shares incorporated in Ghana (company registration number CS015010126), registered address House No. 10, Purple Street, near Mount Zion Church, Weija Block Factory, Accra, Ga South District, Greater Accra Region, Ghana (P.O. Box 465, Weija, Accra; digital address GS-0257-3290). Data Protection Commission registration: [DPC REGISTRATION STATUS — TO BE CONFIRMED]. Nothing in this policy should be read as a claim of registration with, or approval by, the Commission until that line is completed.
Organizers and place owners who receive attendee or customer information through Abonten (section 6) are responsible for how they use it.
2. What we collect
We collect only what the service needs to work. The table below lists every category, where it comes from, and why we have it.
| Category | Examples | Source | Why |
|---|---|---|---|
| Account | Your Google account email or the phone number / email you sign in with; a unique account id; when you signed up and last signed in | You, via sign-in | To create and secure your account |
| Profile | Username, full name, bio, website, avatar image; whether your profile is complete | You | To show who you are to other users |
| Contact details | Phone number (verified by SMS code), email address | You | Sign-in codes, ticket emails, contact for bookings and claims |
| Location | The town or area you choose to explore; your device location when you allow it (to show what's near you); the approximate country from your network address; for field-team members, GPS position when checking in and submitting work | You / your device / network | Discovery, distance sorting, field-work verification |
| Events, places and content | Events you create, places you list, photos, videos, highlights, reviews, responses to reviews, opening hours, services | You | To publish your listings and content |
| Tickets and attendance | Tickets bought or registered, their status (active, used, cancelled), check-in, refunds | Your purchases | To issue and validate tickets and handle refunds |
| Payments | Payment attempts and transactions (amounts, currency, status, a Paystack reference, the payment channel); for saved methods, only the last four digits, brand, expiry, label and a Paystack authorization reference; for organizers, payout account details (bank or mobile-money) | You, Paystack | To take payment, issue refunds, pay organizers |
| Bookings | Booking requests you send to places (time, party size, service, note) and their status | You | To pass the request to the place and track it |
| Messages | Conversations with organizers, places and Abonten Support: text, images, files, voice notes, reactions, read state | You | To deliver your messages |
| Reports | Reports you make about content or users, the reason, details and attachments | You | To moderate the service |
| Notifications | In-app notifications, whether you have read them, and the push token of each device you signed in on | Your devices | To notify you in the app and by push |
| Device and technical | A random install id (app) or browser id (web) used to detect rewards abuse; device platform; app version; network address in server logs and rate-limit records; error reports with the screen or page and technical details | Your device / browser | Security, abuse prevention, reliability |
| Rewards and referrals | Invite codes, which link you arrived from, who invited you, your Abonten Credit ledger, reward decisions and the risk signals behind them | You, your activity | To run the rewards programme fairly |
| Field programme | For team members: role, assignments, GPS check-ins, work submitted, evidence photos, commission and payout records; for business owners: the phone number used to give consent | Team members, owners | To run and audit the field programme |
| Support and moderation records | Support conversations, admin notes about your account, moderation actions, suspension or ban reasons | Abonten staff | To support you and enforce our terms |
We do not collect your date of birth, government identity numbers, or full card numbers, and we do not use advertising or analytics trackers (see the Cookie Policy).
3. How we use it
We use personal information to:
- Provide the service — create your account, sign you in, show listings, issue tickets, deliver messages and notifications, process bookings and claims.
- Take and return payments — through Paystack, including refunds when you or an organizer cancel, and payouts to organizers.
- Keep the service safe — verify phone numbers, limit how often codes and requests can be sent, detect duplicate accounts and rewards abuse, investigate reports, and enforce our Terms.
- Run the rewards programme — attribute referrals, decide and pay rewards, and screen them for abuse.
- Communicate with you — ticket confirmations, event cancellation notices, rewards updates (which you can turn off), support replies, and important notices about your account or these policies.
- Understand and improve the service — aggregated statistics such as ticket sales per event for organizers, place-page views and clicks for owners, and error and performance monitoring for our engineers.
- Meet legal obligations — keep financial records, respond to lawful requests, and handle disputes.
Legal grounds. Under the Data Protection Act, 2012, we rely on your consent (for example when you sign up, allow location or notifications, or give onboarding consent by code), the performance of our contract with you (providing the service you asked for), our legitimate interests in running a safe and reliable service, and compliance with law. Which ground applies to each purpose is subject to legal review.
We do not sell personal information and do not use it for third-party advertising.
4. Where it is stored and who processes it
Abonten runs on cloud services. The providers below process personal information on our behalf under their own security commitments:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, authentication, file storage for claim documents and field evidence | European Union (Paris region) |
| Vercel | Hosts the website and its server code | European Union (Paris region) |
| Cloudinary | Stores and serves images and videos (avatars, flyers, place photos, highlights, message attachments, ticket QR codes) | Global content network |
| Paystack | Payment processing, card tokenization, refunds and payouts | Nigeria / Ghana |
| Hubtel | Sends SMS one-time codes | Ghana |
| Resend | Sends transactional emails (tickets, cancellations, rewards, sign-in codes) | United States |
| Google sign-in; maps and geocoding; Google Workspace hosts our support, privacy and security mailboxes, so emails you send us are stored there | Global | |
| Expo | Delivers push notifications to the app | United States |
| Sentry | Error monitoring for the website, admin console and app | United States |
Because some providers are outside Ghana, your information may be transferred abroad. We rely on the providers' contractual and security commitments for these transfers; the specific safeguards and any registrations required under Act 843 for cross-border transfer are subject to legal review.
