Privacy policy.

Last updated 24 October 2026

1. Who we are and what this covers
2. Our role and yours
3. What we collect
4. How we use it
5. Our legal reasons
6. Who we share it with
7. Data outside Ghana
8. How long we keep it
9. How we protect it
10. Automated checks
11. Your rights
12. If you received a message
13. Browser storage
14. Emails from us
15. Children
16. If something goes wrong
17. Changes to this policy
18. Contact and complaints

1. Who we are and what this covers

Nkra ("we", "us", "our") provides SMS, one-time code, email campaign and API services to businesses in Ghana. This policy explains how we handle personal data when you visit our website, create or use an account, call our API, pay us, contact support, or receive a message sent through Nkra.

We follow the Data Protection Act, 2012 (Act 843) of Ghana. Words such as "personal data", "data controller", "data processor" and "data subject" have the meaning given to them in that Act.

This policy sits alongside our terms of service.

2. Our role and yours

• Your account data: we're the data controller for information about you as a customer: your name, sign-in details, payments and how you use the Service.
• Your recipients' data: when you upload contacts or send messages, you're the data controller and we act as your data processor. You decide who to message and why. We process that data only to provide the Service to you, keep it secure and meet our legal duties.
• Opt-outs: we keep a Service-wide list of numbers and addresses that asked not to be contacted, so that one person's request is respected across all our customers. For this list, we're the data controller.

3. What we collect

Information you give us

• Account details: your name, business name, email address, phone number, and a hashed version of your password.
• Third-party sign-in: if you sign in with Google, we receive your name, email address and a confirmation that Google has verified that email. We don't receive your Google password or access to your other Google data.
• Business details: sender ID requests and their stated purpose, and documents you send to verify your business.
• Contacts and lists: phone numbers, email addresses, names and any other fields you add or import.
• Messages: the text of your SMS, the content and subject of your email campaigns, the recipients, sender ID or sender name, and when you scheduled them.
• Support: what you write to us through the support form or by email, and our replies.

Information created when you use the Service

• Delivery records: message status (queued, sent, delivered, failed), the number of parts, the network, and delivery times reported back by the networks.
• One-time codes: the number a code was sent to, a hashed version of the code, how many attempts were made, and whether it was confirmed. We never keep the code itself in readable form.
• Email activity: whether a campaign email was sent, bounced or unsubscribed from.
• Credit and plans: your balance, every credit added or used, your email plan and monthly usage.
• API use: your API key prefixes (the full key is stored hashed), the requests made with them, and the time they were last used.
• Security and activity logs: sign-ins, sign-in codes requested, changes to settings and actions taken by our staff on your account.
• Technical data: IP address, browser and device type, and the pages and endpoints requested, kept in server logs for security and troubleshooting.

Information from others

• Payments: from our payment processor, the amount, reference, status, payment channel, and a short description such as the mobile money network or the last four digits of a card. We never receive full card numbers, card security codes or mobile money PINs.
• Delivery partners: delivery reports for the messages you send.
• Resellers: if your account is a sub-account, the reseller who created it may give us your name and contact details.

4. How we use it

• to create and run your account, and confirm it's you when you sign in;
• to send your SMS, one-time codes and email campaigns, and show you delivery reports;
• to take payments, add credit, manage email plans, issue refunds and keep financial records;
• to review sender IDs and keep the Service free of spam, fraud and impersonation;
• to respect opt-outs and unsubscribes;
• to answer support requests and tell you about your account, such as a low balance, a held message or a change to our terms;
• to keep the Service secure, investigate misuse, and fix problems;
• to understand overall usage so we can plan capacity and improve the Service, using combined figures rather than individual messages wherever we can;
• to meet our legal and regulatory duties, and to respond to lawful requests from authorities.

We don't read your messages except when an automated check holds them for review, when you ask us to look at something, or when we need to investigate a complaint, misuse or a legal request.

We don't sell personal data, we don't use your contact lists or message content for our own marketing, and we don't use them to build advertising profiles.

5. Our legal reasons

Under Act 843, we process personal data only where we have a lawful reason. Ours are:

For your recipients' data, you're responsible for having your own lawful reason to message them, as our terms explain.

