Privacy Notice
A clear account of what Ujimora collects, why it is needed, and the choices available to you.
Collect what is needed. Protect it. Explain its use.
This notice covers account data, campaign records, payments, security, retention, and your rights under Act 843.
At Ujimora, we are committed to protecting your privacy and the security of your personal information. This notice explains how we collect, use, share, retain, and protect data when you use the platform.
Blockchain and crypto payment information
Where you use crypto checkout, payment records may include wallet addresses, network, asset, transaction hash, memo or tag, quote, campaign-currency value and provider references. We use relevant records to match and confirm contributions, investigate failures and support required compliance checks with payment partners. Blockchain transactions can be public and persistent; hiding your name on a campaign does not make a blockchain transfer anonymous. We cannot erase records on public blockchains.
AI writing and safety screening
For account and organization identity changes, creator-page changes, campaign creation, campaign URL changes, comments, campaign updates, live-session titles and thank-you messages to donors, automated text screening is optional and requires your permission for that submission. If you opt in, the proposed public text is sent to OpenAI for safety screening. Otherwise staff review it; flagged text and attached media also require staff review. Proposed versions and decisions stay in a private publication-review record for up to 30 days, with scheduled deletion, and operational review records are removed on account closure. When automatic publishing applies to a held version, staff approval publishes it, after the same checks as when you publish it yourself, and you are told the outcome in your notification inbox. It is not published if a newer version was submitted or the item changed after you submitted it, if you withdrew it, or if your password or two-step verification settings changed since then. For that check, a one-way fingerprint of your sign-in settings is stored with such a version and deleted with its review record. Otherwise, and always for live-session titles, which are published only when the host starts the session, an approved version must be submitted again within seven days of approval. Publication reviews and your notification inbox show which applies. An approval does not authorize changed content, a campaign goal or any payment. Staff audit records may be retained separately for accountability. When you explicitly request AI writing, your text, instructions and generated draft are processed by OpenAI for writing assistance and safety screening. Flagged drafts are withheld; unavailable screening does not approve a draft. Ujimora records usage and your request-specific permission without storing raw writing input or output in its usage log. A result fingerprint lets us validate safety reports. If you choose Report on a suggestion, the original generated text and your report are saved in the restricted moderation queue for review and follow-up. Review suggestions before using them. Automated checks can make mistakes and do not verify facts or replace human moderation; contact support if a request needs review.
1. Controller and scope
The Ujimora website, applications and crowdfunding services are operated by DevTrack, registered in Ghana under registration number BN843072020, with a registered office at UNN House, Nii Osae Ntifu Avenue, East Legon, Accra, Greater Accra, Ghana (“Ujimora”, “we”, “us”). Contact: support@ujimora.com; privacy: legal@ujimora.com. Ujimora acts as data controller for personal data it determines how and why to process, subject to any processor or controller allocation agreed with payment, identity and infrastructure partners.
2. Data we collect
Account and contact data: name, email, phone, and login or account identifiers. Identity, KYC and KYB data: identity documents, organization records, beneficial owners or signatories, and verification results where required. Campaign data: story, beneficiary information, evidence, updates and public content. Payment and financial metadata: transaction references, amounts, payment channel, payout destination details and reconciliation status. Card credentials are handled by the payment provider rather than stored by Ujimora. Device and security data: IP address, device and browser, logs, fraud signals and authentication events. Support, complaint and communications records.
3. Why we use data
Provide accounts, campaigns, contributions and payouts. Perform identity and business verification, fraud prevention, AML/CFT and security controls. Process subscriptions and fees and reconcile transactions. Provide support, resolve disputes and enforce our terms. Meet legal, regulatory, audit and partner obligations. Improve and oversee the service using internal, aggregated reports on accounts, campaigns, transactions and website visits (no third-party analytics or tracking tools). Send marketing only where permitted and with applicable choice or consent.
4. Legal basis and fairness
Ujimora processes personal data only on an applicable lawful basis, including consent where required, performance of a contract, legal obligations and other bases permitted under Act 843. Collection is relevant, necessary and not excessive for the stated purpose.
5. Sharing
Data may be shared as necessary with payment processors, banks, identity and KYC vendors, hosting and security providers, professional advisers, authorities where legally required, and campaign parties where the service requires it. Ujimora contractually governs its processors and discloses material categories of recipients.
Optional activity alerts and emails
In Settings, you can separately opt in to notification-inbox alerts and emails about donations, creator support, withdrawals and payouts, refunds, wallet activity and subscriptions. Each activity and channel starts off. We store your choices and their change times and use relevant transaction details to prepare the updates you select. Activity emails use our email delivery provider, Resend, and require a verified account email. You can turn a choice off at any time; this stops queued messages that have not already been sent. These choices do not subscribe you to marketing. Account verification, password recovery and password-change security notices remain separate. Decisions our team makes on your own campaigns, verification applications and reports, requests for more information, and invitations or changes affecting your campaign access appear in your notification inbox as service notices. We also email a notice with a sign-in link to your verified account address so you can review the details and take action; private case details stay inside your account. Newsletter and promotional emails require a separate request and email confirmation. We record when you request, confirm or withdraw that choice. You can turn newsletter emails off in Settings or use the unsubscribe link without signing in. Confirmation emails use Resend. Previously collected addresses without confirmed consent are excluded from the mailing list.
