Privacy Policy

Account data: Full name, email address, and (optionally) phone number when you register.

Transaction data: Voucher issuance and redemption records, including merchant ID, value, timestamp, and SHA-256 voucher hash. This data is necessary for financial audit compliance and is retained even after account deletion in anonymised form.

Identity verification data: For merchants and corporate senders, we collect business registration documents and may collect a national ID as required by our KYC process. This data is handled by our KYC partner and is not stored directly on PadyBox servers.

Usage data: IP address, browser type, pages visited, and actions taken on the platform. This data is collected for security monitoring and service improvement.

USSD session data: When you use our USSD redemption channel, your mobile number and session interaction data may be logged by the mobile network operator. See Section 7 for details.

We share your data only with:

• Supabase (database & authentication)

  Hosts our encrypted database and authentication system. Data is stored in the EU (West) region.

• PawaPay (payment processing)

  Receives transaction amounts and mobile money numbers to process payments. Subject to PawaPay's own privacy policy.

• Resend (transactional email)

  Receives your email address to deliver voucher confirmations and account emails. Not used for marketing.

• Law enforcement / regulators

  Only when required by a valid court order, subpoena, or legal obligation in Ghana or Sierra Leone.

Active accounts: We retain your personal data for as long as your account is active.

Account deletion: You may delete your account at any time from your account settings. When you do, we permanently anonymise your identity: your email address is replaced with a randomly generated token in the format deleted-{uuid}@padybox.deleted and your name is cleared. Your transaction records are retained in this anonymised form for financial compliance (typically 7 years under Ghana and Sierra Leone AML regulations), but they are permanently dissociated from your identity.

Voucher audit logs: SHA-256 voucher hashes and redemption records are retained indefinitely in anonymised form for financial audit compliance. These records cannot be linked back to you after deletion.

Depending on your jurisdiction, you have the right to:

• Access:Request a copy of all personal data we hold about you.
• Correction:Request correction of inaccurate data.
• Deletion:Request deletion of your account and personal data (subject to retention obligations above).
• Portability:Request your data in a structured, machine-readable format.
• Objection:Object to processing of your data for specific purposes.

To exercise any of these rights, email privacy@padybox.io or use your account dashboard. We will respond within 30 days.

PadyBox uses only essential cookies required for authentication and session management via Supabase. We do not use advertising trackers, third-party analytics cookies, or any non-essential cookies.

Session cookies are cleared when you close your browser. Authentication tokensare stored in your browser's localStorage and expire automatically after a configurable inactivity period.

You may clear all stored data at any time by logging out or clearing your browser storage. Blocking cookies may prevent you from logging in.

Our USSD redemption service (*123*PADYBOX#) is provided via a licensed mobile network operator (MNO) integration. By using the USSD channel, you should be aware of the following:

• •Your mobile number (MSISDN) is passed to PadyBox during the USSD session to identify your account.
• •Session interaction data (keypad inputs) may be logged by the MNO and by PadyBox for fraud prevention and audit purposes.
• •Standard network charges applied by your MNO for USSD sessions may apply.
• •USSD session logs on the PadyBox side are retained for 90 days, then deleted.