1. Who we are
Souplify is a personal finance and peer-to-peer savings and lending app. It is operated by Tech At Scale Ltd (“we”, “us”, “our”).
We are the data controller for the personal information described in this policy. This policy applies to the Souplify mobile apps for Android and iOS and to the services behind them. It is written to meet our obligations under Ghana’s Data Protection Act, 2012 (Act 843) and the requirements of the Google Play and Apple App Store platforms.
2. Information we collect
Information you give us when you sign up
- Name: your full name, which we split into first and last name for your profile.
- Email address: used to identify your account and to send you one-time sign-in codes.
- Phone number, if you choose to provide one.
- Preferred currency: used to set up your default account (for example, GHS).
Souplify signs you in with a one-time code sent to your email. We do not use, transmit or store a Souplify password.
Profile and identity (KYC) information
You may complete a profile in the app. Some of this information is needed to verify your identity before you can use certain group and lending features. The profile has five sections:
| Section | Information |
|---|---|
| Basic information | Title, first, last and other names, date of birth, gender, marital status, mother’s maiden name, profile photo |
| Address | Residential and postal address, digital address (for example, Ghana Post GPS), nationality, country of residence and of origin, residential status |
| Identity | Type of ID document (national ID / Ghana Card, passport, driver’s licence, voter’s ID or SSNIT card), ID number, issue and expiry dates, tax identification number |
| Employment | Occupation, employer, source of income |
| Next of kin | Name, relationship to you, phone number, email and address |
When you give us details about your next of kin, please make sure they know you are sharing their information with us.
Profile photo. You can take a photo with your camera, choose one from your photo library, or give us a link to an image. We store only the photo you choose; the app does not access the rest of your photo library.
Financial information you record
- Accounts: names, account type (cash, mobile money, bank, card, savings, loan, investment), the provider you pick (such as MTN or a bank), currency, opening and current balances.
- Transactions: amounts, income or expense, category, date, account and any notes you add.
- Budgets and categories you create.
Souplify is a record-keeping app. It does not connect to your bank or mobile-money provider, does not move money out of your accounts, and does not hold your money.
Groups and peer lending
If you create or join a savings group, we process:
- Group details, your membership and role (owner, admin or member).
- Contributions and withdrawals you record against the group.
- Group loan requests, approvals, repayments, and the votes members cast on loan requests.
- Peer loans between members: amount, interest rate, term, repayment schedule and status.
Information collected automatically
When the app encounters an error, it sends a diagnostic report to our servers so we can find and fix problems. A report contains:
- The error message and technical details (stack trace), the screen where it happened and the time.
- App version and a random session identifier.
- Device model, manufacturer and operating-system version, and whether it is a physical device.
- Your account identifier, if you are signed in.
We do not collect your precise or approximate location, your contacts, SMS messages, call logs, browsing history or advertising identifier.
Information stored on your device
The app keeps a copy of your recent data on your device so it loads quickly and works with a poor connection. Your sign-in token is kept in encrypted storage (Android Keystore / iOS Keychain) and is deleted when you sign out. On Android, the app excludes its data from cloud backups and device-to-device transfers. Data stored by the app is removed when you uninstall it.
3. Email import and Google user data
Email import is an optional feature that turns bank and mobile-money transaction alerts in your inbox into transactions in Souplify. You choose one of three ways to connect:
- Gmail: you sign in with Google and grant read-only access to your Gmail (
gmail.readonly). We never send, delete or change emails, and we never see your Google password. - Other email providers (IMAP): you give us your mail server address, email address and password. We recommend using an app-specific password where your provider supports one. We use these credentials only to retrieve transaction alert emails.
- Email forwarding: we give you a unique Souplify address and you choose which emails to forward to it.
What we take from your email. We look only for transaction notification emails from banks and mobile-money providers. From those we extract the provider name, amount, currency, debit or credit, description, masked account number and reference. Each imported transaction appears in the app as pending until you approve or reject it. We do not use other emails for any purpose.
Disconnecting. You can disconnect email import at any time in the app. For Gmail you can also revoke access from your Google Account at myaccount.google.com/permissions. When you disconnect, we stop reading your email and delete the stored access tokens or credentials.
Google API Services: Limited Use
Souplify’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Gmail data only to provide the email-import feature you turned on.
