Privacy notice

1. Who we are

Agoo by Nkonso is provided by Nkonso Technologies Ltd (“Nkonso”, “we”, “us”), a private company limited by shares registered in Ghana, of 10A Mega Street, Adentan Municipality, Accra, Ghana. Agoo was founded, designed and developed by Mawuli Dzaka under Nkonso Technologies Ltd.

This notice covers our websites (agoo.ardent.africa, agoobyardent.dev, agoo.reviews and agooforms.com), the Agoo web console, visitor pages and QR code links (including those an organisation serves on its own domain), Agoo Forms and the forms people answer on it, Wallet passes and apps, and the way we deal with customers, people who contact us and people whose details organisations keep in Agoo.

Agoo is in early access and parts of it are still being built. Where this notice describes something that is planned rather than live, we say so. Our documentation marks each feature as available, in early access, in preview or planned.

You can contact us about anything in this notice at agoo@ardentafrica.com or on +233 30 398 3393. Full details are in section 16.

2. Our two roles

Ghana’s Data Protection Act, 2012 (Act 843) distinguishes between a data controller, who decides why and how personal data is processed, and a data processor, who processes it on a controller’s behalf. We are both, for different data.

If you are a visitor or an employee of an organisation that uses Agoo, that organisation’s own privacy notice is the main one for you. Section 3 explains our part. Our obligations to customers as their processor are in the data processing agreement.

3. If you visit or work at an organisation that uses Agoo

The organisation decides what to ask for, why, and how long to keep it. Depending on how it has set Agoo up, it may record:

