Privacy Policy

At Akrabaa, your privacy is sacred. Just as the neem tree shelters those who gather beneath it, we are committed to protecting the personal data of every person who visits, listens, reads, and creates with us.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it. It applies to the Akrabaa mobile application, the akrabaa.com website, and any related services operated by Dade Krama Studios (collectively, the "Service").

Please read it carefully. By using the Service, you acknowledge that you have read and understood this Policy. Where required by law, we will request your explicit consent before processing your personal data.

01Who We Are (Data Controller)

The data controller responsible for your personal data is:

If you are located in the European Economic Area (EEA) or the United Kingdom and wish to contact our representative or Data Protection Officer, please email privacy@dadekrama.com and we will direct your request to the appropriate person.

02Scope and Audience

This Policy applies to all users of the Akrabaa app and akrabaa.com worldwide. It does not apply to:

• Third-party websites, apps, or services that we link to or integrate with — those are governed by their own privacy policies.
• Information processed by Apple or Google when you download Akrabaa from their respective app stores.
• Anonymous, aggregated, or de-identified data that cannot reasonably be linked back to you.

03Personal Data We Collect

We collect personal data in three ways: (a) information you provide directly, (b) information collected automatically as you use the Service, and (c) information received from third parties such as authentication and payment providers.

3.1Categories of Personal Data

3.2Information We Do Not Collect

We do not collect or store full payment card numbers, CVV codes, or mobile money PINs. All payment credentials are handled directly by our payment processors (Apple, Google, and Kowri) under their own security and privacy policies.

We do not intentionally collect special categories of personal data as defined under GDPR Article 9 (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health, or sexual orientation). Users should not submit such data through the Service.

04How We Collect Personal Data

4.1Information You Provide Directly

When you create an account, complete your profile, make a purchase, submit Creator content, contact support, or otherwise interact with the Service, you provide personal data directly to us.

4.2Information Collected Automatically

When you use the Service, we and our service providers automatically collect technical and usage data through cookies, software development kits (SDKs), and similar technologies. This includes Firebase Analytics, Firebase Crashlytics, and Firebase Cloud Messaging.

4.3Information from Third Parties

We receive limited information from:

• Authentication providers (Google, Apple, Firebase): your verified email, name, profile picture, and a unique identifier.
• Payment processors (Apple, Google, Kowri): confirmation that a payment has succeeded or failed, transaction ID, and the last four digits of your payment method (where applicable). For mobile money payments, we receive confirmation from MTN, Vodafone, or AirtelTigo via Kowri.
• Cloud infrastructure providers (Google Cloud Platform, Firebase): operational logs and error reports.

05Why We Collect Your Data and Our Legal Basis

Under GDPR and similar laws, we must have a valid legal basis to process your personal data. The legal bases we rely on are: your consent, the performance of a contract with you, our legitimate interests, and compliance with legal obligations.

5.1Provision of the Service (Contract)

We process your account, profile, library, and transaction data to deliver the Service you have requested — to create your account, fulfil purchases, sync your reading progress, deliver content, and provide customer support. Without this data we cannot provide the Service to you.

Certain features, including access to purchased digital content, require an active account and may depend on the continued availability of the Akrabaa app.

Legal basis: performance of a contract (GDPR Article 6(1)(b)).

5.2Account Security and Fraud Prevention

We process authentication, device, and transaction data to verify identity, detect and prevent fraud, abuse, and unauthorised access, enforce DRM, and protect the security of the Service and our users.

Legal basis: legitimate interests (GDPR Article 6(1)(f)) and legal obligation (Article 6(1)(c)).

5.3Service Improvement and Analytics

We use usage and analytics data to understand how the Service is used, identify bugs, improve performance, develop new features, and make better decisions about what stories to commission and curate.

Where required by law (such as in the EEA and UK), we will only process analytics data with your consent, which you can give or withdraw at any time through the in-app privacy settings.

Legal basis: legitimate interests (Article 6(1)(f)) or consent (Article 6(1)(a)) where required.

5.4Communications and Notifications

We use your contact details to send transactional communications (order confirmations, password resets, security alerts, important Service updates) and, where you have opted in, marketing communications about new releases, Creator features, and Dade Krama events.

You can unsubscribe from marketing emails at any time using the unsubscribe link in any message or in your account settings.

