Privacy Policy
This policy explains what personal data Spirit AI collects, why we collect it, on what legal basis we process it, who can receive it, how long we keep it and the rights you have over it. We have written it in plain English on purpose: privacy documents that nobody can read protect nobody.
1. Definitions
"Personal data" means any information relating to an identified or identifiable person, such as your name, email address or phone number. "Processing" covers anything we do with that data: storing it, reading it, transferring it or deleting it. The "controller" (us, Spirit AI) decides why and how data is processed; a "processor" handles data on our documented instructions only.
2. Personal data we collect
We collect the details you enter in the registration form: your first and last name, email address and telephone number. For identity verification under our KYC procedure we may collect a copy of your identity document and, where needed, a selfie or short video. When you contact support, we keep the content of your request and our answers. We process no special categories of data and we ask for nothing beyond what the purpose requires.
3. Usage data
When you use the site we receive technical data automatically: your IP address, browser type and version, device type, the pages you open, and the times of your visits. This data serves security (detecting unauthorised access), operation of the service and aggregate statistics about how the site is used. It does not include the content of your communications.
4. Cookies
We use a small number of strictly necessary cookies and similar mechanisms to keep the site working and secure, including keeping you signed in and protecting forms against abuse. Preference cookies remember choices such as an open FAQ section. If analytics is enabled, measurement cookies help us understand which pages need improvement; you can refuse or delete cookies in your browser settings at any time without losing access to the site's content.
5. Controller and processors
Spirit AI is the controller of the personal data described in this policy, reachable at [email protected]. Processors acting under our instructions include our hosting provider, our email delivery provider and the identity verification service. Each is bound by a written agreement covering security, confidentiality, use restrictions and deletion.
6. Purposes of processing and legal bases
We process your data: to create and manage your account and answer your requests (performance of a contract or steps before it); to verify your identity and meet legal obligations such as KYC and record keeping (legal obligation); to keep the platform secure and prevent fraud (legitimate interest); and to send you service messages such as login alerts (legitimate interest). Marketing messages, if you ever choose to receive them, are sent only on your consent, which you can withdraw at any time with effect for the future.
7. How long we keep data
Registration and account data are kept for the life of the account and a limited period after its closure, so that we can answer later questions about your transactions. Verification records are kept for the period required by the anti money laundering obligations applicable to us. Support correspondence is kept up to three years so recurring issues can be seen in context. Usage data is kept no longer than needed for security and statistics. When a retention period ends, the data is deleted or irreversibly anonymised.
8. Transfers of data
Some of our providers operate outside Ghana. Where personal data is transferred to them, the transfer is protected by the provider's contractual commitments and, where applicable, standard data protection safeguards. We select providers who can demonstrate appropriate technical and organisational security measures, and we keep the list of categories of recipients in section 10 below rather than naming individual vendors here, because that list changes as services improve.
9. Security of processing
Data is encrypted in transit and at rest, access follows the principle of least privilege with role based permissions, and access events are logged. Reviews of access rights are performed periodically. You add your own layer by keeping two step verification active and your password unique; see the Security page for the complete picture.
10. Disclosure to third parties
We share personal data only with: identity verification providers (the documents needed to verify you); IT and hosting providers (the data needed to run the service); affiliated companies within our group, processing on our instructions; payment and liquidity providers, the details necessary to execute your deposits and withdrawals; and regulators, courts or other authorities, where disclosure is required by law. We do not sell personal data, and we do not share it for third party advertising.
11. Your rights
You have the right to access the personal data we hold about you and receive a copy; to have inaccurate data corrected; to have data deleted where no legal ground requires us to keep it; to restrict processing while a dispute about accuracy is resolved; to object to processing based on legitimate interest; and to withdraw consent for marketing at any time. To exercise any right, write to [email protected]. We answer within the timelines required by Ghana's Data Protection Act, 2012 (Act 843), normally far sooner. You may also lodge a complaint with the Data Protection Commission.
12. Service providers
The processors we rely on were selected for security and reliability, are audited or certified where their role warrants it, and process only what the service needs: hosting, email delivery, identity verification, and payment processing. If a provider changes or a new category is added in a way that affects your rights materially, this policy is updated before the change takes effect.
13. Analytics
Where analytics is active, we use it to count visits, understand which pages help users and which confuse them, and to detect technical faults. Analytics output is aggregate; it does not build advertising profiles of you. When the GA4 measurement slot is filled by the site operator, that tool's processing follows this section.
14. Advertising and retargeting
We do not run retargeting or advertising profiles on this site. If advertising is ever introduced, it will appear here with the legal basis it relies on and the choices you have, before any such processing starts.
15. Links to other sites
Our pages link to services we do not control, such as the map embed on the Contact page and exchanges referenced in our educational material. Once you follow a link, the operator of the destination site is responsible for its own data practices; we encourage you to read their policies.
16. Children's privacy
The service is intended for adults. We do not knowingly collect data from anyone under eighteen, and accounts are opened only by adults. If we learn that an account belongs to a minor, we close it and delete the associated data, keeping only what the law obliges us to retain.
17. Changes to this policy
We may update this policy as the service or the law changes. The current version is always published on this page with its effective date, and material changes are announced inside the dashboard before they take effect. Continuing to use the service after a change takes effect means the updated policy applies to you.
18. Contact us about privacy
For any privacy question, a data request or a complaint about handling of your data, write to [email protected], marked for the Client Support and Compliance Team, during Monday to Friday, 8:00 to 18:00 GMT (excluding public holidays). We answer privacy requests usually within one business hour and treat them with priority over ordinary queries.