• Visitors and guests: your name, phone number, email address, company, who you are visiting and why, your visitor type, the site, times in and out, your photo, your signature and any documents you sign (such as a non-disclosure agreement), answers to the organisation’s own questions, and booking details if you book an appointment. If your pass covers several days, Agoo records each time you come in and leave on it.
• Who you came to see: a visit can be for one person, for several people, for a team (such as Admissions or Accounts) or for no one in particular, when reception or someone the organisation names receives you. Agoo records who you asked for and who the visit is for. If you wait for someone to see you, it also records who received you, who was asked to see you and what each answered (that they will see you, that you should wait and for how long, that it can’t be today, or that they can’t see you), any note staff add, and how it ended: who saw you, that you were booked in for another time, or that nobody could see you, with the reason staff gave. Staff notes and reasons are for the organisation’s staff and aren’t sent to you. Everyone your visit is for is told about it. This is part of your visit’s record and is kept as long as the organisation keeps visits.
• Vehicles at the gate: if you come by vehicle to a gate where the organisation keeps a vehicle register, its plate, when it came in and left, what it was there for and who for, the driver’s name and the number of passengers if the guard records them, and a photo of the vehicle if the organisation asks for one. The plate is read on the guard’s device. Staff, residents and contractors may have their vehicle recorded so the gate knows it, and the organisation may bar a plate from entering. A host may add your plate when they invite you.
• Parcels and deliveries: if the organisation logs parcels in Agoo, it records each parcel received for you or your team: who it’s for, what it is, who sent it, the courier and tracking number, where it’s kept, photos of its label and of the parcel, when it arrived and who logged it, each message and reminder sent to you, and how it was collected (with your one-time collection code, your signature, or a member of staff’s confirmation with their reason), when and by whom, or that it was sent back or refused. The collection code is sent only to you, or to your team. If you deliver a parcel as a courier, at a kiosk, from a drop-off poster or at reception, the organisation may record your name, your phone number and your courier company, as it chooses. If the organisation turns on reading labels with AI, the photo of the label is read by Anthropic’s Claude to suggest who the parcel is for, and a person always chooses (see section 7). Label and parcel photos, what the AI read, riders’ phone numbers and signatures are deleted 90 days after the parcel is collected or sent back unless the organisation sets between one day and two years; the record of the parcel itself is kept for the organisation’s period, a year unless it sets otherwise. A parcel still waiting is never deleted.
• Guest Wi-Fi: if the organisation shares its guest Wi-Fi through Agoo, you get it only while you are checked in. Agoo records that you were given it, on which visit and network, when and how (at a kiosk, on your pass, in a message, at the desk or from a poster), and which version of the organisation’s Wi-Fi terms you accepted. It never records anything about your phone or other devices, such as their MAC or IP addresses, or what you do online. This is part of your visit’s record, is kept as long as the organisation keeps visits, and is erased with your details.
• Documents you accept or sign: if the organisation asks you to accept its privacy notice, or to sign a document such as a non-disclosure agreement, a waiver or its site rules (on its visitor pages, at a kiosk or at reception), Agoo keeps which version of the document you agreed to and a fingerprint of its exact wording, when you agreed and how: on your phone, at the desk, or on paper, recorded by a member of staff. For a document you sign, it also keeps the full name you typed and the signature you drew. When you accept or sign online, Agoo keeps the IP address and the browser you used, as evidence of your signature under the Electronic Transactions Act, 2008 (Act 772). A published version of a document never changes; if the organisation changes the wording, it publishes a new version, and it may ask you to sign again. You can download a PDF copy of what you signed or accepted from your pass, Agoo emails you a copy of a document you signed if you gave an email address, and reception can give you one. These records stay with your visit for as long as the organisation keeps visits. If your details are erased, the name you typed, your signature, the IP address and the browser are removed, and only the record that a version was agreed to, and when, remains.
• Asking to visit: if the organisation lets visitors ask to visit from its visitor pages, you give your name, your phone number or email address, your company if you like, who you would like to visit, why and when, and the organisation’s own questions, and you accept its privacy notice if it has one. To confirm that the phone number or email address is yours, Agoo sends a six-digit code to it by SMS or email, from Agoo’s own sender. The code works for a few minutes. Agoo keeps only scrambled forms of the code and of the number or address it was sent to, never the code itself, and deletes them within a day. Your request waits for your host’s approval; their answer, and your pass if they say yes, go to the number or address you confirmed. Like any visit, your request may be checked against the organisation’s watchlist.
