Data Retention and Deletion Policy

Pawalink applies different retention periods depending on the category of data and the legal or operational reason for keeping it.

• Financial and payment records (orders, receipts, settlements, payouts, reconciliation data): 7 years from transaction date, as required for tax and accounting obligations under Ghanaian law.
• KYC and identity verification records (SmileID outputs, merchant identity documents, verification status): 5 years after the business relationship ends, as required by the Anti-Money Laundering Act 2008 (Act 749).
• Delivery and escrow records (delivery codes, confirmation events, dispute records, escrow hold logs): 2 years from the transaction date.
• Account and consent records (registration details, consent timestamps, session audit logs): 1 year after account closure.
• Personal contact data not tied to a live order or account: deleted within 30 days of a valid deletion request or account closure.
• Uploaded product photos and AI extraction records: retained while the storefront or product is active; subject to deletion request handling described below.
• Auth and security logs: 1 year rolling.

When a user requests deletion, Pawalink removes public visibility promptly and deletes data that is no longer operationally required. Records subject to a legal retention obligation — including financial records, KYC documents, dispute files, and audit logs — may be retained for the periods above even after account closure.

Backup copies may persist for a short additional period beyond live-system deletion, consistent with reasonable backup rotation schedules. Public pages already indexed or cached by search engines, messaging apps, or third-party tools may remain visible in those external systems after removal from Pawalink.

Under Ghana's Data Protection Act 2012 (Act 843), you have the right to request access to the personal data Pawalink holds about you, to request correction of inaccurate records, and to request deletion of data that is no longer required. To make a data subject request, contact [email protected]. Requests are handled within 30 days. Some records cannot be deleted before their legal retention period expires.

Some data remains on the user device until the user clears it, signs out, or browser policies expire it. That can include cached storefront data, queued uploads, receipt views, order views, and service-worker state stored through localStorage, sessionStorage, IndexedDB, or other browser-managed stores.