1. Who We Are
CoSign is a mobile marketplace application operated in Ghana. We act as the data controller for the personal information we collect from users of our platform. Our contact for data-related queries is joincosign@gmail.com.
2. Information We Collect
2.1 Information you provide directly
- Account registration: Email address, password, username, display name
- Profile: Profile photo, gender, date of birth, language preference, currency preference
- Addresses: Delivery addresses including region, district, street address, and Ghana Post GPS digital address
- Payment information: Mobile Money number and provider (we do not store card numbers — these are handled by Paystack)
- KYC documents (sellers only): Ghana Card, passport, driver's licence, or voter ID; selfie with ID; business registration documents or TIN where applicable
- Communications: Messages sent through CoSign's in-app chat system
- Reviews and ratings: Text, photos, and ratings you submit about products or sellers
2.2 Information collected automatically
- Usage data: Products viewed, searches made, cart activity, orders placed
- Device information: Device type, operating system version, app version
- Transaction data: Order history, payment status, escrow records
- Session data: Login timestamps, session duration
3. How We Use Your Information
We use your information to:
- Create and manage your CoSign account
- Process orders, payments, and escrow transactions
- Verify seller identity (KYC) as required by law and platform policy
- Enable buyer–seller communication through in-app chat
- Provide personalised product recommendations (if you have opted in)
- Detect and prevent fraud, abuse, and prohibited activity
- Comply with legal obligations under Ghanaian law
- Send transactional notifications (order updates, payment confirmations) — you cannot opt out of these as they are essential to service operation
- Send marketing communications where you have given consent — you can opt out at any time from Settings
- Calculate buyer tier status and seller reputation scores
- Resolve disputes between buyers and sellers
- Improve and develop the CoSign platform
Legal basis for processing: We process your personal data on the basis of (a) contract performance — to fulfil our obligations to you as a user of CoSign; (b) legitimate interests — fraud prevention and platform safety; (c) legal obligation — KYC and financial compliance; and (d) consent — marketing communications and personalised recommendations.
4. How We Share Your Information
We do not sell your personal data. We share data only in the following circumstances:
- With sellers: When you place an order, your name, delivery address, and phone number are shared with the seller to fulfil your order.
- With buyers: Your seller store name, product descriptions, ratings, and response time are visible to buyers. Your personal email and phone are not disclosed.
- With Paystack: Payment processing data is shared with Paystack to process your transactions. Paystack's privacy policy applies to data they receive.
- With Cloudinary: Product images, profile photos, and KYC documents are stored on Cloudinary's secure cloud storage.
- With law enforcement: We will disclose information if required by a valid court order, subpoena, or legal process under Ghanaian law.
- In business transfers: If CoSign is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you in advance.
5. Data Storage & Security
Your data is stored on secure servers. We implement industry-standard security measures including:
- Encryption of data in transit (HTTPS/TLS) and at rest
- Access controls limiting staff access to personal data on a need-to-know basis
- Regular security reviews
- Secure password hashing
No system is 100% secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
6. Your Rights
You have the following rights over your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Update inaccurate or incomplete information from your profile settings
- Deletion (Right to Erasure): Request deletion of your account and personal data from Settings → Account → Delete Account. Your data is permanently erased after a 30-day grace period.
- Data portability: Request an export of your personal data in a machine-readable format
- Withdraw consent: Opt out of personalised recommendations from Settings → Privacy, and marketing emails from Settings → Data & Privacy
- Restriction: Request we restrict processing of your data in certain circumstances
To exercise any of these rights, contact us at joincosign@gmail.com. We will respond within 30 days.
7. Data Retention
We retain your personal data for as long as your account is active or as necessary to provide services. Specifically:
- Account data: Retained until account deletion is completed
- Order and transaction records: Retained for 7 years for financial compliance purposes
- KYC documents: Retained for 5 years after the seller relationship ends
- Chat messages: Retained for 12 months after the conversation is archived
- Deleted account data: Permanently erased 30 days after deletion request, except where longer retention is required by law
8. Children's Privacy
CoSign is not intended for users under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has registered, we will delete their account and data promptly.
9. Third-Party Services
CoSign integrates with the following third-party services. Their privacy policies govern their data handling:
- Paystack — Payment processing (paystack.com/gh/privacy (opens in a new tab))
- Cloudinary — Media storage and delivery
- Firebase Cloud Messaging — Push notifications
- Sentry — Crash and error reporting to help us find and fix bugs (technical data only, not used for marketing or advertising)
Links to external websites from within CoSign are provided for your convenience. We are not responsible for the privacy practices of external sites.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email. The effective date at the top of this page will be updated accordingly. Continued use of CoSign after changes indicates your acceptance.
11. Contact Us
For any privacy-related questions or to exercise your rights:
CoSign Data Privacy
Email: joincosign@gmail.com
Subject line: "Privacy Request – [your name]"