Privacy policy

1. Who we are#

SMA (Smart Market Advert) is operated by Rovid, based in Ghana. This policy explains how we collect, use, share and protect personal data when you use the SMA marketplace, shops built on SMA and our apps, and the rights you have under Ghana’s Data Protection Act, 2012 (Act 843).

For the data described here we are the “data controller”. When you order from a shop, that shop also receives your details and is responsible for how it uses them (see who we share it with).

2. What we collect#

When you shop

• Order details: your name, phone or WhatsApp number, email address, delivery address or pickup request, notes to the shop, and the items, options and prices you ordered.
• Account details (if you create a shopper account): your email address, saved delivery addresses, your wishlist, and records of your sign-ins. Sign-in codes and session tokens are stored only in scrambled (hashed) form.
• Reviews: your rating, review text and the display name you choose.
• Messages: what you send to a shop through its contact or enquiry form, newsletter sign-ups, questions you ask a shop’s AI shopping assistant, and messages you send to SMA.
• Order tracking: the order number and phone number or email you enter to look up an order.

When you browse

• Usage information: pages and products viewed, items added to a cart, checkouts started, the site that referred you, and a random visitor identifier stored in your browser. Shops see these figures only as totals.
• Technical information: your IP address, browser and device details, used to keep SMA secure, apply rate limits and diagnose errors.
• Cookies and browser storage: see our cookie notice.

When you sell

• Seller account: your name, email address and sign-in details (handled by our authentication provider), and your shop’s business name, contact numbers, address and settings.
• Shop content: products, photos, posts and the customer and order records of your shop.
• Connected channels: access tokens and keys for the social and messaging accounts you connect. These are encrypted before they are stored.
• Billing: your plan, payment references, amounts and dates. Card and mobile-money details are handled by the payment provider, not stored by us.
• Support and referrals: support requests you send us, and referral codes and commissions if you take part in our referral programme.

3. How we use it, and our legal grounds#

Act 843 allows us to process personal data only for a lawful reason. We use your data as follows:

We do not sell personal data, and we do not use it for decisions that have legal or similarly significant effects on you based solely on automated processing.

4. Who we share it with#

• The shops you order from. Each shop receives the details of its own order (your name, contact details, delivery address, notes and items) so it can confirm, deliver and support it. A shop never sees what you ordered from other shops. The shop is responsible for its own use of your data under Act 843.
• Service providers who process data for us under contract and only on our instructions:
  • hosting and database providers that run our servers;
  • S3-compatible cloud storage (such as Cloudflare R2) for images and files;
  • email delivery providers, and SMS Online Ghana for text messages;
  • Clerk, which handles seller sign-in;
  • Anthropic, whose Claude AI models power AI features: only the text needed for the task is sent, such as a product description or a question asked to a shop’s assistant;
  • payment providers that process seller subscription payments, such as Rovid Pay and Paystack;
  • error-reporting and product-analytics services (such as Sentry and PostHog), where enabled;
  • the social networks and WhatsApp gateway services that sellers connect, to publish the sellers’ posts.
• Authorities and others where the law requires it, or where necessary to protect the rights, safety or property of our users, the public or SMA.
• A buyer or successor if SMA’s business is reorganised or sold, under the same protections.

5. International transfers#

Some of our service providers store or process data outside Ghana, for example in the European Union or the United States. When we transfer personal data abroad, we use providers that commit to protect it to a standard comparable to Act 843, through contractual safeguards and security measures, and we transfer only what the service needs.

6. How long we keep it#

• Orders are kept while the shop’s account is open, so that the shop and you can refer to them, and afterwards for as long as tax, accounting or legal-claim rules require.
• Shopper accounts are kept until you ask us to delete them. Sign-in codes expire after 10 minutes, and sign-in sessions after 30 days.
• Detailed browsing events are deleted after 90 days; only daily totals that do not identify you are kept after that.
• Seller accounts and shop content are kept while the shop is open and deleted within a reasonable time after it closes, except records we must keep by law, such as payment records.
• Messages and support requests are kept for as long as needed to deal with them and any follow-up.

7. How we protect it#

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), encryption of connected-account keys, hashing of sign-in codes and session tokens, separation of each shop’s data, access controls for staff, rate limits against automated abuse, and regular backups. No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Commission where the law requires.

8. Your rights#

Under Act 843 you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that is inaccurate, out of date or incomplete;
• ask us to delete or destroy data we no longer have a lawful reason to keep;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it, without affecting earlier processing; and
• complain to the Data Protection Commission.

Signed-in shoppers can update saved addresses in their account. For anything else, contact us using the details below. We may need to confirm your identity before acting on a request, and we will respond within the time the law requires. For order data a shop holds, you can also contact the shop directly; we will help if it does not respond.

9. Children#

SMA is not intended for children under 18 and we do not knowingly collect their data. Young people should use SMA only with a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

10. Cookies#

We use a small number of cookies and browser storage entries that keep you signed in, remember your cart and preferences, and measure visits to shops. We do not use advertising cookies. The full list is in our cookie notice.

11. Changes to this policy#

We will update this policy when our practices or the law change, and change the “Last updated” date above. For significant changes we will give notice on SMA or by email.

12. Contact us and complaints#

To exercise your rights or ask about this policy, contact us:

• Send us a message through our contact page.
• WhatsApp: +233247913462

If you are not satisfied with our response, you can complain to the Data Protection Commission of Ghana (dataprotection.org.gh).