At BisaFund, your privacy matters. This policy explains how we collect, use, and protect your personal information when you use our crowdfunding platform.
1. Information We Collect
When you use BisaFund, we collect information you provide directly, such as your name, email address, phone number, and payment details. We also collect information automatically, including your device type, browser, IP address, language preference, and usage data such as pages visited and campaigns viewed. IP Address Logging: We log your IP address when you perform key actions on the platform, including logging in (successful and failed attempts), creating or submitting campaigns, making donations, requesting withdrawals, completing KYC verification, and performing admin actions. IP logs are used for fraud detection, coordinated behavior analysis, account takeover prevention, and to block malicious IP addresses that threaten the platform. IP logs are retained for a maximum of 90 days and are automatically purged thereafter. IP logs are accessible only to platform administrators and are never shared with third parties except where required by law. For campaign organisers, we collect identity verification information including: your full name, date of birth, ID type (Ghana Card, Voter ID, Passport, or SSNIT), ID number, and a biometric selfie photo. For identity verification (KYC), your name, date of birth, ID type, ID number, and selfie image are transmitted to our third-party verification partner, Smile ID, to be checked against the Ghana government database with biometric face matching. BisaFund stores a record of the verification result and the email of the user who completed verification, and may retain the submitted selfie as evidence for admin review if verification fails. BisaFund does not retain the raw identity data returned by Smile ID. We also retain records of AI-generated campaign content and descriptions that you create using our AI assistant, as well as temporary records of AI-generated image placeholders generated during campaign creation.
2. How We Use Your Information
We use your information to operate and improve the BisaFund platform, to process donations and campaign payouts via mobile money and bank transfer, to verify your identity for campaign creation, to send you notifications about your campaigns or donations (via email or SMS), to detect and prevent fraud, and to comply with Ghanaian legal and regulatory requirements.
3. Payment Information
All payment processing is handled by Paystack, a trusted payment provider. BisaFund does not store your mobile money credentials, bank account numbers, or card details. Payment data is transmitted directly to Paystack using industry-standard encryption. We retain only the transaction reference and status for record-keeping.
4. Phone Verification & SMS
BisaFund uses phone OTP (one-time password) verification via Twilio as part of the campaign creation process. When you create a campaign, you will receive an SMS with a 6-digit OTP to verify your phone number. This OTP is valid for 10 minutes and is stored in hashed form — BisaFund does not store your OTP in plain text. BisaFund also sends SMS notifications to confirm donations, notify you of campaign milestones, and alert you to important account activity. You can opt out of non-essential SMS at any time through your account settings. Transactional messages (e.g., payout confirmations, OTPs) cannot be opted out of.
5. Sharing & Social Features
When you share a campaign via WhatsApp, Facebook, Twitter/X, or by copying a link, the campaign's public information is shared. BisaFund does not access your social media accounts or contact lists. Anonymous donors' identities are not disclosed publicly — they appear as "Anonymous" on campaign pages.
6. Information Sharing with Third Parties
We do not sell your personal data. We share your data only with: payment processors (Paystack) to complete transactions; SMS providers (Twilio) to send OTPs and notifications; identity verification services (Smile ID) to verify your identity against the Ghana government database as part of our mandatory KYC process before withdrawing funds — your name, date of birth, ID type, and ID number are transmitted to Smile ID solely for this purpose; corporate matching partners (for matched donation programs); and law enforcement when required by Ghanaian law. All third-party providers are bound by data protection agreements. Identity verification data is processed in accordance with the Data Protection Act, 2012 (Act 843) of Ghana, and Smile ID acts as a data processor on behalf of BisaFund for the sole purpose of identity verification.
7. Data Retention
We retain your account information for as long as your account is active. Transaction records are kept for a minimum of 7 years to comply with Ghanaian financial regulations. Identity verification documents are retained for 2 years after account closure. IP address logs are retained for a maximum of 90 days and are automatically purged on a rolling basis; however, if an IP is associated with a fraud investigation, suspended campaign, or law enforcement request, the associated log entry may be retained for the duration of the investigation (up to the standard 7-year retention for fraud-related records). You may request deletion of your account and associated data by contacting us.
8. Security
BisaFund uses industry-standard security measures including HTTPS encryption, AES-256-GCM encryption for sensitive personal data (phone numbers, ID numbers, payout details, donor phone numbers, contact form PII, celebrity emails), secure data storage, and strict role-based access controls. Admin dashboard access is protected by mandatory PIN + TOTP two-factor authentication (2FA), with brute-force lockout after repeated failed attempts. All users can optionally enable TOTP-based 2FA on their own accounts, with recovery codes and brute-force lockout protection. Admin email addresses are masked in all audit logs, legal exports, and UI displays to protect staff privacy. Identity verification data transmitted to Smile ID is sent over encrypted channels and is not stored in plain text by BisaFund — only the verification result and the email of the verifying user are retained. Phone OTP verification for payout phone numbers uses fail-closed rate limiting to prevent brute-force attacks. However, no online platform is 100% secure. We encourage you to use a strong password and to contact us immediately if you suspect unauthorised access to your account.
