Privacy Policy
Draft for review. This policy describes what Abonten Hub actually does with personal information today. It has been prepared with Ghana's Data Protection Act, 2012 (Act 843) in mind but has not yet been reviewed by legal counsel. Effective date: [EFFECTIVE DATE — TO BE CONFIRMED].
1. Who is responsible for your data
Abonten Hub ("Abonten", "we") operates the abontenhub.com website and the Abonten mobile app and decides how personal information collected through them is used. The data controller is Abonten Hub Ltd, a private company limited by shares incorporated in Ghana (company registration number CS015010126), registered address House No. 10, Purple Street, near Mount Zion Church, Weija Block Factory, Accra, Ga South District, Greater Accra Region, Ghana (P.O. Box 465, Weija, Accra; digital address GS-0257-3290). Abonten Hub Ltd is registered as a data controller with the Data Protection Commission of Ghana under the Data Protection Act, 2012 (Act 843): certificate number PROV2609522, registered 16 September 2026, valid until 15 September 2028. Registration is not an approval of this policy by the Commission.
Organizers and place owners who receive attendee or customer information through Abonten (section 6) are responsible for how they use it.
2. What we collect
We collect only what the service needs to work. The table below lists every category, where it comes from, and why we have it.
| Category | Examples | Source | Why |
|---|---|---|---|
| Account | Your Google account email or the phone number / email you sign in with; a unique account id; when you signed up and last signed in | You, via sign-in | To create and secure your account |
| Profile | Username, full name, bio, website, avatar image; whether your profile is complete | You | To show who you are to other users |
| Contact details | Phone number (verified by SMS code), email address | You | Sign-in codes, ticket emails, contact for bookings and claims |
| Location | The town or area you choose to explore; your device location when you allow it (to show what's near you); the approximate country from your network address; the city or rough area (about 1 km) you ask us to tell you about when Abonten launches there, kept until the notice is sent or you cancel it; for field-team members, GPS position when checking in and submitting work | You / your device / network | Discovery, distance sorting, launch notices you asked for, field-work verification |
| Events, places and content | Events you create, places you list, photos, videos, highlights, reviews, responses to reviews, opening hours, services | You | To publish your listings and content |
| Tickets and attendance | Tickets bought or registered, their status (active, used, cancelled), check-in, refunds | Your purchases | To issue and validate tickets and handle refunds |
| Payments | Payment attempts and transactions (amounts, currency, status, a Paystack reference, the payment channel); for saved methods, only the last four digits, brand, expiry, label and a Paystack authorization reference; for organizers, payout account details (bank or mobile-money) | You, Paystack | To take payment, issue refunds, pay organizers |
| Bookings | Booking requests you send to places (time, party size, service, note) and their status | You | To pass the request to the place and track it |
| Messages | Conversations with organizers, places and Abonten Support: text, images, files, voice notes, reactions, read state | You | To deliver your messages |
| Reports | Reports you make about content or users, the reason, details and attachments | You | To moderate the service |
| Notifications | In-app notifications, whether you have read them, and the push token of each device you signed in on | Your devices | To notify you in the app and by push |
| Website visits | Which pages of the website are opened; the site or link that led there, including the campaign tags in links Abonten posts; country, device type, operating system and browser. Counted by Vercel Web Analytics, which sets no cookies and stores nothing in your browser. Addresses of private pages (messages, checkout, settings, consent links) are cut to their first part before they leave your browser | Your browser | To count visits and see which pages and which of our posts bring people |
| Page views of listings | That an event's or a place's page was opened, when, and whether on the website, an iPhone or an Android phone. No account, device or address is kept with it; views by the listing's own organizer or owner are not recorded | Your browser or app | To show organizers and owners how often their page is opened |
| Device and technical | A random install id (app) or browser id (web) used to detect rewards abuse; device platform; app version; network address in server logs and rate-limit records; error reports with the screen or page and technical details | Your device / browser | Security, abuse prevention, reliability |
| Rewards and referrals | Invite codes, which link you arrived from, who invited you, your Abonten Credit ledger, reward decisions and the risk signals behind them | You, your activity | To run the rewards programme fairly |
| Field programme | For team members: role, assignments, GPS check-ins, work submitted, evidence photos, commission and payout records; for business owners: the phone number used to give consent | Team members, owners | To run and audit the field programme |
