Privacy Policy

Effective Date: January 2025 · Last Updated: February 2026

1. Introduction

Snrael ("we," "us," or "our") is a multi-tenant e-commerce platform operated in the Republic of Ghana. We are committed to protecting the privacy and security of personal information collected from merchants, customers, and visitors who use our platform.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use the Snrael platform, including our website at snrael.com, all merchant storefronts hosted on our subdomains, and any related services.

By creating an account, placing an order, or otherwise using Snrael, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described herein. If you do not agree with this policy, please do not use our platform.

2. Information We Collect

2.1 Account Information

When you create an account on Snrael, we collect the following information:

• Phone number — your primary identifier and login credential
• Email address (optional) — for additional communication preferences
• Full name — for account identification and order processing
• Password — stored in encrypted/hashed form; we never store or have access to your plaintext password

2.2 Merchant Verification Information

To verify merchant identity and comply with Know Your Customer (KYC) regulations, we collect:

• Ghana Card number and images of the Ghana Card
• Business name and business address
• Business registration number
• Taxpayer Identification Number (TIN)
• Form A certificate (Registrar General's Department)

2.3 Store Information

When merchants set up and operate their stores, we collect:

• Store name, description, and branding assets (logo, banner)
• Product listings, descriptions, images, and pricing
• Store policies (return policy, delivery terms, contact details)

2.4 Customer Order Information

When customers place orders, we collect:

• Customer name and phone number
• Delivery address, including region, city, and landmark
• Order details (items, quantities, prices, delivery preferences, special instructions)

2.5 Automatically Collected Information

When you use our platform, we automatically collect certain technical information, including:

• Pages visited and time spent on each page
• Referring website or source
• Device type, browser type, and version
• IP address
• Operating system
• Device identifiers

2.6 Information from Third Parties

We may receive information from third-party service providers, including:

• Hubtel — payment transaction status, confirmation codes, and verification results

3. How We Use Your Information

3.1 Provide and Operate Our Services

• Create and manage your account
• Process and fulfil orders
• Facilitate payments via Mobile Money through Hubtel
• Send transactional communications (order confirmations, delivery updates, OTP codes)
• Provide customer support

3.2 Verify Identity

• Conduct KYC verification for merchants
• Prevent fraud and unauthorized access
• Comply with legal and regulatory requirements

3.3 Improve the Platform

• Analyse usage patterns and platform performance
• Develop new features and services
• Identify and fix bugs and technical issues

3.4 Communicate with You

• Send order updates and delivery notifications via SMS
• Notify you of changes to our policies or terms
• Respond to support inquiries
• Send promotional and marketing messages (only with your prior consent; you may opt out at any time)

3.5 Ensure Security

• Detect and prevent fraud, abuse, and unauthorized access
• Monitor for suspicious activity
• Enforce our Terms of Service and Acceptable Use Policy

3.6 Comply with Legal Obligations

• Meet obligations under the Ghana Data Protection Act, 2012 (Act 843)
• Comply with the Electronic Transactions Act, 2008 (Act 772)
• Respond to lawful requests from regulatory authorities
• Maintain records as required by Ghanaian law

4. Legal Basis for Processing

Under the Ghana Data Protection Act, 2012 (Act 843), we process your personal data on the following lawful bases:

5. How We Share Information

5.1 With Merchants

When you place an order on a merchant's store, we share your customer name, phone number, and delivery address (including landmark) with the merchant so they can fulfil your order.

5.2 With Customers

Store information, product listings, pricing, and merchant refund policies are displayed publicly to customers browsing the platform.

5.3 With Service Providers

We share information with trusted third-party service providers who assist in operating our platform:

• Hubtel — payment processing (Mobile Money), SMS delivery, and OTP verification
• Hosting providers — cloud infrastructure for data storage and processing
• Analytics providers — platform usage analysis and performance monitoring

5.4 For Legal Reasons

We may disclose your information when required or permitted by law, including to:

• Comply with legal obligations or court orders
• Respond to requests from lawful authorities
• Protect the rights, property, or safety of Snrael, our users, or the public
• Prevent or investigate fraud, abuse, or illegal activity

5.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of the transaction. We will notify you of any such change in ownership or control and the choices you may have regarding your information.

