Privacy Policy

This Privacy Policy describes how Crimond Enterprise (trading as uStreamline, “we”, “us”, or “our”), a business registered in Ghana with its principal place of business at 1237 Ga Odumase Road, Near Ga Odumase Mantse We, Ghana, collects, uses, discloses, and safeguards personal information when you use our platform and services.

uStreamline is a multi-shop e-commerce platform with WhatsApp automation. This policy applies to two groups of users:

• Shop owners (merchants) who register on our marketing site to operate an online storefront powered by uStreamline.
• Shoppers who visit a merchant's storefront on our platform, interact with the WhatsApp bot, browse products, or place orders.

Where data flows differ between these two groups, this policy addresses each group separately. By using our services, you acknowledge that you have read and understood this policy. If you do not agree, please do not use the service.

This policy is intended to comply with the Data Protection Act, 2012 (Act 843) of Ghana. [REVIEW: confirm full compliance with Ghana DPA and any sector-specific regulation that applies to your business operations.]

From shop owners

• Full name and profile picture.
• Mobile phone number (used for one-time-password authentication).
• Email address, where provided.
• Business and storefront information you supply, including store name, store logo, descriptions, product listings, taglines, and links to your social media accounts.
• Payout details required to receive payments processed through our payment provider.

From shoppers

• Mobile phone number (used for one-time-password verification per shop).
• Name and delivery address provided at checkout.
• Order details, cart contents, and order history with the specific shop you transact with.
• Payment metadata such as transaction reference, amount, and status. We do not store full payment card details — these are handled directly by our payment provider (see Section 4).

From WhatsApp interactions

• Messages exchanged with a shop's automated assistant, including text content and any media you send.
• Conversation state, timestamps, and the phone number you message from.
• The display name associated with your WhatsApp account.

Automatically collected information

• Device and browser information, IP address, and approximate location.
• Local-storage and session-storage data used to keep your cart, chat session, and theme preferences working across pages.
• Authentication tokens and session identifiers.
• Logs and diagnostic data used to detect errors and abuse.

We use the information we collect to:

• Operate, maintain, and improve the uStreamline platform and storefronts.
• Authenticate you, secure your account, and prevent fraud, abuse, and unauthorised access.
• Process orders, deliver receipts, coordinate fulfilment, and provide customer support.
• Process payments through our payment provider.
• Send transactional notifications by SMS or WhatsApp (for example, order confirmations, delivery updates, and verification codes).
• Power AI assistant features used by shop bots to respond to shopper messages. Message content may be processed by third-party AI/LLM providers in order to generate responses (see Section 4).
• Generate aggregated analytics that help merchants understand sales and conversation performance for their own shop. We do not sell personal information.
• Comply with legal obligations and enforce our Terms & Conditions.

We do not use personal information for advertising or marketing to shoppers without an appropriate legal basis. [REVIEW: confirm consent and lawful-basis treatment for any future marketing use.]

To deliver our services we share limited personal information with trusted third-party processors. These providers are bound by contractual obligations to handle data only as instructed and to apply appropriate security measures. We rely on the following categories of providers:

• Payment processing — to initiate transactions, verify payments, and reconcile payouts. Card and account details are entered directly with the payment provider and are not stored on our servers.
• Messaging infrastructure — to send and receive WhatsApp messages between shops and shoppers.
• SMS delivery — to send one-time passwords and transactional text messages.
• AI / large-language-model processing — to power automated responses in shop bots. Message content may be sent to these providers for generation; we do not authorise providers to use your content to train their general models, except where covered by their published policies.
• Cloud hosting and file storage — to host the application, store images and media, and run our database infrastructure.
• Operational tooling — for logging, observability, and error reporting strictly necessary to keep the service running.

[REVIEW: Ghana's Data Protection Act may require named disclosure of cross-border processors. Confirm whether categorical disclosure is sufficient, or update this section to name specific vendors. Also confirm that data-processing agreements are in place with each named or categorised processor.]

We retain personal information only for as long as is necessary for the purposes described in this policy, or as required by law:

• Account data for shop owners and shoppers is retained while the account or storefront is active and for a reasonable period thereafter to allow for recovery, dispute resolution, and legal compliance. [REVIEW: set a specific window such as 12 months post-closure.]
• Order and payment records are retained for the period required by tax, accounting, and commercial laws of Ghana. [REVIEW: typically six years — confirm with your accountant/lawyer.]
• WhatsApp conversation history is retained while the related storefront is active so that shop bots can maintain context.
• Logs and diagnostic data are retained for a short rolling window sufficient to investigate incidents.

When data is no longer required, we delete it or irreversibly anonymise it.

Subject to applicable law, you have the following rights in respect of your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct information that is inaccurate or incomplete.
• Deletion — ask us to delete your personal information, subject to retention obligations.
• Objection and restriction — object to, or ask us to restrict, certain processing.
• Portability — request a portable copy of information you have provided to us.
• Withdrawal of consent — where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email notifications@ustreamline.com. We will respond within the timeframe required by law. You also have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe we have handled your information unlawfully.

We use a combination of technical and organisational measures to protect personal information, including:

• Encryption of data in transit using HTTPS / TLS.
• One-time-password (OTP) authentication for shop owners and shoppers.
• Access controls that limit who can view production data.
• Reliance on reputable third-party providers whose own infrastructure carries recognised security certifications.

No system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to harm you, we will notify you and the Data Protection Commission as required by law.

We use a minimal set of cookies and browser-storage mechanisms strictly to operate the service:

• Authentication tokens to keep you signed in.
• Session storage to preserve your cart, chat session, and shop-context across pages.
• Theme preference to remember whether you prefer light or dark mode.

We do not currently use third-party advertising or tracking cookies. [REVIEW: revise this section if analytics or marketing tags are added in future.] Most browsers allow you to manage cookie settings; disabling required cookies may break parts of the service.

Our service is intended for users aged eighteen (18) and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at notifications@ustreamline.com and we will take appropriate action.

Some of the third-party providers we rely on (for messaging, AI, hosting, and similar services) operate or store data outside of Ghana. Where personal information is transferred internationally, we take reasonable steps to ensure it remains protected by appropriate safeguards consistent with the Data Protection Act, 2012. [REVIEW: confirm that contractual safeguards or adequacy mechanisms are in place with each cross-border processor.]

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you through the service or by SMS, WhatsApp, or email. Your continued use of uStreamline after the effective date of any update constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or our data practices:

• Entity: Crimond Enterprise (trading as uStreamline)
• Address: 1237 Ga Odumase Road, Near Ga Odumase Mantse We, Ghana
• Email: notifications@ustreamline.com