Draft — pending legal review. Not yet final. This page is an internal working draft of our Privacy Policy, written from how the platform actually collects and processes data today. It has not yet been reviewed by a lawyer and must not be relied on as final until that review is complete.

Privacy Policy

Last updated: 9 October 2026 (draft)

This Privacy Policy is issued by Volta Marketplace, operated by Dziwornu Prince, based in Ghana.

1. What we collect

When you create an account, we collect your full name and either an email address or a phone number (at least one is required). If you set a password, we store only a one-way cryptographic hash of it (Argon2id) — never the password itself. If you sign in with Google or Apple instead, we store the provider's unique account identifier for you and the email address it reports (which, for Apple, may be a private relay address rather than your real one); we never receive or store your Google/Apple password.

If you choose to verify your identity (KYC) to get a Verified badge, our verification partner, Didit, handles the identity-document check. We do not store your ID document images, date of birth, or document numbers — our database holds only the verification status and, where Didit's decision includes it, the legal name extracted from your ID.

If you make a payment (a subscription, listing fee, or charter registration), our payment partner, Paystack, handles your card or mobile-money details directly. We never see or store your card number or banking credentials — we keep only the transaction reference, amount, currency, and status that Paystack reports back to us.

We also collect: photos and other content you upload (stored via Cloudflare R2 object storage); your phone number if you verify it for SMS-based sign-in or notifications; basic session/usage data (see Cookies & sessions below); and, for charter drivers, vehicle and licence details you submit as part of registration.

2. How we use it

We use your data to: operate your account and let you sign in; show your Verified badge once KYC is approved; process payments and keep a record of what you've paid for; deliver listings, search, and recommendations; send account-related emails/SMS (verification codes, receipts, status updates); and investigate reports of abuse or policy violations.

3. Who we share it with

We share data with the following third parties, only as needed to provide the service:

Didit — identity-verification processing, if you opt into KYC.
Paystack — payment processing for any purchase you make.
Google / Apple — only if you choose to sign in with one of them; they confirm your identity to us, we don't send them anything beyond the standard OAuth request.
Cloudflare R2 — object storage that hosts the images you upload.
JB Sales Hub — our SMS provider; delivers verification codes and notifications to your phone.

We do not sell your personal data.

4. Cookies & sessions

We use a session cookie (voltaflask_session) to keep you signed in; it's HTTP-only, marked Secure, and expires after 7 days of inactivity (14 days if you check "Remember me"). We don't use third-party advertising or tracking cookies.

5. Data retention

We retain your personal data while your account is active. When you delete your account, we remove your personal identifying information; some anonymised records and content you created (such as reviews or messages) may be retained so the platform and other users' records remain intact. Records we are legally required to keep are retained for as long as the law requires.

6. Your rights

You can access and correct most of your personal details yourself from Account Settings. You can also request deletion of your account at any time from Settings: this removes your listings, scrubs the identifying fields on your account (name, email, phone, profile details), deactivates it, and removes your roles. We keep the underlying account row in this anonymised form, rather than erasing it outright, so that reviews or messages you left on other users' shops don't break for those other users — but it no longer identifies you.

7. Security

Passwords are hashed with Argon2id, a memory-hard hashing algorithm, and never stored in plain text. Session cookies are HTTP-only and transmitted only over HTTPS. Staff accounts with elevated access are required to enrol in two-factor authentication. Sign-in attempts and one-time codes are rate-limited and lockout-protected against repeated guessing.

8. Children

Our services are not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a child has created an account, contact us and we will take appropriate action.

9. Ghana Data Protection Act, 2012

Volta Marketplace is committed to compliance with Ghana's Data Protection Act, 2012 (Act 843). Registration with the Data Protection Commission is in progress.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Questions about this Privacy Policy, or requests about your data, can be sent to info@voltamarketplace.com, or via the other channels on our Contact page.