Legal basis: consent (Article 6(1)(a)) for marketing; legitimate interests (Article 6(1)(f)) or contract (Article 6(1)(b)) for transactional messages.

5.5Creator Economy and Payouts

If you join Akrabaa as a Creator (planned for a future phase), we process your submission data, engagement statistics, earnings, and payout details to operate the creator programme, calculate earnings, process payouts via Kowri, and meet tax and accounting obligations. Creator features will be introduced in phases, and additional terms and disclosures will apply at the time of launch.

Legal basis: performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

5.6Legal Compliance

We process personal data when necessary to comply with applicable laws, court orders, regulatory requests, or to establish, exercise, or defend legal claims.

Legal basis: legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)).

06How We Share Your Personal Data

6.1Service Providers (Processors)

We share personal data with trusted third parties that process data on our behalf under written data processing agreements. All service providers process personal data only under our instructions and are subject to confidentiality and data protection obligations. These include:

• Google Cloud Platform & Firebase (Google LLC) — hosting, authentication, database, analytics, crash reporting, push notifications, content delivery.
• Kowri — payment processing for African mobile money and card transactions on akrabaa.com.
• Apple App Store and Google Play — in-app purchase processing for mobile app transactions.
• SendGrid (Twilio Inc.) — transactional and marketing email delivery.
• Algolia or Typesense — search indexing and discovery.
• HQ Consulting — our development partner, with limited access strictly for development, debugging, and support.

6.2Other Users

If you become a Creator and publish content, your display name, avatar, public profile, and the content you submit will be visible to other users. Reviews, ratings, and comments you post may also be visible publicly.

6.3Legal and Regulatory Disclosures

We may disclose personal data when we believe in good faith that disclosure is necessary to: (a) comply with applicable law or legal process; (b) respond to lawful requests from public authorities, including law enforcement; (c) protect the rights, property, or safety of Dade Krama, our users, or the public; or (d) investigate or address fraud, security, or technical issues.

6.4Business Transfers

If Dade Krama is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your personal data may be transferred to the successor entity. We will notify you of any such transfer and any choices you may have.

6.5With Your Consent

We will share your personal data for any other purpose with your explicit consent.

07International Data Transfers

Akrabaa is operated from Ghana, and our service providers (notably Google Cloud Platform and Firebase) are based in or operate from countries including the United States, the European Union, and other regions. This means your personal data may be transferred to, stored in, and processed in countries other than your country of residence.

We take steps to ensure that any international transfer of personal data is subject to appropriate safeguards consistent with applicable law. Where personal data of individuals in the EEA, the United Kingdom, or Switzerland is transferred to a country that has not been recognised by the European Commission as providing an adequate level of data protection, we rely on appropriate safeguards, including:

• The European Commission's Standard Contractual Clauses (SCCs);
• The UK International Data Transfer Addendum;
• Supplementary technical and organisational measures, including encryption in transit and at rest.

You may request a copy of the safeguards we have put in place by emailing privacy@dadekrama.com.

Our infrastructure is designed to prioritise performance, reliability, and accessibility for users across African markets.

08How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. The actual retention period depends on the type of data:

• Account data: for as long as your account is active, plus a limited retention period necessary to resolve disputes, enforce agreements, and comply with legal obligations.
• Transaction and order records: retained for at least seven (7) years to comply with tax, accounting, and consumer protection laws.
• Library and reading progress: for as long as your account is active. Deleted when you delete your account.
• Creator submissions and earnings: retained for the duration of the Creator agreement and for at least seven (7) years after the last payout, for tax and audit purposes.
• Analytics and usage data: retained in identifiable form for up to twenty-six (26) months, after which it is aggregated or deleted.
• Crash and diagnostic logs: retained for up to ninety (90) days.
• Support correspondence: retained for up to three (3) years after the matter is resolved.

After the applicable retention period, we will securely delete or anonymise your personal data. Where deletion is not technically feasible (for example, in encrypted backups), we will isolate the data and protect it from further processing until deletion is possible.

09Your Privacy Rights

Depending on where you live, you have a number of rights over your personal data. Akrabaa honours the following rights for all users worldwide, even where not strictly required by local law.