5.6 No Sale of Personal Data

We do not sell your personal data to third parties. We only share information as described in this policy to operate and improve our services.

6. Mobile Money Transaction Data

Mobile Money is the primary payment method on Snrael. The following applies to how we handle Mobile Money transaction data:

• Transaction amounts, statuses, and confirmation codes are processed through Hubtel, our payment processor.
• We do not store full Mobile Money account numbers. Payment credentials are handled entirely by Hubtel.
• Your mobile network provider (MTN, Vodafone, or AirtelTigo) is stored for transaction routing purposes.
• Transaction records are retained for 7 years in accordance with financial regulations in Ghana.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy or as required by law. The following retention periods apply:

After the applicable retention period expires, your data will be securely deleted or anonymised so that it can no longer be associated with you.

8. Data Security

We implement a range of technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption in transit — all data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Encryption at rest — sensitive data is encrypted in our databases
• Role-based access controls — only authorised personnel and systems can access your data, based on the principle of least privilege
• Password hashing — all passwords are hashed using bcrypt with 12 rounds of salting
• Secure authentication tokens — JWT access tokens expire after 15 minutes, and refresh tokens expire after 7 days and are stored as HTTP-only cookies
• Rate limiting — sensitive endpoints (login, OTP verification) are rate-limited to prevent brute-force attacks
• Regular security monitoring — we continuously monitor our systems for vulnerabilities and threats

While we take extensive measures to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for keeping your account credentials confidential and notifying us immediately if you suspect any unauthorised access.

9. Your Rights

Under the Ghana Data Protection Act, 2012 (Act 843), you have the following rights regarding your personal data:

• Right of Access — you may request a copy of the personal data we hold about you
• Right to Rectification — you may request that we update or correct any inaccurate personal data
• Right to Erasure — you may request deletion of your personal data, subject to legal retention requirements
• Right to Data Portability — you may request your personal data in a structured, machine-readable format
• Right to Object — you may object to the processing of your personal data for marketing purposes
• Right to Restriction — you may request that we restrict the processing of your personal data in certain circumstances
• Right to Withdraw Consent — you may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal
• Right to Lodge a Complaint — you may file a complaint with the Data Protection Commission of Ghana if you believe your data protection rights have been violated

To exercise any of these rights, please contact us at support@snrael.com or privacy@snrael.com. We will respond to your request within 30 days.

10. Cookies and Tracking

Snrael uses cookies and similar technologies to enhance your experience on our platform:

• Essential cookies — required for core platform functionality, such as maintaining your session and security tokens
• Session cookies — maintain your login state and preferences during your visit
• Analytics cookies — help us understand how users interact with the platform so we can improve our services

We do not use third-party advertising cookies. You can configure your browser settings to refuse cookies, though this may affect the functionality of the platform and your ability to use certain features.

11. International Data Transfers

Your personal data is primarily processed and stored in Ghana. However, some of our cloud hosting and service providers may process data in locations outside of Ghana.

Where cross-border data transfers occur, we ensure that appropriate safeguards are in place in accordance with the requirements of the Ghana Data Protection Act, 2012 (Act 843). These safeguards include:

• Ensuring the receiving country provides adequate data protection
• Implementing Data Processing Agreements with all third-party processors
• Applying contractual clauses that require recipients to protect your data to the same standard

12. Children's Privacy

Snrael is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal information from a person under 18, we will take steps to promptly delete that information from our systems. If you believe that a child has provided us with personal data, please contact us at privacy@snrael.com.

13. Third-Party Links

Our platform may contain links to third-party websites, services, or content that are not operated or controlled by Snrael. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party websites you visit before providing any personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you through one or more of the following channels:

• SMS notification to your registered phone number
• In-platform notification
• Updated notice on our website

The "Last Updated" date at the top of this policy will be revised accordingly. Your continued use of Snrael after the revised policy takes effect constitutes your acceptance of the changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• General Support: support@snrael.com
• Privacy Enquiries: privacy@snrael.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission of Ghana.