- We do not transfer Gmail data to others, except as needed to provide that feature, to comply with the law, or as part of a merger or acquisition with your prior notice.
- We do not use Gmail data for advertising, and we do not sell it.
- No person reads your Gmail data unless you give us explicit permission for specific messages (for example, to investigate a support request), it is needed for security purposes or to comply with the law, or the data has been aggregated and anonymised for internal operations.
- We do not use Gmail data to train generalised artificial-intelligence or machine-learning models.
4. How we use your information
- To provide Souplify: keeping your accounts, transactions, budgets and statistics, running groups, contributions, loans and votes, and importing transactions you ask us to import.
- To sign you in: sending one-time codes to your email and keeping you signed in securely.
- To verify your identity: completing know-your-customer (KYC) checks needed for group and lending features, and meeting legal and regulatory obligations.
- To keep Souplify safe: detecting and preventing fraud, abuse and security incidents, and limiting repeated sign-in attempts.
- To fix and improve the app: using diagnostic reports to find and fix errors.
- To communicate with you: about your account, security, and changes to our services or this policy.
Decisions about group loans are made by the votes of group members, not by automated scoring. We do not sell your personal information or use it for advertising.
5. Legal basis for processing
We process your information only where the law allows it:
- To perform our contract with you: providing the features you sign up for.
- Your consent: for optional features such as email import and your profile photo. You can withdraw consent at any time; this does not affect processing that already took place.
- Legal obligations: identity verification, record-keeping, and responding to lawful requests from authorities.
- Legitimate interests: keeping Souplify secure and fixing errors, where these interests are not outweighed by your rights.
7. Device permissions
| Permission | Why |
|---|---|
| Internet and network state | To connect to our servers and tell you when you are offline. |
| Camera (on request) | Only when you choose to take a profile photo. |
| Photos (on request) | Only the single photo you pick for your profile, through your device’s photo picker. |
Souplify does not request access to your location, contacts, SMS, call logs or microphone.
8. How long we keep information
- Account, profile and financial records: for as long as your account is open.
- After you delete your account: we delete or anonymise your information within 30 days. However, we keep the records we are legally required to keep, such as identity verification records and the history of group contributions and loans that other members depend on, for the period required by applicable law, and then delete them.
- Email import data: Gmail access tokens and IMAP credentials are deleted as soon as you disconnect. Imported transactions you approved remain part of your records until you delete them or your account.
- Diagnostic reports: kept for up to 90 days.
- One-time sign-in codes: expire after a short time and cannot be reused.
9. Deleting your account
You can ask us to delete your Souplify account and the information associated with it at any time, even if you no longer have the app installed. See Delete your Souplify account for how to make a request, what we delete and what we must keep.
10. Security
- All communication between the app and our servers is encrypted in transit (HTTPS/TLS).
- You sign in with single-use codes, so there is no Souplify password to steal or reuse.
- Your sign-in token is stored in your device’s encrypted keystore, and on Android, app data is excluded from cloud backups.
- Access to personal information on our systems is limited to staff and service providers who need it to run Souplify.
No system is completely secure. If we become aware of a security breach that affects your personal information, we will notify you and the Data Protection Commission as required by law.
11. Your rights
Under the Data Protection Act, 2012 (Act 843) and other applicable laws, you have the right to:
- Access the personal information we hold about you and learn how it is processed.
- Correct inaccurate or incomplete information. You can update most of it yourself in the app under Profile.
- Delete your account and information, subject to the legal exceptions in section 8.
- Object to processing that causes or is likely to cause you unwarranted damage or distress, and to processing for direct marketing.
- Withdraw consent for optional features, such as by disconnecting email import.
- Complain to the Data Protection Commission of Ghana (dataprotection.org.gh) or the data protection authority where you live.
To exercise these rights, contact us using the details in section 15. We may need to verify your identity, and we will respond within the time the law requires.
12. International transfers
Our servers and service providers may be located outside the country where you live. When we transfer your information across borders, we take steps to make sure it continues to be protected as described in this policy and as required by applicable law.
13. Children
Souplify is intended for adults aged 18 or older and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. We will change the effective date at the top of this page, and if the changes are significant we will notify you in the app or by email before they take effect.
15. Contact us
For questions about this policy or your information, or to exercise your rights:
- Email: privacy@techatscale.io