| Abonten Safety (only if you use it) | The trusted contacts you name: their name, phone number, optional email, language and how they relate to you, and whether they accepted. For each SOS, "check in on me" or location share: when it started and ended, the note you wrote, the event you chose, your device's positions while it is open, who was told and whether each text, email or notification went, who opened the page and what each contact answered | You, your device | To alert the people you choose, when you ask, with where you are |
| If someone names you as a trusted contact | Your name, phone number, optional email and language, as given by the person who named you; your answer to the invite; a request to stop all Abonten Safety texts to your number, if you make one | The person who named you; you | To ask whether you agree and, if you do, to alert you when they ask for help |
| Identity verification (only if you verify) | The country and type of the document you chose; the name, date of birth and expiry date on it; the last four characters of its number; two codes made from the number and from your name and date of birth, which cannot be turned back into them; the result of the check and the fraud signals behind it; when you agreed and to which notice. Not the photos of your document or your selfie, and not the full number | You, through our identity provider Smile ID, which checks the document (for a Ghana Card, against the National Identification Authority's record) and your selfie | To confirm who is behind an organizer or a place, to trace them if something goes wrong at an event or a fraud is reported, and to stop a banned person coming back on a new account with the same document |
| Support and moderation records | Support conversations, admin notes about your account, moderation actions, suspension or ban reasons | Abonten staff | To support you and enforce our terms |
Unless you verify your identity (above), we do not collect your date of birth or anything from a government identity document; we never keep the full number of a document, nor full card numbers, and we do not use advertising trackers or analytics cookies. Visits to the website are counted without cookies, as described above (see the Cookie Policy). The app does not use Vercel Web Analytics.
3. How we use it
We use personal information to:
- Provide the service — create your account, sign you in, show listings, issue tickets, deliver messages and notifications, process bookings and claims.
- Take and return payments — through Paystack, including refunds when you or an organizer cancel, and payouts to organizers.
- Keep the service safe — verify phone numbers, limit how often codes and requests can be sent, detect duplicate accounts and rewards abuse, investigate reports, and enforce our Terms.
- Run the rewards programme — attribute referrals, decide and pay rewards, and screen them for abuse.
- Communicate with you — ticket confirmations, event cancellation notices, rewards updates (which you can turn off), support replies, and important notices about your account or these policies.
- Understand and improve the service — aggregated statistics such as ticket sales and event-page views for organizers, place-page views and clicks for owners, visits to the website per page and per link, and error and performance monitoring for our engineers.
- Meet legal obligations — keep financial records, respond to lawful requests, and handle disputes.
Legal grounds. Under the Data Protection Act, 2012, we rely on your consent (for example when you sign up, allow location or notifications, or give onboarding consent by code), the performance of our contract with you (providing the service you asked for), our legitimate interests in running a safe and reliable service, and compliance with law. Which ground applies to each purpose is subject to legal review.
We do not sell personal information and do not use it for third-party advertising.
4. Where it is stored and who processes it
Abonten runs on cloud services. The providers below process personal information on our behalf under their own security commitments:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, authentication, file storage for claim documents and field evidence | European Union (Paris region) |
| Vercel | Hosts the website and its server code | European Union (Paris region) |
| Vercel Web Analytics | Counts visits to website pages (section 2); no cookies | To be confirmed |
| Cloudinary | Stores and serves images and videos (avatars, flyers, place photos, highlights, message attachments, ticket QR codes) | Global content network |
| Paystack | Payment processing, card tokenization, refunds and payouts | Nigeria / Ghana |
| Hubtel | Sends SMS one-time codes, and the Abonten Safety texts to trusted contacts | Ghana |
| Resend | Sends transactional emails (tickets, cancellations, rewards, sign-in codes, Abonten Safety alerts to contacts who gave an email) | United States |
| Google sign-in; maps and geocoding; Google Workspace hosts our support, privacy and security mailboxes, so emails you send us are stored there | Global | |
| Smile ID | Checks your identity document and selfie when you verify your identity, and keeps the photos under its own retention; for a Ghana Card it checks against the National Identification Authority's record | To be confirmed |
| Expo | Delivers push notifications to the app | United States |
| Sentry | Error monitoring for the website, admin console and app | United States |
Because some providers are outside Ghana, your information may be transferred abroad. We rely on the providers' contractual and security commitments for these transfers; the specific safeguards and any registrations required under Act 843 for cross-border transfer are subject to legal review.
