.png?alt=media&token=6017d704-1ea3-4deb-9c8f-52fa5bce4514)
Your data. Your right to know.
SwapAm was built on the same trust problem every Accra phone buyer faces. We know what it feels like to share your number with a stranger. This page explains exactly what we collect, why, and what you can do about it.
Compliant with the Ghana Data Protection Act 2012 (Act 843) · DPC registration in progress
Who we are
SwapAm is an online phone trust and verification platform operated by SwapAm Ghana (swapam.co). Our principal service is SwapAm Vault — Ghana's IMEI registry for phone ownership verification.
For the purposes of the Ghana Data Protection Act 2012 (Act 843), SwapAm is the data controller of personal information submitted through our platform.
Contact: ops@swapam.co
What we collect
Act 843 § 17We collect the minimum data needed to provide our services. Here is a plain breakdown of every field we store:
To associate a registered device with a verified owner.
Stored
Firestore database (encrypted at rest)
Shared with
First name + last initial on shared certificate links
Used for emergency certificate recovery via Vault Access.
Stored
Firestore database
Shared with
Never publicly shown. Only used for owner verification.
The unique device identifier that makes your certificate verifiable.
Stored
Firestore database
Shared with
Masked publicly (last 4 digits). Full IMEI only accessible by you.
Protects access to your certificate. We store only a SHA-256 hash.
Stored
Hashed only. We cannot see or recover your PIN.
Shared with
Never shared
Proof of payment. Needed to resolve disputes or reissue certificates.
Stored
Firestore database
Shared with
Used internally only. No card or bank details ever stored.
Sets the official date on your ownership certificate.
Stored
Firestore database
Shared with
Shown on your public certificate
Why we collect it
Lawful basisUnder Act 843, we must have a lawful basis for each purpose:
Contract performance
Your name, phone, IMEI, and payment reference are required to register your device and issue your certificate. Without them we cannot perform the service you paid for.
Legitimate interest
We retain Paystack references to resolve payment disputes and prevent duplicate registrations.
Consent
By completing registration and ticking the consent checkbox, you agree to your name and masked IMEI appearing on a publicly shareable certificate link. You may withdraw this consent at any time.
We do not use your data for advertising, sell it to third parties, or build behavioural profiles.
How we protect it
Encryption at rest and in transit
All data is stored in Google Firestore, which encrypts data at rest by default. All traffic is served over HTTPS/TLS.
PIN hashing
Your Vault PIN is hashed using SHA-256 before storage. SwapAm staff cannot read or recover your PIN.
Access controls
Firestore security rules restrict direct database access. Certificate data is only readable via authenticated API routes.
Payment security
Payments are processed by Paystack, a PCI-DSS compliant payment provider. SwapAm never receives or stores your card details.
Your rights under Act 843
Act 843 § 20-24The Ghana Data Protection Act gives you real control over your personal data:
Access your data
Request a copy of all personal data we hold about you.
Email ops@swapam.co — subject: Data Access Request
Correct your data
If your name, phone number, or other details are wrong, we will fix them.
WhatsApp or email us with correct details and your certificate ID
Delete your data
Request deletion of your registration and all personal data we hold.
See the Deleting your data section below
Withdraw consent
Stop your certificate from being publicly shareable at any time.
Contact us — we will mark your certificate private within 48 hours
Lodge a complaint
If you believe we have handled your data unlawfully, you may complain to the Data Protection Commission of Ghana.
dataprotection.gov.ghWe respond to all rights requests within 21 days as required by Act 843. We do not charge a fee.
Deleting your data
You have the right to request deletion of your SwapAm Vault registration and any personal data associated with it.
We will process deletion requests within 21 days. You will receive confirmation once complete.
Changes to this policy
We may update this policy as our services evolve or as the law requires. When we make material changes, we will update the date at the top of this page and, where possible, notify registered users via WhatsApp or email.
Continued use of SwapAm after a policy update constitutes acceptance of the revised terms.
Contact us
Available via the chat button on swapam.co
Response time
2 business days general · 21 days for data rights requests
To file a complaint with Ghana's Data Protection Commission: dataprotection.gov.gh
SwapAm Ghana · swapam.co · Privacy Policy v1.0 · June 2026
Compliant with Ghana Data Protection Act 2012 (Act 843)