• Booking an appointment: if the organisation has booking pages, you give your name, your phone number or email address (or both), your company if you like, the answers to the organisation’s own questions for that kind of appointment, how you would like to be reminded, and the time, length and way of meeting you chose; you accept its privacy notice if it has one. You confirm your phone number or email address with a one-time code in the same way as a request to visit, so nobody can book in someone else’s name or have Agoo message a stranger. The booking, your details and your answers go to the host and the organisation, and Agoo sends your confirmation, reminders and any change by the channel you chose, with a link to move or cancel. If the host must confirm each booking, they confirm or decline it from a link in their message, and Agoo tells you either way. An in-person booking becomes an expected visit with a pass, and the rest of this section applies to it. If you don’t attend, that is recorded on the booking. Bookings are kept for the period the organisation sets for bookings. If a day is full and you join its waitlist, Agoo keeps your name, the contact you confirmed, the day, length and way of meeting you wanted, and your place in the line; if a time frees up, the first person waiting is sent a link to book it. Waitlist entries are deleted once the day they were waiting for has passed. If the organisation puts its booking page inside its own website, the page still comes from Agoo, and what you type goes to Agoo directly, not through that website. If your appointment is a video meeting and the organisation has Agoo make it with Google Meet, Microsoft Teams or Zoom, Agoo makes the meeting in your host’s own Google, Microsoft or Zoom account and adds the booking to your host’s calendar there. Depending on the organisation’s settings, the meeting and the event show your name and the kind of appointment, also your company, or only the time; never your phone number or email address. Agoo doesn’t add you to the event or send you an invitation from your host’s calendar: your link comes in Agoo’s own messages, and you join on that provider’s service, under its own terms and privacy policy (see Connected calendars and meeting links).
• What you do on its visitor pages: if the organisation sends you a pass, or puts check-in posters at its entrance, you can use its visitor pages on your own phone. Checking yourself in from a poster asks for the same details as a check-in at a kiosk or at reception (your name, phone number, email address and company if you give them, who you are visiting, why, and the organisation’s own questions), which you enter yourself, and accepting or signing the documents the organisation asks for. From your pass you can answer the organisation’s questions for your visit before you arrive, accept or sign its documents, tell your host you are running late, ask for another time with a note, cancel your visit with a reason, or say you have left; Agoo records what you did on your visit and tells your host. Hosts can approve or decline a visit from a link in their message. While you fill in one of these forms, what you have typed so far is kept in your phone’s browser for up to 24 hours, so a dropped connection or a closed page doesn’t lose it; it is filed under a scrambled form of the page’s address, never the address itself, stays on your phone until you send it, and is cleared once you do (or when you choose Start again). The organisation remains responsible for these details, as for any other check-in.
• Identity documents, only if the organisation asks for them: the type of ID and its number, typed by you or read by the kiosk from the ID's machine-readable lines, and sometimes a photo of a passport or another ID. A Ghana Card is never photographed: when the kiosk reads one, the camera's picture is used only on the device to read the number and is discarded at once, never saved, uploaded or kept, in line with the National Identity Register (Amendment) Regulations, 2026 (L.I. 2523). Nobody compares your card with you. Agoo records the ID you give; it doesn't check who you are with it.
• Staff: your name, contact details, role, sites, team, and attendance records such as clock-in and clock-out times, the method used, shifts, overtime, leave and timesheets, and any punch a manager added or corrected for you, with who did it, when and their reason. If you or the organisation add them, also a profile photo, the name you go by and your pronouns, and how you want Agoo to reach you (which alerts come by WhatsApp, SMS or email, and quiet hours). If the organisation sends you scheduled report emails (totals of visits, never names), Agoo keeps which reports you get and any you stopped. The organisation decides which of your details you can change yourself in the console. If you clock in on your phone, Agoo checks that you are within the site’s area, or on its Wi-Fi, at that moment. If the organisation turns them on, Agoo also keeps a selfie taken when you clock in, the exact location of a phone clock-in, or the Wi-Fi network you used, for as long as the organisation sets (90 days by default for selfies and exact locations). If you set up your staff badge on your phone in the Agoo app, the key that makes its codes stays in your phone’s security chip; Agoo keeps only the part that checks them (which can’t make one), your phone’s name and when you added it. You can remove it at any time, signing out removes it from that phone, and the organisation can remove it too. If you turn on notifications in the Agoo app, Agoo keeps, for each phone or tablet, the address Apple or Google gives the app for notifications (a device token), the kind of device, the app’s version, your language and time zone, and when it was last used, and whether each notification reached the device; which alerts come to the app is your choice in your notification settings. Notifications are delivered through Apple’s push notification service on iPhone and iPad, or Google’s Firebase Cloud Messaging on Android, and show on your lock screen, with visitors’ names unless the organisation chooses to leave them out. Signing out, removing the device in your notification settings or deleting the app stops them, and devices unused for 120 days are removed. If you answer a notification, for example telling reception you’re on your way, Agoo records your answer on the visit. If the organisation uses teams, Agoo keeps which teams you are in and whether you lead one, the visits you or your team are asked to see, and what you answered; if you gave your answer to reception by phone, reception can record it for you, and the record names you both. The organisation can also set where a visitor who arrives asking for you without an invitation goes first (to you, your assistant, your office or reception) and whether visitors can find you by name at its kiosks and on its visitor pages. If you work a gate, Agoo keeps when you signed in and out on the gate’s device, how (your PIN or your phone’s badge) and why you signed out, and names you on what you did there, for as long as the organisation keeps attendance records. If the organisation shares its staff Wi-Fi with you through Agoo, Agoo keeps which of its networks are shared with you and when a network’s password was sent to your phone; the password is kept in your phone’s secure storage, each time you show it in the Agoo app is recorded in the organisation’s audit trail, and you are told in the app, or by email, when a network’s password changes.
