Privacy Policy
This policy explains what personal information the Kora mobile application and korasusulink.com collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to everyone who uses Kora, wherever you are.
In short: we collect what we need to run a savings and payments service and to confirm you are who you say you are. We do not sell your information, and we do not use it for advertising or cross-app tracking.
1. Who we are
Kora ("we", "us") provides a community savings, wallet, lending and remittance service in Ghana and to Ghanaians abroad. For data protection purposes we are the data controller for the information described here.
Questions about this policy or your information: privacy@korasusulink.com
2. Information we collect
Information you give us
| What | When and why |
|---|---|
| Name, phone number, email address, date of birth | When you create an account, so we can identify you and contact you about your money. |
| A PIN you choose | To protect your account. It is stored only as a one-way hash — we cannot read it back. |
| Identity documents: Ghana Card, passport, voter ID or driver's licence, plus the ID number and a selfie | Only when you choose to verify your identity. Required before borrowing, and to meet anti-money-laundering obligations. Stored in a private area that other users cannot access. |
| Profile photo | Optional. Shown to people you transact with so they can recognise you. |
| Messages, images and voice notes you send in group or direct chats | To deliver them to the people you are talking to. |
| Fundraiser titles, descriptions and images | To display the fundraisers you create. These are visible to other users. |
Information created as you use Kora
| What | Why |
|---|---|
| Wallet balances and full transaction history — contributions, payouts, transfers, withdrawals, loan repayments, remittances | This is the core of the service. Financial records are also kept to meet legal and accounting obligations. |
| Savings group membership, payout position and contribution record | To run Susu cycles and calculate who is paid and when. |
| Trust score and underwriting profile | To decide whether you qualify for a loan and on what terms. |
| Fraud signals — for example unusually rapid transfers or large transfers to a new recipient | To protect you and other users from fraud and to comply with financial crime rules. |
| Push notification token, and basic device and app information | To send you alerts about your money and to diagnose faults. |
Information from your device, only with your permission
Kora asks before using any of these, and you can refuse or withdraw permission at any time in your device settings. Refusing only disables the related feature.
- Camera — to scan payment QR codes and photograph your ID during verification.
- Photo library — to attach images to chats, set a profile picture, add a fundraiser image, or upload an ID document.
- Microphone — to record voice notes in chats.
- Contacts — to help you find and invite people you already know. We use your contacts only to show you matches on your own device and to let you send an invitation. We do not upload your address book to build a social graph.
- Face ID / fingerprint — to unlock the app instead of typing your PIN. The biometric check happens on your device; Kora never receives your biometric data.
3. Why we are allowed to use your information
- To perform our contract with you — running your wallet, savings groups, loans and transfers.
- To meet legal obligations — identity verification, anti-money-laundering checks, and keeping financial records.
- Our legitimate interests — preventing fraud, keeping the service secure, and improving it.
- Your consent — for optional things like camera, contacts and push notifications, which you can withdraw at any time.
4. Who we share it with
We do not sell your personal information. We share it only as follows:
- Other Kora users — your name, profile photo and username are visible to people you transact with or share a group with. Your ID documents are never visible to other users.
- Supabase, which hosts our database, file storage and authentication. Data is stored on servers in the European Union.
- Hubtel and other payment providers, to move mobile money to and from your wallet.
- Expo, to deliver push notifications to your device.
- Regulators, law enforcement or courts, where we are legally required to.
5. Where your information is stored
Our database and files are hosted in the European Union. If you use Kora from Ghana, your information is therefore transferred outside Ghana; if you use it from the United Kingdom or the European Economic Area, it stays within the EEA. We rely on our providers' standard contractual protections for these transfers.
6. How long we keep it
We keep your account information for as long as your account is open.
Please read this carefully. When you delete your account, Kora performs a soft delete: we anonymise your name and email, clear your PIN and close your access. We retain your financial ledger — the record of contributions, payouts, transfers and loans — because financial services rules require transactions to remain auditable and because other members of your savings groups have a legitimate interest in a complete record of a cycle they took part in. Your ID documents are deleted.
7. Your rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong — most of it you can edit yourself in the app;
- delete your account, subject to the financial-record retention explained above;
- stop sending you notifications, which you can also do in the app;
- object to, or ask us to restrict, a particular use of your information.
Write to privacy@korasusulink.com and we will respond within 30 days. If you are in Ghana and are unhappy with our response, you may complain to the Data Protection Commission. If you are in the UK or the EEA, you may complain to your local supervisory authority.
8. How we protect your information
- Traffic between the app and our servers is encrypted in transit.
- Your PIN is stored as a one-way hash and verified on our servers, never compared on the device alone.
- Session tokens are held in your device's secure keystore.
- Identity documents live in a private storage area. Each user can reach only their own folder, and staff access is issued as short-lived links that expire after two minutes.
- Access to administrative tools requires a separate authenticated administrator account.
No system is perfectly secure. If a breach affects your information we will tell you and the relevant regulator as the law requires.
9. Children
Kora is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
10. Changes to this policy
If we change this policy we will update the date at the top, and tell you in the app when the change is significant.
11. Contact
privacy@korasusulink.com
Kora — Accra, Ghana