5. Sharing with other users
Some information is visible to other users by design:
- Public profile: your username, name, avatar, bio, website, the events and places you have published, your public highlights and your reviews.
- Organizers see the name and contact details of people holding tickets to their events, so they can run the event and check people in.
- Place owners see the details in booking requests sent to them, and the name and review of anyone who reviews their place.
- Message recipients see what you send them and when you were last active in the conversation.
- People you invite see your first name or username on the invite page.
- Your trusted contacts (Abonten Safety) see your name and phone number when they are asked to be your contact. Only while an SOS, a missed check-in or a location share is open do they see, on a private page opened from their text, where you are, how recently your position was updated, the note you wrote and the event you chose. They stop seeing where you are when you say you are safe or the share ends; an alert that nobody closed stays visible to them for one more day. Abonten Safety does not contact the police, an ambulance or any emergency service, and it does not tell event organizers.
- If you verify your identity, other people see an "ID checked" mark beside your name. Nothing from your document is shown to anyone: not your legal name, date of birth or number.
- A guest's trusted contacts (Abonten Safety), while the guest's alert or location share is open, see the name on the organizer's public profile and whether their identity is checked, and the venue's own phone and WhatsApp numbers from its Abonten page, so they can reach the people on site. They never see an organizer's legal identity.
Favourites and bookings are private to you.
6. Organizers and place owners as recipients
When an organizer or owner receives your information through Abonten, they may use it only for the event or booking it relates to. Our Terms prohibit them from selling it or using it for unrelated marketing. If you believe an organizer or owner has misused your information, report them in the app.
7. Cookies and device storage
The website uses a small number of first-party cookies for signing in, remembering your language and country, attributing invites and referrals, and detecting rewards abuse. The app stores equivalent information securely on your device. We do not use analytics or advertising cookies; website visits are counted without them (section 2). The Cookie Policy lists every cookie and storage key.
8. Notifications and marketing
- In-app and push notifications are sent for activity on your account (tickets, messages, bookings, reviews, rewards, event changes). You can turn off push notifications in your device settings. Abonten does not yet offer per-type notification controls in the app.
- Emails are sent for ticket confirmations, event cancellations and sign-in codes. Rewards emails ("your credit is ready") can be turned off on the Rewards page or with the unsubscribe link in every such email.
