1. Who controls your data

Amanah is the data controller for personal data processed in connection with the platform. We are registered with the Ghana Data Protection Commission. [REVIEW: insert registration number once issued.]

2. What we collect

Account data — name, email, role (lawyer, firm admin, student), firm/organisation, bar-admission jurisdiction where provided.
Authentication data — Supabase-managed credentials, session tokens, audit events.
Content you upload — documents, drafts, matter notes, research prompts.
Usage data — pages visited, features used, token and query counts (used for billing and to improve the service).
Payment data — handled by Paystack; Amanah stores only the last four digits and a transaction reference.

3. Legal bases

We process personal data under the Ghana Data Protection Act, 2012 (Act 843) on the following bases: (a) performance of a contract with you; (b) your consent, where required; (c) our legitimate interests in operating and securing the platform, preventing fraud, and improving the service; and (d) legal obligations, including tax, accounting and regulatory reporting.

4. How we use your data

To provide the platform and the features you request.
To send transactional emails (password reset, billing, service notices). We will not send marketing email without your consent.
To enforce our Terms, investigate abuse and prevent fraud.
To produce aggregated, de-identified usage statistics. These never identify individuals or firms.

We do not train shared AI models on your private matter documents. Our corpus consists of published primary legal sources and materials licensed for that purpose.

5. Processors we rely on

Supabase — authentication, Postgres database, object storage.
Anthropic — Claude model inference for research, drafting and agents.
Google — text-embedding-004 for vectorising corpus and user queries.
Groq — additional model inference for drafting workflows.
Paystack — payments.
Sentry — error monitoring.
Railway / Render — application hosting.

Each processor is bound by a data-processing agreement restricting use to providing the service to Amanah. Some of these are located outside Ghana; cross-border transfers rely on the safeguards permitted under Act 843.

6. Retention

Account data is retained while your account is active. Matter documents and drafts are retained for the duration of your subscription plus 90 days after termination, after which they are deleted or irreversibly anonymised. Audit logs may be retained for up to 7 years where required by law.

7. Your rights

Under Act 843 you have rights to access, correct, delete and object to processing of your personal data, and to request a copy of the data in a portable format. The address for these requests will be published on this page. We respond within 30 days of receiving a request.

8. Security

Data is encrypted in transit (TLS 1.3) and at rest. Access to production systems is role-based, logged and audited. We conduct periodic security reviews. A responsible disclosure address will be published on this page.

9. Children

The main platform is intended for users aged 18 and above. Amanah for Students is intended for law students aged 16 and above; users below 18 must have parental consent.

10. Changes

We will notify you of material changes to this notice by email and in-product.