Privacy Policy | Cornerstone

1. Who we are and our role

Cornerstone Digital Agency, based in Accra, Ghana, operates the Cornerstone platform. For the personal data of our own users, including Merchants, savers, and the officers and users of Organisations, we decide how and why the data is used. For the personal data of a Merchant's Customers (people who pay a Merchant through Cornerstone) and of an Organisation's members and supporters, the Merchant or Organisation decides why it needs that data, and we handle it on its behalf to process payments and run the account. We also keep it ourselves for security, fraud prevention, and legal record-keeping.

2. What we collect

We collect only the data necessary to provide and secure our financial infrastructure.

All users

Name, phone number, and email address (where provided).
Ghana Card number, ID images, and a selfie (where provided for verification).
Transaction history on the Cornerstone platform.
Security data such as your PIN (stored only in hashed form), one-time codes, device and session information, and IP address.
Organisation name (for institutional accounts).

Individual users

Your savings balances, goals, deposits, withdrawals, and any auto-save, auto-debit, or challenge settings.
The phone numbers you link to your account, and the payout numbers you register.
Details of the people and merchants you send money to or pay, such as their number, name, and amount.
Group savings membership and contributions, which the group's administrators can see.
Loan and savings-product applications, and repayment or account history, where you apply through a partner.
App and device information, such as device identifiers and notification tokens, used to deliver the service and keep it secure.

Merchants

Business name, business type, branch details, and your assigned Merchant Code.
Payout Mobile Money numbers and bank details, and settlement and withdrawal history.
Details of staff you add, such as name, phone number, role, and branch access.
Payroll information you enter for your staff, such as salary, tax, and pension details.
Details of suppliers you pay, such as name, phone number, and network.
Collect settings and activity, including API key identifiers (never your secret key), webhook addresses, and request logs.
Loan applications and repayment history where you apply for a loan through a partner.

Organisations

Organisation name, type, organisation code, contact details, and registration or verification documents.
Details of its officers, executives, and users, such as name, email, phone number, role, permissions, and identity documents where verification is needed.
Payout bank and Mobile Money account details, payout requests and approvals, and audit logs of who did what.
Member, supporter, and participant information the Organisation uploads or collects, such as names, phone numbers, dues, contributions, tickets, votes, and payment history.

A Merchant's Customers

The Mobile Money number and network used to pay, the amount, the time, and the payment reference.
A name or email address where the Customer or Merchant provides it, and any data the Merchant chooses to attach to a payment.

3. Why we collect it

Your data is used strictly for the following operational purposes:

Operating the platform (processing payments, savings, settlements, and payouts).
Identity verification and AML/KYC regulatory compliance.
Preventing fraud and keeping accounts and funds secure.
Running your savings, transfers, recurring payments, and group features.
Showing Merchants and Organisations who has paid them, and giving them reports, receipts, and insights.
Verifying Organisations and their officers, and approving payouts under our Maker-Checker controls.
Building your verifiable financial record.
Qualifying Merchants and savers for credit pathways via our MFI and lender partners, where you apply.
Sending you service messages, such as receipts, codes, and security alerts.
Fixing errors, monitoring performance, and improving the platform.

4. Merchants, Organisations, and the people they serve

Merchants receive information about payments made to them, such as the payer's phone number, amount, and time. Merchants must use this only to run their business, keep it secure, and meet their legal duties. If a Merchant sends SMS messages to its Customers through Cornerstone, the Merchant is responsible for having the right to contact them and for what the messages say. Merchants who connect their own systems through the Collect API or webhooks are responsible for protecting the data they receive there.

Organisations can see the information about their members, supporters, and payers that is needed to run their accounts, such as who paid, how much, and when. They must have the right to give us the data they upload, use what they receive only for their own legitimate activities, and protect it. Organisations that message their members through Cornerstone are responsible for having the right to contact them.

If you are a Customer, member, or supporter and have a question about how a Merchant or Organisation uses your data, contact them first. You can also contact us and we will help.

5. Who we share data with

We share data only where needed to run the service, and only with:

Mobile network operators, USSD aggregators, and payment and banking partners, to carry out transactions.
Banks, lender, MFI, and other partners, but only when you apply for or take one of their products, and only what is needed for that application. For a savings product this includes the identity details the provider needs to open your account.
Other members and administrators of a savings group you join, who can see the group's membership and contributions.
Service providers that help us run Cornerstone, such as SMS and messaging, identity verification, cloud hosting, file storage, error monitoring, and analytics, under strict instructions to protect the data. Some may process data outside Ghana; where they do, we require appropriate safeguards.
The Merchant or Organisation you pay or belong to, as described in Section 4.
Regulators, law enforcement, and courts, where the law requires it or to protect against fraud.

6. What we never do

We do not sell your data to any third party.
We do not share your data with unauthorised third parties.
We do not use political affiliation data for non-political purposes.

7. Political data

Data collected for political branches (e.g., constituency dues, delegate registers) is ring-fenced. It is never shared with external parties and is not used for any purpose beyond the specific membership management function for which it was collected.

8. How long we keep data

We keep data for as long as your account is active and afterwards for as long as the law requires us to keep financial, identity, and transaction records, or as needed to resolve disputes and prevent fraud. When we no longer need it, we delete it or anonymise it.

9. Your rights

You have the right to access, correct, delete (subject to legal retention requirements), and object to the processing of your data at any time. Merchants can also ask for a copy of their account and transaction records. To exercise these rights, contact us at info@mycornerstonegh.com. We may need to verify your identity first.

10. Data security

Your data is protected using enterprise-grade security. Data at rest is encrypted using AES-256. Data in transit is secured via TLS protocols. Access is strictly audited and limited to authorised personnel. No system is perfectly secure, so please protect your PIN, passwords, one-time codes, and API keys.

11. Age

Cornerstone is for people aged 18 and over. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy. The version number and effective date at the top of this page show the current version. For material changes, we will give notice through the app, dashboard, SMS, or this website.

13. Governing law

This Privacy Policy is governed by the provisions of the Data Protection Act, 2012 (Act 843) of the Republic of Ghana.

14. DPC registration

Data Protection Commission Registration is currently in progress. This policy will be updated with our registration number upon receipt.

15. Contact

If you have questions regarding this policy or your data, reach out to us:
Email: info@mycornerstonegh.com
Phone: +233 550 409 984