9. Cookies & Analytics
We use cookies and similar technologies to keep you signed in, understand how the platform is used, and improve our services. We store your language preference (English or French) and your dark/light theme preference in local storage for a seamless experience across sessions. You can control cookie settings in your browser. Disabling cookies may affect your ability to use some features of BisaFund.
10. AI-Generated Content (Campaigns, Images & Blog)
When you use our AI campaign assistant, your input (situation and category description) is sent to our LLM provider for content generation. The generated descriptions may be reviewed to improve our AI services and detect patterns of fraud. Generated content remains your intellectual property and can be modified or deleted at any time. We do not use your personal information to train AI models. If generated content is identified as part of a fraudulent or suspended campaign, we may retain it for compliance and law enforcement purposes. BisaFund also offers AI-generated image suggestions during campaign creation. When you browse AI images, your campaign title and category are sent to our image generation provider to produce relevant visual placeholders. These AI-generated images are draft placeholders only — they cannot be used on published campaigns. If you do not upload a real photograph, any AI-generated placeholder is discarded and not stored. If you select an AI placeholder, a temporary record is retained until you upload a real photo or exit the campaign creation flow. Our automated blog system generates articles from an internal topic pool only — it does not use any user-submitted campaign data or personal information.
10A. Corporate Matching Data
When your campaign participates in a corporate matching program, we collect and process additional data including: (a) Corporate partner name and contact information; (b) Matched donation amounts and ratios; (c) Match reversal records if applicable; (d) Communication between organizers and corporate partners regarding matched funds. This data is used to: track matching program performance, process match reversals when necessary, notify organizers of match status changes, maintain audit trails for compliance, and facilitate communication between stakeholders. Corporate matching data is retained for 7 years for financial compliance and may be shared with corporate partners, auditors, and law enforcement as required.
10B. Celebrity Profile Data
When you apply for celebrity status on BisaFund, we collect and process additional data including: (a) Your public display name, biography, category, and profile/cover images; (b) Social media links (Twitter/X, Instagram, Facebook, YouTube, TikTok); (c) Social proof links demonstrating notable presence (verified social media, press articles, Wikipedia, official websites); (d) Verification documents (ID scans, press clippings, awards); (e) Your email address, which is encrypted with AES-256-GCM and stored separately from your public profile — only platform administrators can decrypt it. Celebrity profile data is used to: verify notable presence and identity, display approved celebrity profiles on the Celebrity Causes hub, enable team member delegation for campaign management, and track aggregate fundraising performance. Your encrypted email is never exposed in API responses to non-admin users. Admin actions on celebrity profiles (approval, suspension, revocation, feature toggling) are fully logged in the audit trail with admin email masking and IP address capture. Celebrity campaigns are flagged for a separate priority review track and may display publicly disbursed amounts if the creator opts in. You may request deletion of your celebrity profile at any time, subject to ongoing fraud investigations or legal holds.
11. Children's Privacy
BisaFund is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.
12. Campaign Suspension & Data Access
If a campaign is suspended or flagged for fraud, BisaFund may retain all associated data (campaign content, organizer information, donor records, messages) for investigation, legal compliance, and law enforcement cooperation. Suspension does not mean immediate data deletion. Data will be retained according to our standard retention schedules. Organisers whose campaigns are suspended should not expect their data to be deleted immediately.
13. Organiser Transparency & Payout Badges
Organizers agree that their campaign content, fundraising progress, organizer profile information, and donor count are publicly visible. Donor identities are private unless donors choose to make themselves publicly visible. For suspended campaigns, the suspension notice and reason are visible to the public to maintain community trust. For campaigns with corporate matching, the matched amount and corporate partner name are publicly displayed. Organisers may optionally opt-in to display a "Funds Disbursed" badge on their campaign page after at least one completed payout. For celebrity campaigns (created by approved celebrities), the total disbursed amount is shown alongside the badge. For regular campaigns, only the badge is displayed without the amount, to protect organiser financial privacy. The opt-in can be toggled at any time from the campaign dashboard. The disbursed total reflects only completed payouts processed by BisaFund admins — pending or rejected withdrawals are not counted.
14. Your Rights
You have the right to access, correct, or delete your personal data. You may also request a copy of the data we hold about you. To exercise these rights, contact us at security@bisafund.com. We will respond within 30 days.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of BisaFund after such changes constitutes your acceptance of the updated policy.
16. Contact Us
For any privacy-related questions or requests, contact our team at security@bisafund.com. For legal matters, write to BisaFund, Accra, Ghana. For suspension appeals or compliance inquiries, contact security@bisafund.com.
Questions about your privacy? Contact us at security@bisafund.com.
For corporate matching inquiries, contact info@bisafund.com.