Privacy
What this system stores about you, why, and for how long.
Version 2026-09-08 · Last updated 8 September 2026
This notice has not been reviewed by a lawyer. It describes what the software actually does, checked against the database schema, and it is written to be a truthful starting point — not a finished legal document. Ghana's Data Protection Act, 2012 (Act 843) also requires whoever operates this system to register as a data controller with the Data Protection Commission. Have this reviewed, and that registration confirmed, before relying on either.
Who holds your information
EwenamTech is the data controller: it operates this system and decides what is done with the information in it. Credits Monitor is the software; the shop records inside it belong to the businesses that entered them.
On what basis
Almost everything here is processed because it is necessary to provide the service you asked for — your name and contact details identify your account, and your entries are the service itself. Two things rest on a different footing:
- Sign-in attempts, including your IP address, are kept because we have a legitimate interest in stopping people guessing at passwords, and because you have an interest in being able to see whether somebody has tried.
- Records we must keep by law, if any apply, are kept for as long as the law requires and no longer.
Where it is stored
Not in Ghana. The database runs on Cloudflare's infrastructure in the United Kingdom and the European Union, and messages are sent through providers that may also operate outside Ghana.
This matters and is not a detail: Ghana's Data Protection Act, 2012 (Act 843) sets conditions on moving personal data out of the country. Anyone operating this system should confirm those conditions are met for their deployment. It is disclosed here rather than left out, because a notice that is quiet about where the records live is not worth reading.
What is stored, and why
Every item below is a real field in the database, not a category of thing that might be collected.
| What | Why it exists | Kept for |
|---|---|---|
| Your name, and a phone number, an email address, or both — whichever you gave us. One of them is what you sign in with. | To identify your account and to send the six-digit code that confirms it is you signing in. | As long as the account exists |
| Your password, stored only as a one-way hash (PBKDF2-HMAC-SHA256, 600,000 iterations). | To check a password without being able to read it. Nobody operating this system can recover your password — only replace it. | As long as the account exists |
| Your shop's name, sector, category, location, and its registration number if you gave one. | To label your records and to choose which categories of income and expense you are offered. | As long as the shop exists |
| The entries you make: date, amount, category, and any note. Assets and liabilities you declare. Stock items and their movements. | These are the product. They are your books, entered by you. | Until deleted. You can delete individual entries yourself; see below for the rest. |
| Sign-in attempts: the phone number or email typed, whether it worked, your IP address, and your browser's self-description. | To refuse repeated guessing at your password, and so an administrator can see whether somebody has been trying to get into your account. | 90 days |
| Your open sign-in sessions, held as a hashed token. | To keep you signed in without storing anything reusable. | 12 hours, then deleted |
| Sign-in codes, stored only as a hash alongside the number they were sent to. | To check the code you type without storing the code. | Usable for 5 minutes; the record is deleted after a day |
| If you start opening a shop and do not finish: the shop name, your name, the phone number or email you gave, and your chosen password as a one-way hash. | To hold the request while we wait for you to confirm the code. Nothing is created until you do — no shop, no account. | 1 hour, then deleted |
What is not collected
- No tracking of any kind. There is no analytics, no advertising, no third-party script, and no pixel. The app loads nothing from anywhere except itself — a content policy enforces that in the browser as well.
- One cookie, and it is strictly necessary. It holds your sign-in session and nothing else. There is no cookie banner because there is nothing to consent to: a cookie that only keeps you signed in is the kind every data-protection regime exempts.
- No location beyond the town you typed, no contacts, no camera, no microphone. The app tells your browser to refuse those outright.
Who else sees it
These, and only these, because the software cannot work without them.
- Cloudflare runs the servers and stores the database. Everything above sits on their infrastructure, in the United Kingdom and the European Union.
- An SMS provider — chosen by the administrator, and one of Arkesel, Hubtel or Twilio — receives your phone number and the text of the sign-in code, because that is what sending a message requires.
- An email provider, currently Cloudflare's own email service, receives your email address and the text of the code when a code goes to an address rather than a handset.
None of them receives anything else: no entries, no amounts, no stock, and no password — only the address or number, and the message.
Nothing is sold, and nothing is shared for marketing. If a court or a regulator with authority in Ghana requires disclosure, the operator has to comply, and this notice cannot promise otherwise.
What you can do
- See it. Everything the system holds about your trading is on your own screens. Reports will export the whole period as a CSV file.
- Correct it. Ledger entries and declared assets can be deleted and re-entered by you. Ask an administrator to change your name, phone number or shop details.
- Delete it. The shop owner can delete the shop and every record in it from Account → Delete your shop, with their password. It happens seven days later, so a mistake can be cancelled; after that it is gone, along with the shop's helper accounts and their sign-in history. Download a copy from Reports first if you want one.
If you are not satisfied
Ask the operator first — they can usually fix it faster than anyone else. If that does not resolve it, you can complain to Ghana's Data Protection Commission, which supervises how personal data is handled in Ghana and can act independently of whoever runs this system.
How it is protected
- Signing in takes a password and then a code sent to your phone. Knowing the password alone is not enough.
- Passwords are stored as hashes that cannot be reversed, and nobody can reset yours over SMS — an administrator has to hand you a temporary one, which is deliberately harder than a link and is what stops somebody who has your SIM from taking the account.
- Every read of your books is filtered by your shop in the query itself, and repeated failed sign-ins are refused for fifteen minutes.
No system is beyond compromise, and this notice does not claim otherwise. What it can say is what is actually in place, above.
Getting in touch
About anything on this page, contact the operator: ewenamtechservices@gmail.com or 0248468450.
Version 2026-09-08. See also the terms of use.