Privacy Policy
Sikafon, operated by EGAL. Last updated 18 August 2026.
This policy describes what Sikafon does with your personal data. It is written to be checked against the system rather than to sound reassuring: where we do something unusual, we say what and why, and where a protection has limits, we say where the limits are.
1. Who is responsible
EGAL operates Sikafon and is the data controller for the information described here. EGAL is registered with Ghana's Data Protection Commission.
Your bank is a separate controller for your bank account. Sikafon is an identity and routing layer: your money stays in your own account at a licensed institution, and Sikafon carries the instruction and keeps the record. When you open an account through Sikafon, the bank receives your identity information and holds its own relationship with you, governed by its own terms and privacy policy.
2. What we collect
When you create an @handle
- The @handle you choose and the display name you give.
- Your mobile number.
- A PIN, which is stored only as a bcrypt hash. We cannot read your PIN, and we cannot recover it for you.
When you open a bank account through Sikafon
We collect what the bank's account-opening process requires: first, middle and last names, date of birth, gender, Ghana Card type and number, mobile number, email address, and residential address. This information is transmitted to the bank to open the account.
When you make or receive a payment
- The amount, currency, counterparty @handle, and the purpose you declare before the payment moves.
- References returned by the bank, the ledger entry, and the receipt.
- The device and network information ordinarily present in a web request.
3. Two things we deliberately do not store
These are engineering choices, not policy language, and they are checkable in the source.
Your Ghana Card number and mobile number are stored as non-reversible hashes, not as values. Sikafon needs to recognise a card or a number — to stop the same card opening two accounts, or to link a Companion — not to read it back. A leaked Sikafon table therefore does not hand anyone a list of customers' card or mobile numbers. The bank holds the actual identity record; we hold a fingerprint of it.
We never store reusable authentication secrets. No PIN in plaintext, no bank PIN, no OTP, no card CVV. Where such a value is needed to authorise a movement, it exists only in flight for that single instruction and is never written down.
4. Why we process it, and on what basis
| Purpose | Basis |
|---|---|
| Creating and maintaining your @handle and account | Performance of our agreement with you |
| Opening a bank account on your instruction | Performance of our agreement, and your consent |
| Executing and recording payments you authorise | Performance of our agreement |
| Identity verification, fraud prevention, AML and sanctions controls | Legal obligation and legitimate interest |
| Keeping an audit trail of money movements | Legal obligation |
| Diagnosing faults and keeping the service available | Legitimate interest |
Every payment requires you to declare its purpose before any money moves. That purpose is carried into the ledger and the audit trail. It exists so a payment can be explained later — by you, to a bank, or to a regulator.
5. Who we share it with
- Your bank. Identity information for account opening, and payment instructions for execution. The bank is a separate controller.
- Identity verification services, where required to confirm a Ghana Card against the national register.
- Infrastructure providers who host the service and store data on our instruction.
- Error-monitoring, to diagnose faults.
- Regulators, law enforcement and courts, where we are legally required to disclose.
We do not sell personal data, and we do not share it for advertising.
One thing we deliberately refuse to answer. Our partner endpoint returns an identical response whether or not a phone number belongs to a Sikafon customer. Ghana's numbering plan is small enough to walk end to end, and an endpoint that confirms membership is a way to enumerate our customers. We accept the inconvenience.
6. Where your data is stored
Sikafon currently runs on infrastructure located outside Ghana — the application in Frankfurt, Germany, and the database in Oregon, United States. Your personal data is therefore transferred outside Ghana and processed there.
We are stating this plainly because it is a real cross-border transfer, and because the arrangement is under review: co-locating the application and database in a single region is planned work for reasons of latency as well as data residency.
7. How long we keep it
- Risk assessments, compliance cases and screening evidence: seven years, which reflects anti-money-laundering record-keeping expectations.
- The ledger and the audit trail: permanently. See the next section.
- Idempotency records: 24 hours.
- Other operational records are kept for as long as needed for the purposes above.
8. Your rights, and one honest limit
Under Ghana's Data Protection Act, 2012 (Act 843) you have rights including access to your personal data, correction of inaccurate data, and in defined circumstances objection to processing and erasure. To exercise any of these, contact us using the details in §11.
The limit, stated rather than buried. Sikafon's ledger and audit trail are append-only, enforced by database triggers — no member of staff, no code path and no direct database connection can alter or delete an entry. This is deliberate: books that can be rewritten are not books, and it is a large part of why the record can be trusted.
The consequence is that we cannot delete a completed money movement or its audit entry, even at your request. We consider this necessary for compliance with financial record-keeping obligations, and it is also a genuine constraint on erasure that most privacy policies do not mention. We can correct identity and profile information, and we can close your access. We cannot unwrite the record of a payment that happened.
Sikafon does not currently offer self-service account deletion. Ask us and we will tell you precisely what can and cannot be removed.
9. Security
TLS in transit; mutual TLS and payload encryption on the bank connection; PINs hashed with bcrypt; two-factor authentication available and failing closed; per-account debit locks; rolling velocity limits; role-based access with least privilege; append-only audit.
A phone number never grants a session. Linking a Companion tells us which @handle you are; it never signs you in. SIM swap is cheap in Ghana, and any design that turns "I control this number" into "I can move this money" hands an attacker the account for the price of a SIM.
No independent penetration test has been carried out on Sikafon to date. We would rather you knew that than assumed otherwise.
10. Children
Sikafon is not intended for people under 18, and we do not knowingly collect their data.
11. Contact and complaints
Reach us through the Tell us something box on our help page, at sikafon.com/help. It works whether or not you are signed in, and whether or not you still have an account — which matters, because you may need to reach us at exactly the moment you cannot sign in.
Use it to ask what we hold about you, to ask us to correct it, to ask us to delete what we are not required to keep, or to complain about how we handle your data. There is a field for your phone number or email address: leave one if you want an answer, because without it we will read your message and have no way to reply to you.
If you are not satisfied with our response, you may complain to Ghana's Data Protection Commission.
12. Changes
If we change this policy we will update the date above and, where the change is significant, tell you in the app.