• Employment details, if the organisation records them: who your line manager is, the dates you started and left, whether you are permanent, temporary, casual or part time, and your contracted hours a week. Your line manager, and their own managers, can see your attendance, shifts and leave. Each day Agoo works out records your breaks, paid or unpaid, and whether an unpaid one was taken off automatically, you clocked out for it or you punched it. Where your organisation has break punches on, your Start break and End break punches are kept like your clock-ins, and a day whose break was left open, ran long or wasn't taken is shown to your managers. If HR switches on the paid nursing hour for you, Agoo keeps only the dates it runs between, seen by you and HR (and by the kiosks at your site, so they can offer you a nursing break once you've identified yourself), never anything about a pregnancy or a birth. If the organisation plans rosters in Agoo, Agoo keeps the shifts you are rostered on (the site, day and times, the shift's name, label and break, and any note a manager adds for you), the repeating pattern you are on, what each published change altered and whom it told, and when you saw a change in the app. You see only your own published shifts; the people who plan rosters at your sites, and those who can see attendance there, see the roster, and can print it for a notice board. You are told about a change by a notification in the Agoo Workspace app, or by email if you don't have the app. The kiosks at your site keep the site's published shifts for yesterday, today and tomorrow, so they can show you your shift today once you've identified yourself. Where the organisation lets staff take open shifts or swap shifts, Agoo keeps the open shifts you claim, the shifts you offer, take, refuse or withdraw, whom you offered them to, any note you or a colleague adds, and the record of their approval (each step, who decided it and when, and their note), and you are told in the app, or by email, about offers, answers and decisions. A colleague offering you a shift sees whether you could take it and your published shifts at that site for the next four weeks, so they can ask for one in return; colleagues who could take an open shift or an offer made to anyone see who offered it and the shift. Agoo warns the people who plan rosters, and you, where a shift would leave you under 12 hours' rest, without 48 hours off in seven days or over your weekly hours (Labour Act, 2003 (Act 651), sections 41 and 42). Section 55 of the Act means a woman's consent is needed for night work or overtime before her maternity leave, and for overtime while her baby is under eight months: Agoo works this out only from maternity leave already recorded, never asks or keeps anything about a pregnancy, and shows the warning only to those who may see your private leave, such as HR. If you agree, HR or whoever plans your roster records that you consented (to night work, overtime or both, from when and to when, and any note), and can end it. Rosters, swaps, claims and records of consent are kept as long as the organisation keeps attendance records. From your punches Agoo also works out each day's counted hours, regular time and overtime, any work on a rest day or a public holiday and, where the organisation pays a night allowance, your time at night, by the organisation's rules or the work-rule set it puts you on (Agoo keeps which set you follow, and from when). Where extra time needs a manager's approval, Agoo keeps the decision: who approved all or part of it or declined it, when, how much, and their reason, which you see. You are told about a decision in the Agoo Workspace app, or by email if you don't have the app. For each timesheet period (a week, a fortnight or a month, as the organisation sets), Agoo keeps your timesheet: its totals, where it stands, and the record of its approval (whether you confirmed it, when and with any note you added; each approval step, who decided it, when and in what capacity; who sent it back or reopened it, when, and their note or reason, which you see), and whether anything arrived after it was locked. Once approved, it is locked, so your hours for that period change only if someone reopens it with a reason. You are told in the app, or by email, when it is ready to confirm, sent back or reopened. Timesheets and their approval are processed so the organisation can pay you for the hours you worked and manage your employment. These are kept as long as the organisation keeps attendance records. Where the organisation's plan has the payroll export, its HR makes payroll files from approved timesheets: your name, employee number, department, site and employment type, with your hours and days under the organisation's pay codes, including the kinds of leave you took (sick or maternity leave included, which your line manager sees only as “away”), and any correction to an earlier file. They are made so the organisation's payroll can pay you, and only HR, Owners and Admins, and systems the organisation gives payroll access, can make or download them. Each file is kept with the organisation's attendance records, for as long as it keeps them, and making or downloading one is recorded.
• Leave: the leave you take or ask for, including requests you send from the Agoo Workspace app (its kind, the dates, the days it counts, whether it is paid, any note you add, who approved, declined, recorded, cancelled or ended it, and any reason given), the record of its approval (each step, who decided it and when, whether they decided as the approver, as someone covering for them, as the next manager up or as HR, and their note), your balance for each kind of leave and every line behind it (days granted, taken, given back, carried over, expired or adjusted, with who made each change and why). If you approve leave, Agoo also keeps the decisions you make, and the deputies you name or are named as (who, for which dates, and who named them). Employers must keep a record of the leave each worker is due and takes, and what they were paid for it (Labour Act, 2003 (Act 651), section 27), so this is processed for the organisation's legal obligations as your employer; its approvals and deputies are part of keeping that record and managing your employment. Your line manager, whoever approves your leave and HR see your leave; for the kinds of leave the organisation marks as private, such as sick or maternity leave, your manager and other approvers see only that you are away, never the kind or your balance, and integrations never see the kind. You are told by a notification in the app, or by email, when your leave is decided. Leave records, with their approvals, are kept for the organisation's period, 7 years unless it sets between 1 and 10 years.