5. Sharing with other users
Some information is visible to other users by design:
- Public profile: your username, name, avatar, bio, website, the events and places you have published, your public highlights and your reviews.
- Organizers see the name and contact details of people holding tickets to their events, so they can run the event and check people in.
- Place owners see the details in booking requests sent to them, and the name and review of anyone who reviews their place.
- Message recipients see what you send them and when you were last active in the conversation.
- People you invite see your first name or username on the invite page.
Favourites and bookings are private to you.
6. Organizers and place owners as recipients
When an organizer or owner receives your information through Abonten, they may use it only for the event or booking it relates to. Our Terms prohibit them from selling it or using it for unrelated marketing. If you believe an organizer or owner has misused your information, report them in the app.
7. Cookies and device storage
The website uses a small number of first-party cookies for signing in, remembering your language and country, attributing invites and referrals, and detecting rewards abuse. The app stores equivalent information securely on your device. We do not use analytics or advertising cookies. The Cookie Policy lists every cookie and storage key.
8. Notifications and marketing
- In-app and push notifications are sent for activity on your account (tickets, messages, bookings, reviews, rewards, event changes). You can turn off push notifications in your device settings. Abonten does not yet offer per-type notification controls in the app.
- Emails are sent for ticket confirmations, event cancellations and sign-in codes. Rewards emails ("your credit is ready") can be turned off on the Rewards page or with the unsubscribe link in every such email.
- Abonten does not send marketing newsletters or share your contact details with advertisers. If we introduce marketing communications we will ask for your consent first.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, listings, favourites, highlights | Until you delete your account |
| Tickets, transactions, refunds, organizer earnings and payouts | Retained after account deletion as financial records; specific period to be confirmed |
| Pending checkouts | Expire after 30 minutes if unpaid; expired rows are cleaned up |
| Drafts (events, places, reviews) | Until published or deleted; expired drafts are removed automatically |
| Messages and attachments | Until deleted by you (where supported) or by moderation; no automatic expiry today |
| Reports and moderation records | Retained; your identity is removed from reports you filed when you delete your account |
| Place-claim supporting documents | Deleted 30 days after the claim is approved or rejected |
| Referral click records | 90 days |
| Rewards ledger and reward decisions | Retained after account deletion (the balance itself is forfeited) |
| Field-programme evidence photos | Intended retention 365 days; automatic deletion is not yet in place |
| Rate-limit and one-time-code records | Rate-limit records 1 day; code request logs are retained (period to be confirmed) |
| Push tokens | Removed when you sign out of a device or the device stops accepting notifications |
| Error and performance monitoring | Sentry retains events per its plan; our own error records have no retention period yet (to be confirmed) |
| Administrative audit log | Retained permanently; it cannot be edited or deleted |
Where a period says "to be confirmed", no automatic deletion exists yet and a retention decision is pending. We will update this table when those decisions are made.
10. Deleting your account
You can delete your account yourself from Settings › Security on the web or in the app. Deletion is immediate and irreversible:
- Deleted: your login, profile, phone and email, events and places you own, favourites, highlights, saved payout accounts, notification preferences, and rewards you were still waiting for.
- Kept: payment transactions and tickets already issued, ledger and refund records, reports you filed (with your identity removed), moderation and administrative logs, rewards ledger history, and — if you were a field-team member or gave onboarding consent — the programme's audit records. These are kept for financial accountability, security and legal reasons.
- Forfeited: any Abonten Credit balance.
Deleting the app from your phone does not delete your account.
11. Your rights
Under the Data Protection Act, 2012 you have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate — most of your details can be edited directly in Settings;
- delete your account (section 10);
- object to processing based on our legitimate interests, and to direct marketing (we send none);
- withdraw consent where processing is based on it, for example by revoking location or notification permission on your device, or turning off rewards emails;
- complain to the Data Protection Commission of Ghana if you believe we have handled your information unlawfully.
To exercise a right, contact us through the in-app support conversation (Messages › "Contact Abonten Support" on the web, or Account › Help & support in the app) or email privacy@abontenhub.com. We will confirm your identity — using the account you are signed into, or the email address or phone number on your account — and respond within the period required by law. Abonten does not yet offer a self-service data export; access requests are handled manually.
12. Security
We protect your information with encryption in transit, an authentication system with one-time codes instead of passwords, row-level database access rules that limit each account to its own data, server-side checks on every action, restricted staff access with an audit trail, and payment processing delegated to Paystack so that card data never touches our systems. Our security overview is at abontenhub.com/legal/security. No system is perfectly secure; if you suspect a problem with your account, contact support at once.
13. Children
Abonten is not directed at children, but does not currently verify age. A minimum age and any parental-consent process are pending decisions and will be published here. If you believe a child has created an account, contact support and we will remove it.
14. Changes to this policy
We will update this policy when our practices change. The version and last-updated date appear at the top, and material changes will be announced in the app or by email before they take effect.
15. Contact
Support and privacy requests: the in-app support conversation (section 11). Privacy contact: privacy@abontenhub.com. General support: support@abontenhub.com. Postal address: Abonten Hub Ltd, P.O. Box 465, Weija, Accra, Ghana. We aim to acknowledge privacy requests within two working days (Monday to Friday, 09:00–17:00 Ghana time, excluding public holidays); this is a goal, and the time limits set by law for responding to your request apply regardless. When you write to us by email about your account, we will confirm your identity before acting — usually by asking you to write from, or confirm through, the email address or phone number on your account.