- Abonten does not send marketing newsletters or share your contact details with advertisers. If we introduce marketing communications we will ask for your consent first.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, listings, favourites, highlights | Until you delete your account |
| Tickets, transactions, refunds, organizer earnings and payouts | Retained after account deletion as financial records; specific period to be confirmed |
| Pending checkouts | Expire after 30 minutes if unpaid; expired rows are cleaned up |
| Drafts (events, places, reviews) | Until published or deleted; expired drafts are removed automatically |
| Messages and attachments | Until deleted by you (where supported) or by moderation; no automatic expiry today |
| Reports and moderation records | Retained; your identity is removed from reports you filed when you delete your account |
| Place-claim supporting documents | Deleted 30 days after the claim is approved or rejected |
| Referral click records | 90 days |
| Rewards ledger and reward decisions | Retained after account deletion (the balance itself is forfeited) |
| Field-programme evidence photos | Intended retention 365 days; automatic deletion is not yet in place |
| Rate-limit and one-time-code records | Rate-limit records 1 day; code request logs are retained (period to be confirmed) |
| Push tokens | Removed when you sign out of a device or the device stops accepting notifications |
| Page views of listings | No automatic deletion yet (to be confirmed); they hold no account or device identifier |
| Website visit statistics | Kept by Vercel for the period its Web Analytics plan allows (to be confirmed) |
| Error and performance monitoring | Sentry retains events per its plan; our own error records have no retention period yet (to be confirmed) |
| Abonten Safety positions | 7 days after the SOS, check-in or share ends |
| Abonten Safety history (when each session ran, who was told, their answers) | 180 days after it ends |
| Trusted contacts | Until you remove them or delete your account; a contact's request to stop all Safety texts is kept so that it can be honoured |
| Identity checks that did not succeed (rejected, failed, cancelled, expired) | 1 year |
| Identity checks of a deleted account | 2 years after the account is deleted, so that someone can still be traced after an incident |
| Identity checks tied to fraud (revoked, blocked, or the same document on another account) | 5 years after the decision |
| Administrative audit log | Retained permanently; it cannot be edited or deleted |
Where a period says "to be confirmed", no automatic deletion exists yet and a retention decision is pending. We will update this table when those decisions are made.
10. Deleting your account
You can delete your account yourself from Settings › Security on the web or in the app. Deletion is immediate and irreversible:
- Deleted: your login, profile, phone and email, events and places you own, favourites, highlights, saved payout accounts, notification preferences, rewards you were still waiting for, and your Abonten Safety contacts and history (including every position).
- Kept: payment transactions and tickets already issued, ledger and refund records, your identity verification record for the period in section 9, reports you filed (with your identity removed), moderation and administrative logs, rewards ledger history, and — if you were a field-team member or gave onboarding consent — the programme's audit records. These are kept for financial accountability, security and legal reasons.
- Forfeited: any Abonten Credit balance.
Deleting the app from your phone does not delete your account.
11. Your rights
Under the Data Protection Act, 2012 you have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate — most of your details can be edited directly in Settings;
- delete your account (section 10);
- object to processing based on our legitimate interests, and to direct marketing (we send none);
- withdraw consent where processing is based on it, for example by revoking location or notification permission on your device, or turning off rewards emails;
- complain to the Data Protection Commission of Ghana if you believe we have handled your information unlawfully.
To exercise a right, contact us through the in-app support conversation (Messages › "Contact Abonten Support" on the web, or Account › Help & support in the app) or email privacy@abontenhub.com. We will confirm your identity — using the account you are signed into, or the email address or phone number on your account — and respond within the period required by law. Abonten does not yet offer a self-service data export; access requests are handled manually.
12. Security
We protect your information with encryption in transit, an authentication system with one-time codes instead of passwords, row-level database access rules that limit each account to its own data, server-side checks on every action, restricted staff access with an audit trail, and payment processing delegated to Paystack so that card data never touches our systems. Our security overview is at abontenhub.com/legal/security. No system is perfectly secure; if you suspect a problem with your account, contact support at once.
13. Children
Abonten is not directed at children, but does not currently verify age at sign-up. Verifying your identity, which running events or places may require, needs you to be at least 18. A minimum age and any parental-consent process are pending decisions and will be published here. If you believe a child has created an account, contact support and we will remove it.
14. Changes to this policy
We will update this policy when our practices change. The version and last-updated date appear at the top, and material changes will be announced in the app or by email before they take effect.
15. Contact
Support and privacy requests: the in-app support conversation (section 11). Privacy contact: privacy@abontenhub.com. General support: support@abontenhub.com. Postal address: Abonten Hub Ltd, P.O. Box 465, Weija, Accra, Ghana. We aim to acknowledge privacy requests within two working days (Monday to Friday, 09:00–17:00 Ghana time, excluding public holidays); this is a goal, and the time limits set by law for responding to your request apply regardless. When you write to us by email about your account, we will confirm your identity before acting — usually by asking you to write from, or confirm through, the email address or phone number on your account.