Privacy Policy

Pawalink is operated by Fortis Buildnext. In this policy, "Pawalink", "we", "us", and "our" refer to Fortis Buildnext acting as the operator of the Pawalink platform. This policy applies to personal data handled through Pawalink websites, public storefronts, order pages, receipts, trust pages, buyer checkout flows, and related services.

Pawalink collects data across four categories, depending on how you use the platform.

• Account and identity data: phone number, email address, password hash, verification status, KYC outputs, session identifiers, consent records, onboarding details, and audit log entries tied to account actions.
• Commerce and order data: storefront content, product listings, uploaded product photos and metadata, order records, receipts, payment references, payout details, buyer contact details entered during checkout, and delivery or escrow workflow records.
• Behavioral and analytics data: feature usage telemetry, event logs, and product reliability signals where analytics tools are enabled.
• Public proof surfaces: trust pages, receipts, order-status pages, structured data, and delivery proof artifacts generated from order records — these are intentionally public and may be indexed by third parties.

Uploaded product photos and related metadata may be sent to third-party AI providers — currently including Anthropic, OpenAI, and Google Gemini through a failover pipeline — to extract product details, suggest categories, or generate draft descriptions. These providers may process data outside Ghana.

AI outputs are assistive only and may be incomplete or inaccurate. Merchants remain responsible for reviewing and approving any AI-generated content before it is published. Pawalink may retain correction and quality-review records from these workflows.

Published storefronts, product catalogs, trust pages, receipts, order-status pages, and structured data endpoints are visible to anyone with the link. They may be indexed or cached by search engines, AI crawlers, browsers, and messaging apps. Removing content from Pawalink does not guarantee immediate removal from third-party caches or indexes.

Pawalink uses browser-side storage including httpOnly cookies for server-managed auth, plus localStorage, IndexedDB, service-worker cache, and background sync where supported. On a shared device, locally cached non-auth content may be visible to others. Queued uploads may remain on-device until sync succeeds or you clear local site data.

We share data with service providers only as needed to operate the platform. Known categories include payment processors (Paystack and connected rails), identity verification (SmileID), communications providers (WhatsApp Business, Hubtel SMS), analytics (PostHog where configured), AI providers (Anthropic, OpenAI, Google Gemini), and data infrastructure and hosting providers. Some of these providers process data outside Ghana.

We may also disclose data where required by Ghanaian law, a court order, a regulator request, or to protect users, payment flows, or the integrity of the platform.

Retention periods vary by data type. Financial and payment records are kept for 7 years. KYC records are kept for 5 years after the business relationship ends, as required by the Anti-Money Laundering Act 2008. Delivery and escrow records are kept for 2 years. Auth and security logs are kept for 1 year. Personal data no longer operationally required is deleted within 30 days of a valid closure or deletion request. See our Data Retention and Deletion Policy for the full schedule.

Under Ghana's Data Protection Act 2012 (Act 843), you have the right to request access to, correction of, and deletion of personal data Pawalink holds about you. To make a data subject request, contact [email protected]. For escalations contact [email protected]. We respond within 30 days. Some records cannot be deleted before their legal retention period expires.

Pawalink handles personal data in Ghana and is subject to the Data Protection Act 2012 (Act 843), administered by the Data Protection Commission (DPC). The DPC is the primary regulator for personal data handling in Ghana. Serious data incidents may also engage the Cyber Security Authority under the Cybersecurity Act 2020 (Act 1038). Payment-related data handling is framed in the context of the Payment Systems and Services Act 2019 (Act 987), under which Pawalink operates as a commerce and reconciliation platform rather than a payment service provider — actual movement of funds is handled by licensed third-party processors.

Pawalink's Ghana data-controller registration details with the Data Protection Commission will be published here once finalised. If you have a compliance question or wish to contact the DPC directly, visit dataprotection.org.gh.