6. Who we share it with

We share personal data only as needed to run the Service, and only with:

• Delivery partners and mobile networks, who receive the recipient's number, the message and the sender ID so they can deliver it;
• Email delivery providers, who receive the recipient's address, the email and the sender details so they can deliver campaign and account emails;
• A licensed payment processor, who handles your payment details directly when you top up or buy a plan;
• Hosting and infrastructure providers, who store our data and run our servers;
• Sign-in providers, such as Google, only when you choose to sign in with them;
• Your reseller, if your account is a sub-account, who can see your balance and usage;
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality;
• Authorities, such as regulators, courts or the police, when the law requires it or to protect people from harm or fraud;
• A buyer or successor, if Nkra or its business is sold or merged, under the same protections as this policy.

Each service provider is bound to use the data only to provide its service to us, to keep it secure, and not to use it for its own purposes. We review these companies before we work with them.

7. Data outside Ghana

Some of our service providers store or process data in other countries. When data leaves Ghana, we make sure it's protected to the standard Act 843 requires, through contracts and the safeguards those providers have in place, and we only send what the service needs.

8. How long we keep it

We may keep data longer if we need it for a dispute, an investigation or a legal claim, and only for as long as that lasts.

9. How we protect it

• All traffic to our website and API is encrypted in transit (HTTPS).
• Passwords, sign-in codes, one-time codes and API keys are stored hashed, so they can't be read back.
• Sensitive settings and service credentials are stored encrypted.
• Access to customer data is limited to staff who need it, and staff sign-ins need a code sent by email. Staff actions on accounts are logged.
• Every credit change is recorded in a ledger, so balances can always be checked.
• Our data is backed up regularly.

No system is perfectly secure, but we work to protect your data and review our safeguards regularly.

10. Automated checks

To stop scams, our system automatically checks SMS sends and email campaigns for wording often used in fraud. If it finds any, the send is held until a person on our team reviews it, so no final decision is made by the computer alone. If a send you made is blocked and you think that's wrong, contact us and we'll look again.

11. Your rights

Under Act 843 you can:

• ask whether we hold personal data about you, and get a copy of it;
• ask us to correct data that's wrong or incomplete;
• ask us to delete data we no longer have a reason to keep;
• object to us using your data, including for direct marketing;
• withdraw any consent you've given, without affecting what we did before;
• ask for your account data in a commonly used format so you can take it elsewhere.

You can update most account details yourself in Settings, and export your messages from the dashboard. For anything else, use our support form. We'll reply within 21 days, and may need to confirm it's you first. There's no charge, unless a request is clearly unfounded or repeated.

12. If you received a message

If you got an SMS or email from a business using Nkra, that business decided to message you and is responsible for having your permission. To stop their messages:

• SMS: follow the opt-out instructions in the message, or contact the business directly.
• Email: click the unsubscribe link at the bottom of the email.

You can also ask us to add your number or address to our Service-wide opt-out list, or report a message you didn't agree to, through our support form. We'll pass requests about your data to the business that sent the message and help them respond, and we investigate every report of spam or fraud.

13. Browser storage

We don't use advertising or tracking cookies. Our dashboard stores a sign-in token in your browser so you stay signed in, and remembers small preferences such as which page you were on. Clearing your browser storage, or signing out, removes them. Our website loads its typefaces from a font service, which receives your IP address as any web request does.

14. Emails from us

We send emails you need to use the Service: sign-in codes, receipts, low-balance alerts, held message notices and changes to our terms. You can't opt out of these while your account is open. We'll only send you news about new features if you agree, and every such email includes a way to stop them.

15. Children

The Service is for businesses and adults. We don't knowingly open accounts for anyone under 18. If you think a child has given us personal data, contact us and we'll delete it.

16. If something goes wrong

If a security incident puts personal data at risk, we'll act quickly to contain it, notify the Data Protection Commission as Act 843 requires, and tell affected customers without undue delay, explaining what happened and what we're doing about it. Where your recipients' data is affected, we'll give you the information you need to meet your own duties.

17. Changes to this policy

We may update this policy as the Service or the law changes. If a change is significant, we'll tell you by email or in the dashboard before it takes effect. The date at the top shows when it last changed.

18. Contact and complaints

For any question or request about your personal data, use our support form and mark it "Privacy". We'll aim to resolve it with you directly.

If you're not happy with how we've handled your data, you can complain to the Data Protection Commission of Ghana, at dataprotection.org.gh.