Thank-you messages from campaigns you support
After a campaign ends or a payout is made, its organizer or beneficiary may send its donors a thank-you message through Ujimora. Ujimora limits how many each campaign can send (normally one). We choose the recipients from successful donations: fully refunded or reversed donations are excluded, and a donor who gave more than once receives one copy. We email the message through Resend to your verified account email if you gave while signed in, or to the email you gave at checkout. The organizer and beneficiary see only how many people it reached, never names or email addresses, and anonymous donations stay anonymous. To prevent duplicate messages, we keep a delivery record for each recipient with a reference to the donation or account, a one-way hash of the address, the delivery status and times. While a delivery is pending or can still be retried, the prepared email, including your address, is stored with it. You can stop these messages with the unsubscribe link in the email, without signing in, or in Settings; we keep a one-way hash of your address to honour that choice. These messages are not marketing and do not subscribe you to the newsletter.
Campaigns run for someone else
When an account creates a campaign for another person or organization (the beneficiary), it gives us the beneficiary’s name, email address, relationship to the organizer and the reason for the campaign. We use the email address to invite the beneficiary to accept or decline the campaign and to check that the account accepting it uses that address. It is never shown publicly; the organizer and our staff see only a partly hidden version, and we delete it from the invitation once the beneficiary accepts or declines or a new invitation replaces it. Invitations are emailed through Resend. The campaign page shows the beneficiary’s name and whether they have confirmed the campaign. When a beneficiary accepts, declines or withdraws consent, we record the decision, its time, the version of the terms shown, a fingerprint of the campaign details they saw, and the IP address and browser information of the person deciding, as evidence of the decision.
Optional account protection
After signing in, you can enable an authenticator app for an extra sign-in code. We store its secret encrypted, hashes of single-use recovery codes and security-change records. Keep the setup key and downloaded recovery codes private. On supported mobile devices, biometric unlock is a separate optional setting. Fingerprint and face information stays within your device authentication system; Ujimora uses the result to access a protected saved sign-in credential. Signing out removes that saved credential and biometric preference from the app. You can use password and authenticator sign-in instead. Server-side authenticator data is removed through the account-erasure process; necessary security audit records are kept only as long as needed for security and legal purposes.
Optional organization website requests
An organization can separately request website assistance during signup. If selected, its organization and contact details and website request may be used for follow-up by parent company Neurodyne Corp Ltd (https://neurodyne.dev; info@neurodyne.dev). This is optional and is not required to use Ujimora. New requests and withdrawals are timestamped. Use Withdraw website request in the signed-in notice to stop the request; for contact already underway, contact info@neurodyne.dev. Withdrawing the request does not affect the account or its donations.
6. International transfers
Where data is processed outside Ghana, Ujimora assesses and implements the safeguards required by applicable Ghanaian law and by its contractual and provider arrangements.
7. Retention
Personal data is retained only as long as necessary for the stated purpose and applicable legal, financial, fraud, dispute, audit and regulatory obligations. Contact legal@ujimora.com for the retention period that applies to particular data.
8. Your rights
Subject to Act 843, you may have rights to be informed, to access your personal data, to request correction or rectification, to object to certain processing and to exercise other applicable data-subject rights. To make a request, contact legal@ujimora.com.
9. Security
Ujimora uses reasonable technical and organisational measures including access controls, encryption where appropriate, secure development, monitoring, backups, incident response and least-privilege administration. No method of electronic transmission or storage is completely secure.
10. Cookies and analytics
Ujimora web properties do not currently use cookies or third-party analytics, tracking or advertising technologies. We produce internal reports on accounts, campaigns and transactions, and collect cookie-free website visit counts. Visit records contain the website and page path without query strings, referrer domain, device and browser category, time and country when our hosting provider supplies it. We derive a daily anonymous visitor fingerprint from the IP address and browser information; we do not store the raw address or full browser string in visit records. The fingerprint changes each day, and visit records expire after 400 days. We respect the browser Do Not Track signal. See the Cookie Notice for the browser storage we use.
11. Children
Ujimora is intended for users aged 18 and over. Campaigns involving children require appropriate adult authority and heightened handling of personal information.
12. Contact and complaints
In account Settings, you can submit a private request for access to your data, correction or a privacy review, check progress and read our response. We aim to respond within 30 days; applicable legal requirements continue to apply. If you cannot sign in, or need another way to receive information, contact legal@ujimora.com. Request details and review records are used to handle and document your request. You may also contact the Ghana Data Protection Commission regarding your rights or concerns where applicable.
13. Updates
This notice shows its effective date and material changes will be communicated appropriately.
Legal & regulatory basis
This document is grounded in the Ghanaian legal framework applicable to donation and reward crowdfunding, including: • Bank of Ghana crowdfunding guidance — donation and reward crowdfunding involve the collection, holding and disbursement of funds through an appropriate regulated structure or partnership. • Data Protection Act, 2012 (Act 843) and Data Protection Commission guidance. • Electronic Transactions Act, 2008 (Act 772) — online supplier information, pricing and fees, contract access, refund information and secure payment-system requirements. • Payment Systems and Services Act, 2019 (Act 987), as applicable to our regulated payment partners. • Applicable AML/CFT requirements confirmed with our regulated partners.
Privacy-related inquiries can be sent to legal@ujimora.com.