Privacy Policy

TailoredFlow is a product of AMC Technologies, a business registered in Ghana under the Registration of Business Names Act, 1962 (Act 151) with registration number BN336890326, trading as Cheqam. In this policy “we”, “us” and “our” mean AMC Technologies.

We process personal data in Ghana and are subject to the Data Protection Act, 2012 (Act 843) and the supervision of the Data Protection Commission.

Our address is Spintex, Aviation Highway, Accra, Ghana. You can reach us at [email protected] or +233 24 504 5867.

There are two separate kinds of personal data in TailoredFlow, and our responsibilities differ for each. Reading this section first will make the rest of the policy make sense.

1. Your account, where we are the data controller. This is data about you as the business owner or member of staff: your name, your email address, your phone number, your business details, what you pay us and what you ask support. We decide what happens to this data, so we are the controller and this policy governs it directly.

2. Your business records, where we are a data processor. This is everything you enter about other people: your customers and their contact details, a tailoring client's measurements, a pharmacy patient's allergies and medication, your staff and their pay. You decide what to collect and why. You are the data controller for that information and we are your processor: we hold and process it on your instructions, to run the service for you, and for nothing else. We do not sell it, mine it, or use it to build products.

The practical consequence is that if one of your customers asks to see or delete what is held about them, that request is yours to answer, not ours. We will help you find and export it. If such a request reaches us directly, we will point the person to you rather than act on their data ourselves.

• Identity and contact: your name, email address and phone number. If you sign in with Google, we receive your name, email address and profile picture from Google; we never receive your Google password.
• Business profile: your business name, business type, trading address and any social media handles you choose to add.
• Subscription and billing: your plan, renewal dates, and the record of each payment, including the mobile money number used, the network, the amount and the transaction status.
• Payment collection enrolment (optional): if you ask us to collect your customers' payments, your business registration document (Form A) and the trading details we verify against it. We are required to collect and keep this by the Anti-Money Laundering Act, 2020 (Act 1044).
• SMS sender ID verification (optional): if you apply for a sender ID for SMS campaigns, your Ghana Card number and phone number. This is required by the networks before they will let messages be sent in your business's name. It is captured once and is not shown back to you or to our staff in full.
• Support: what you write to us by email, WhatsApp or the contact form, and the page you were on when you sent it.
• Technical: your IP address and browser type, recorded by our hosting and security infrastructure as part of serving the page.

You choose what goes in here. Depending on your trade, it may include:

• Customers and clients: name, phone, WhatsApp number, email, address, notes, purchase history and any credit they owe you.
• Body measurements, if you run a tailoring house or boutique.
• Patients and prescribers, if you run a pharmacy: name, gender, date of birth, address, NHIS number, prescriber and licence details, and allergies, chronic conditions and current medications.
• Staff: name, email, role and permissions, salary and payslips.
• Marketing lists: the phone numbers and names you send SMS campaigns to.

A specific warning about health data. Information about a person's health is special personal data under Act 843 and carries stricter duties than ordinary contact details. If you use the pharmacy features to record allergies, chronic conditions or medication, you are the controller of that data and those duties are yours. In practice that means collecting it only where you genuinely need it, telling the patient what you hold and why, keeping it accurate, and not disclosing it to anyone who has no clinical or lawful reason to see it. We give you role-based staff permissions so you can limit who in your shop can open a patient record; using them is your decision.

• To provide the service you signed up for (performance of our contract with you): running your account, saving your records, processing sales, sending receipts, and keeping your data available across your devices.
• To take payment (performance of our contract): billing your subscription and, if you have enrolled, settling money we collect on your behalf.
• To meet legal obligations: tax records, and the identity checks required before we may handle money for you.
• To support and secure the service (our legitimate interests): answering your questions, investigating faults and abuse, and preventing fraud.
• With your consent: optional things you switch on, such as applying for an SMS sender ID. You can withdraw consent at any time, which stops the future processing but does not undo what was lawful before.

We do not sell your personal data, and we do not sell or share your business records. We do not use your customers' data to advertise to them.

We use a small number of service providers to run TailoredFlow. They act on our instructions and may only use the data to provide their service to us:

• Google (Firebase): sign-in, database and file storage. This is where your account and your business records are held.
• Cloudinary: hosting the product and business images you upload.
• Hubtel: a payment service provider licensed by the Bank of Ghana. It processes mobile money and card payments. Your customers' payment credentials go to Hubtel, not to us; we never see or store a PIN, a full card number or a wallet password.
• Hubtel also acts as our SMS aggregator, delivering the receipts and campaign messages you send and registering your sender ID with the networks.
• Formspree: delivering messages sent through the contact form on our website.
• Google Ads: measuring which of our adverts bring businesses to cheqam.com. This runs on our marketing website only. It is not present anywhere inside the app, so it never sees your business records, your customers or your sales. Our Cookie Policy explains exactly what it sets and how to refuse it.

We will also disclose data where we are required to by law, by a court, or by a regulator acting within its powers, and where it is necessary to establish or defend a legal claim. If our business is sold or merged, your data may transfer with it; we will tell you before that happens.

Our infrastructure providers store data on servers outside Ghana. Act 843 permits personal data to be transferred abroad where the receiving country or provider offers an adequate level of protection, and we rely on our providers' contractual data protection commitments for this.

If you require your data to remain within Ghana, contact us at [email protected] before you sign up, so we can tell you honestly whether we can meet that.

While your account is active, we keep your data so the service works.

After you cancel, we keep your data for 90 days, then delete it. That window exists so you can change your mind or export your records; it is not a period in which we do anything else with the data. You can ask us to delete it sooner and we will, subject to the exception below.

The exception is records we are legally required to retain. Transaction and accounting records are kept for the period Ghanaian tax law requires, currently six years under the Revenue Administration Act, 2016 (Act 915), and identity records collected for anti-money-laundering purposes are kept for the period Act 1044 requires. These are retained for that purpose alone.

You have the right to:

• be told whether we hold personal data about you, and to be given a copy;
• have inaccurate data corrected, and incomplete data completed;
• have data deleted where we no longer have grounds to keep it;
• object to processing based on our legitimate interests;
• withdraw consent where consent is what we rely on;
• ask us to stop processing your data for direct marketing, at any time;
• complain to the Data Protection Commission.

To exercise any of these, write to [email protected]. We will respond within 30 days. We will ask you to confirm your identity first, so that we do not hand your data to somebody else.

If you are unhappy with our answer you may complain to the Data Protection Commission of Ghana, which supervises compliance with Act 843. Contacting us first usually resolves things faster, but you are not obliged to.

Data is encrypted in transit and at rest by our infrastructure providers. Access to production data is limited to the people who need it to run the service. Your staff accounts carry role-based permissions, so a cashier does not see your margins or your reports.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to affect you, we will tell you and the Data Protection Commission as Act 843 requires, and we will tell you what we know rather than the least we can say.

Your part matters too: use a password you have not used elsewhere, give each member of staff their own login rather than sharing one, and remove people who leave.

TailoredFlow is a tool for running a business and is not intended for children. We do not knowingly collect data from anyone under 18 as an account holder. If you record a customer or patient who is a minor, you are responsible for having the appropriate consent from a parent or guardian.

We update this policy when the product changes what it collects or who it shares data with. The date at the top tells you when it last changed. If a change materially affects your rights, we will tell you in the app or by email rather than relying on you to notice.