Privacy Policy

1. Who we are and our role

Sankofa ("we", "us") provides an email sending service. For the personal data of the people who sign up for and pay for Sankofa ("account data"), we decide why and how it is used, so we are the data controller.

For the personal data in the emails you send through Sankofa (mainly your recipients' email addresses), you are the controller and we are your processor: we handle it only to deliver your email and under your instructions. You are responsible for having a lawful basis, such as consent, for emailing your recipients.

2. What we collect

Account data:

• Your email address and a securely hashed password, or the identity information returned by GitHub or Google if you sign in with them
• Sign-in and session information needed to keep your account secure
• The name and a hashed form of each API key you create (we can't read back your full key after it is shown to you)

Service data (about your sending):

• Sending domains you add and their verification status
• For every email: the from address, recipient addresses, subject line, time, and delivery status
• Delivery events reported by our email provider, such as delivered, bounced, complained or rejected
• Your suppression list and webhook endpoint URLs
• We don't store the body or attachments of your emails in our database. They pass through our email provider only to be delivered.

Billing data:

• Purchase history: amount, number of credits, payment status, and the payment reference
• Payments are handled by Paystack. We never see or store your full card number, mobile money PIN or bank login.

3. How we use it

• To provide, secure and support the service, including sending your email and showing you delivery results
• To take payment and keep an accurate balance of your credits
• To detect and prevent spam, fraud and abuse, and to enforce our Acceptable Use Policy
• To contact you about your account, security or important changes
• To meet legal obligations

We do not sell your personal data, and we do not use your recipients' addresses for our own marketing.

4. Who we share it with

We share data only with service providers that help us run the service, under appropriate terms:

• Amazon Web Services (Amazon SES, SNS and SQS): sends your email and reports delivery events
• Supabase: hosts our database and handles account sign-in
• Paystack: processes payments
• GitHub and Google: only if you choose to sign in with them
• Hosting and infrastructure providers used to run our website and API

We may also disclose information if the law requires it, to protect the rights and safety of others, or as part of a business transfer, in which case we will tell you.

5. Where your data is processed

Our email and database infrastructure is hosted in Europe (Ireland). If you or your recipients are elsewhere, including in Ghana, your data will be transferred to and processed in other countries. Where we transfer personal data internationally, we rely on providers that maintain appropriate safeguards.

6. How long we keep it

We keep account data for as long as your account is open. Message logs and delivery events are kept for as long as they are useful to you and to us for security and abuse prevention. When you close your account we delete or anonymise your personal data on request, except what we must keep for legal, tax, fraud-prevention or dispute purposes (such as payment records). Suppression entries may be kept so that addresses that opted out are not emailed again.

7. Security

We use encrypted connections, hash API keys and passwords, verify the signature on every payment notification, restrict each customer's data to their own account, and limit who can access our systems. No system is perfectly secure, so please use a strong, unique password and keep your API keys secret. If you believe a key is compromised, revoke it in the dashboard right away.

8. Your rights

Under the Data Protection Act, 2012 (Act 843) of Ghana, and other laws that may apply to you, you can ask to access, correct or delete your personal data, object to or restrict certain uses, and withdraw consent where we rely on it. To exercise a right, email info.sankofa.dev@gmail.com. We may need to verify your identity first.

If you're a recipient of an email sent by one of our customers, please contact the sender first, since they control why you were emailed. You can also write to us and we will pass your request on or suppress your address. You may also complain to the Data Protection Commission of Ghana.

9. Cookies

We use only the browser storage needed to keep you signed in and to remember basic preferences, such as your last sign-in method. We don't use advertising or cross-site tracking cookies.

10. Children

Sankofa is for businesses and adults. It is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes and contact

We may update this policy from time to time. We'll post the new version here with an updated date, and tell you about material changes in the dashboard or by email.

Questions about this policy or your data? Contact us at info.sankofa.dev@gmail.com.