9.1Rights Under GDPR (EEA, UK) and Ghana's Data Protection Act

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): ask us to delete your data, subject to certain exceptions.
• Right to restriction of processing: ask us to limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object: object to processing based on legitimate interests, including profiling, and to direct marketing.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: Akrabaa does not make decisions producing legal or similarly significant effects about you based solely on automated processing.
• Right to lodge a complaint: with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

9.2Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to: know what personal information we collect, use, disclose, and sell or share; request deletion of your personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information; and not be discriminated against for exercising your rights.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

9.3How to Exercise Your Rights

You can exercise most of your rights directly within the Akrabaa app:

• View, edit, and update your profile in Settings → Profile.
• Manage notification and marketing preferences in Settings → Notifications.
• Export a copy of your data in Settings → Privacy → Download My Data.
• Delete your account and associated data in Settings → Privacy → Delete My Account.

Alternatively, you may contact us at privacy@dadekrama.com. We will respond to verifiable requests within thirty (30) days, or such shorter period required by applicable law. We may need to verify your identity before acting on your request. There is no fee for exercising your rights, unless your request is manifestly unfounded or excessive.

10Children's Privacy

Akrabaa is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us at privacy@dadekrama.com and we will take steps to delete the information.

In jurisdictions where the digital age of consent is higher than 13 (for example, 16 in some EU member states), we require parental consent for users below that age. We may verify parental consent using methods such as email verification or other appropriate means.

If Akrabaa offers content categorised as suitable for children, that content will be clearly marked, and we will apply additional safeguards consistent with the laws of your jurisdiction.

11How We Protect Your Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures designed to protect it from unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS and at rest using industry-standard algorithms (including AES-256 for protected content).
• Firebase Authentication with secure token management and automatic session refresh.
• Rate limiting and account lockout after repeated failed login attempts.
• Email verification for new accounts.
• Role-based access controls limiting employee and contractor access to personal data on a need-to-know basis.
• Regular security reviews aligned with the OWASP Top 10.
• Audit logging of administrative actions on the backend.
• DRM, signed URLs, and device fingerprinting for protected content.
• Secure cloud infrastructure on Google Cloud Platform with regional edge locations prioritising African markets.

Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to notifying you and the relevant supervisory authority of any personal data breach without undue delay, in accordance with applicable law.

12Cookies and Similar Technologies

The akrabaa.com website uses cookies and similar technologies to operate the site, remember your preferences, analyse traffic, and (with your consent) deliver relevant marketing. The Akrabaa mobile app does not use traditional browser cookies but uses similar identifiers via SDKs such as Firebase.

Cookies we use fall into the following categories:

• Strictly necessary: required for the Service to function (e.g., authentication, session management, security).
• Functional: remember your preferences such as language and display settings.
• Analytics: help us understand how the Service is used so we can improve it.
• Marketing: used only with your consent, to measure the effectiveness of our promotional campaigns.

On first visit to akrabaa.com, EEA, UK, and other applicable users will see a cookie banner allowing you to accept, reject, or customise non-essential cookies. You may withdraw or modify your consent at any time through the Cookie Settings link in the website footer or through in-app privacy controls.

13Automated Decision-Making and Profiling

Akrabaa uses limited profiling to personalise content recommendations, surface stories you may enjoy, and improve your experience. We do not use automated decision-making that produces legal or similarly significant effects about you.

You can opt out of personalised recommendations in Settings → Privacy → Personalisation. Doing so may make some recommendations less relevant but will not affect your access to the Service.

14Third-Party Links and Services

The Service may contain links to third-party websites, apps, and services that are not operated by Dade Krama. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of every third-party service you visit.

15Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will notify you through the Service, by email, or by other appropriate means, and update the "Last Updated" date above.

We encourage you to review this Policy periodically. Your continued use of the Service after any update constitutes your acknowledgement of the updated Policy.

16Contact Us and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal data, please contact us first so we can try to resolve the issue:

16.1Lodging a Complaint with a Supervisory Authority

If you are not satisfied with our response, or believe we have not complied with applicable data protection law, you have the right to lodge a complaint with a supervisory authority:

• In Ghana: the Data Protection Commission of Ghana (dataprotection.org.gh).
• In the EEA: your local data protection authority. A list is available at edpb.europa.eu.
• In the United Kingdom: the Information Commissioner's Office (ico.org.uk).
• In California: the California Privacy Protection Agency (cppa.ca.gov).

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority.