Privacy Policy — Reload

1. Who We Are

Reload (reloadgh.com) is operated by Webb Labs LTD, an independent data-bundle reseller. We are not affiliated with or endorsed by MTN Group Limited, Telecel Group, or AT Ghana (formerly AirtelTigo). For privacy matters, contact us at privacy@reloadgh.com.

2. Data We Collect

Account data: name, email address, password (hashed), phone number.
Transaction data: order history, bundle type, recipient numbers, payment method, amounts paid.
Device & usage data: IP address, browser/app version, pages visited, session timestamps.
Country-level location: for visitors outside Ghana, we detect your country from your network's IP address (via Cloudflare) to recommend a display currency (USD, GBP, or EUR). We do not derive or store city-level or precise location, and this detection never affects the price you are charged — only which currency it is shown and charged in.
Currency preference: if you manually choose a display currency, we store that choice in a cookie/local storage on your device and, if you are signed in, on your account, so it is remembered on your next visit.
Payment data: we do not store full card numbers. Payments are processed by Paystack and Stripe, who maintain their own privacy policies.
Push notification tokens: Firebase Cloud Messaging tokens to deliver order status notifications.

3. How We Use Your Data

To process and fulfil data-bundle orders.
To send transactional emails and push notifications (order confirmation, delivery status).
To calculate XP, manage leaderboard rankings, and award badges.
To prevent fraud and enforce our no-refund policy.
To comply with legal obligations and respond to lawful requests.
To improve the platform via aggregated, anonymised analytics (PostHog).

4. Legal Basis (GDPR)

Where applicable, we process your data on the basis of: contract performance (to fulfil your orders), legitimate interests (fraud prevention, security), and consent (marketing communications, where separately obtained).

5. Data Sharing

We share data only where necessary:

Network fulfilment partners — to fulfil MTN, Telecel, and AirtelTigo bundle orders (each receives the recipient phone number and bundle type only, for the network that order is on).
Paystack / Stripe — to process payments.
Firebase (Google) — for push notifications.
Resend — to send transactional emails.
Sentry — for error monitoring (anonymised stack traces).
We never sell your personal data to third parties.

6. Data Retention

We retain account and transaction data for a maximum of 3 years from your last activity, after which it is automatically deleted. You may request earlier deletion at any time (see Section 9).

7. Cookies

We use essential cookies for authentication and session management, including a cookie that remembers your chosen display currency (Section 2). Analytics cookies (PostHog) are used only with your consent. See our Cookies Policy for full details.

8. Your Rights

You have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure of your data (see Section 9 for account deletion).
Object to or restrict processing.
Data portability.
Lodge a complaint with your local data protection authority.

Exercise any right by emailing privacy@reloadgh.com. We respond within 30 days.

9. Account Deletion & Data Erasure

You can permanently delete your Reload account and all associated personal data at any time. Deletion is irreversible.

How to delete your account

Open the Reload app → Profile → Account Settings → Delete Account.
Or email privacy@reloadgh.com with subject line "Account Deletion Request" and your registered email address.

What gets deleted

Your name, email, password hash, and phone number.
Saved numbers, badge data, XP records, and leaderboard entries.
Push notification tokens.

What is retained

Transaction records are retained for up to 3 years in anonymised form to comply with financial regulations, fraud prevention obligations, and dispute resolution requirements. These records are not linked to your identity after deletion.

Deletion requests are processed within 7 business days.

10. Security

Passwords are hashed using bcrypt. All data in transit is encrypted via TLS. We use Cloudflare for DDoS protection. Production access is restricted to authorised personnel only.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or in-app notification. Continued use of the platform constitutes acceptance of the updated policy.

12. Contact

Webb Labs LTD
Email: privacy@reloadgh.com
Support: support@reloadgh.com