Privacy Policy

CashMango is a non-custodial software platform operated by Hotlab Company Limited in Ghana. We help users create, share, track, confirm, and reconcile payment records for both group collections and merchant businesses. CashMango does not hold or process customer funds through the platform.

For any privacy enquiry, contact us at hello@cashmango.africa.

CashMango acts as a data controller for personal data we collect and use to operate, secure, support, and improve the platform. In some cases a collection organizer, school, merchant, association, or other workspace operator also acts as a controller for the data they choose to upload, publish, manage, or share through CashMango.

If you use CashMango to manage data about contributors, customers, members, students, or other individuals, you are responsible for ensuring you have an appropriate lawful basis and authority to use that data through the service.

When you apply for a loan through a partner lender (see Section 8), the partner lender becomes a separate, independent data controller for the data shared with them at the moment of application. CashMango and the partner lender are not joint controllers.

Depending on how you use CashMango, we may collect:

• Account details such as your name, phone number, email address, password credentials, and profile information.
• Collection or merchant information such as business name, collection title, due dates, payment channels, and account details you choose to display.
• Payment-related records such as amounts reported, payment method selected, references, notes, timestamps, and confirmation status.
• Receipts, screenshots, supporting images, and other proof submitted through the service.
• Device, browser, IP address, analytics, and usage information needed to operate, improve, and secure the platform.
• Consent records including timestamp, IP address, user agent, and version of the consent text you agreed to.
• Support messages, feedback, and communications you send to us.

We use personal data to:

• Create and manage user accounts and workspaces.
• Display public collection or merchant payment details where the account owner has chosen to publish them.
• Record, organize, review, and reconcile payment or sales activity.
• Support dashboard reporting, reminders, notifications, and internal service operations.
• Protect the service against fraud, misuse, abuse, and unauthorized access.
• Respond to support requests and communicate service updates.
• Match you with licensed lending partners at your request and with your consent (Section 8).
• Comply with legal obligations and resolve disputes where required.

We process personal data on the following legal bases under the Data Protection Act, 2012 (Act 843):

• Consent — for optional features such as loan matching, and for any processing you explicitly opt into.
• Contract performance — to provide the CashMango service you have signed up for.
• Legitimate interest — for security, fraud prevention, and service improvement, balanced against your rights.
• Legal obligation — to comply with applicable Ghanaian law, including tax and anti-money laundering obligations.

Where processing depends on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

CashMango is a records and workflow platform. Users may share payment details through CashMango, but payments are made outside the platform using existing channels such as MoMo, bank transfer, or cash. We do not act as your wallet, bank, payment processor, or funds custodian through the current version of the service.

Records, payments, screenshots, confirmations, and receipts shown through CashMango are part of the workflow and review layer of the service. They should not be read as a guarantee from CashMango that a transfer has cleared, settled, or been finally received through the underlying payment channel in every case.

We do not sell personal data. We may share data only in limited cases:

• With service providers that help us host, secure, maintain, or support the platform (including Supabase for hosting and authentication).
• With collection owners, merchants, or authorized workspace users according to the permissions and visibility settings of the relevant workspace.
• With licensed lending partners you have specifically applied to, with your per-application consent (see Section 8).
• Where you instruct or authorize us to share data with another person or service.
• Where disclosure is required by law, regulation, court order, or lawful government request.
• In connection with a business transfer, restructuring, or financing transaction, subject to appropriate confidentiality safeguards.

CashMango is not a lender and does not make credit decisions. As a separate, optional service, merchants may choose to apply for loans through licensed partner lenders (banks, savings & loans companies, or registered microfinance institutions).

Loan matching is strictly opt-in. We only share your sales data with a partner lender when you personally apply for a loan through the CashMango app. At the point of application you will see exactly what data will be shared, which lender will receive it, and whether CashMango receives a referral fee from the lender. CashMango never pays or charges you for the referral.

The partner lender makes the credit decision independently. They may use automated processing to evaluate your application. Under Act 843, you have the right to request human review of any decision that significantly affects you.

You can withdraw your loan-matching consent at any time in Settings. Withdrawal stops future sharing but does not retrieve data already shared with a lender in response to an application you submitted.

CashMango uses infrastructure providers (including Supabase) that may store or process personal data on servers located outside Ghana. Where this happens, we rely on the service provider's contractual safeguards (such as a Data Processing Agreement) and on your informed consent to ensure a level of protection consistent with the Data Protection Act, 2012.

By creating an account you consent to this transfer for the purpose of operating the service. You may withdraw consent by closing your account; some records may be retained for legal or tax purposes as described in Section 10.

We keep personal data only as long as necessary for the purposes it was collected:

• Active account and workspace data — retained while your account and workspace are active.
• Account data after closure — up to 30 days before permanent deletion (subject to legal holds).
• Audit logs (status changes, closures, reconciliations) — 7 years, consistent with tax and audit obligations.
• Consent records — 7 years after withdrawal or account closure for evidentiary purposes.
• Authentication and access logs — up to 90 days on a rolling basis.
• Support communications — up to 2 years from last contact.

Some data may be retained longer where required by law or where necessary to resolve a pending dispute, comply with regulatory requests, or defend legal claims.

We use reasonable technical and organizational safeguards to protect data against unauthorized access, loss, misuse, alteration, or disclosure. These include encryption in transit, access controls, audit logging, and least-privilege role separation for staff. No system is perfectly secure and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and limiting access to authorized users in your workspace.

If we become aware of a security incident that poses a material risk to your personal data, we will notify you and the Data Protection Commission within the timelines required by Act 843.

You have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of data where retention is no longer necessary or lawful.
• Object to or restrict certain processing in limited cases.
• Withdraw consent where processing depends on consent.
• Request information about automated decisions that significantly affect you, and request human review.
• Complain to the Data Protection Commission at dataprotection.gov.gh where you believe your rights have been violated.

To exercise these rights, contact hello@cashmango.africa. We aim to respond within 30 days.

CashMango is registering with the Data Protection Commission and operating in line with applicable requirements under the Data Protection Act, 2012 (Act 843). We may update this policy as our operational status, products, or regulatory obligations evolve.

CashMango is intended for users aged 18 and over. We confirm this at signup and require age confirmation before an account can be created. CashMango is not intended for unsupervised use by children. Where a school, parent, guardian, or authorized institution uses the service in connection with a minor, that institution or adult user is responsible for ensuring they have appropriate authority and lawful basis to share or manage the relevant data.

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, for material changes, provide additional notice through the service. Material changes to loan-matching terms will require you to re-consent before any further data sharing.

For privacy questions, requests, or complaints, contact us at hello@cashmango.africa or support@cashmango.africa.