• Leave certificates, such as a medical certificate for sick leave or the certificate maternity leave needs (Act 651, section 57), are information about your health, which Act 843 treats as special personal data. The organisation may process it because it is necessary for a right or obligation the law gives it as your employer (Act 843, section 37(3)). You or HR can add one, you from the Agoo Workspace app's camera or your files. Agoo keeps a certificate as a private file that only you and the organisation's HR can open, never your manager, other staff, integrations or the API; every time one is added, opened or removed is recorded in the audit trail. It is deleted when the organisation's period ends, 24 months after the leave unless it sets between 30 days and 2 years, unless a legal hold keeps it; HR can delete it sooner, for example if you ask.
• HR records, if you work for the organisation: your legal name as on your Ghana Card, date of birth, gender if you give it, nationality, marital status only if the organisation asks for it, your personal email and phone, home address and GhanaPost GPS address, and the languages you speak; your employment (department, position, grade, the kind of contract and when it ends, probation, your notice, working pattern, cost centre and continuous service) and your Tier 2 and Tier 3 pension schemes; your emergency contacts, next of kin and the beneficiaries you name, with their shares; your statutory numbers (Ghana Card PIN, which since April 2021 is also your TIN, SSNIT number, passport and permits); and the bank or mobile money accounts you are paid into. Every change to your job is kept as a line of job history with the date it takes effect, who made or approved it and why. The organisation processes this to employ you and pay you and for its duties as your employer under the Labour Act, 2003 (Act 651) and tax and pension law. Statutory numbers and account numbers are encrypted, and only their last four characters are shown; only the organisation's Owner and HR can see a full number, and only by giving a reason, which is recorded in the audit trail with the time. Your line manager sees your job and its history, never your personal details, numbers or accounts. A change to where you are paid needs a fresh check that it is you or HR, and you are always told by email and in the app; if you tell Agoo it wasn't you, your accounts are held, so nothing is paid into them, until HR checks them with you. A disability is recorded only if you choose to declare it, so the organisation can notify the Public Employment Centre (Act 651, section 47); it is special personal data about your health, kept only with your consent. You can see your whole record in the Agoo Workspace app under My record, change the parts the organisation lets you, and ask HR to correct the rest. HR records are kept for the organisation's period after you leave, 6 years unless it sets between 1 and 10 years; passport, permit and other identity numbers not needed for tax, a year unless it sets up to 6 years.
• HR documents, if you work for the organisation: the documents it keeps about your work, such as your contract and written particulars, letters, licences, permits, certificates, appraisals and warning letters, and, if it needs them, medical certificates and a police clearance report, each with its type, title, the dates it was issued and runs out, and who added it. You may add your own in the Agoo Workspace app or the Console. Each file is encrypted with a key of its own before it is stored, photos lose their location and other hidden details first, and every file is checked for viruses by Agoo's own systems before anyone can open it. Who sees a document depends on its type: you always do; HR, the Owner and admins see contracts, letters and certificates, and your line manager only if the type allows; identity and disciplinary documents only you, HR and the Owner; medical certificates and police clearance, which are special personal data, only you and HR. Every opening of an identity, disciplinary or health document is recorded in the audit trail. Before a document runs out, Agoo reminds you, HR and, where the type says so, your line manager (never about a health document). Agoo never keeps a copy of a Ghana Card: L.I. 2523 forbids relying on one to check who someone is. HR documents are kept with the HR record or identity numbers they belong to; health documents for 2 years after they stop being current, unless the organisation sets between 30 days and 6 years.
• Emergencies: if the organisation starts an emergency roll call or a drill at a site, Agoo lists who was on site (visitors checked in and staff clocked in), sends each of them a link to say they are safe, and records how each was accounted for and by whom. While it runs, the phone numbers of the people on the list are shown to the organisation’s front desk and security staff at that site, including on their phones, so they can call anyone who is missing; the numbers are removed from the roll call when it ends.
• Others, depending on the organisation: contractors and their documents, delivery riders, residents and domestic staff on an estate, or a school’s authorised pick-up people.
• People who scan its QR codes: when you scan a tracked QR code an organisation made with Agoo (one that opens an agoo.click or qr.agoo.ardent.africa link, or a link on the organisation’s own short-link domain), Agoo records when you scanned it; the country, region and city that our network provider, Cloudflare, works out from your connection; the kind of device, its operating system, browser and language; and what happened, for example that you were sent on to the organisation’s web page. To count how many different people scanned a code, it also keeps a one-way code made from your connection, your browser and that day’s date. The code changes every day, so it can’t be used to follow you from one day to the next, and it doesn’t identify you. If a code asks for a password, Agoo stores only a scrambled form of the password, never the password itself. A plain QR code holds its content in the code itself, so scanning it doesn’t reach Agoo and records nothing.

Agoo is designed with these protections, which organisations can’t switch off:

• ID numbers are sealed: each is encrypted on its own, and screens and exports show only its type and last four characters (for example “Ghana Card ending 4567”). Only people whose role the organisation allows can see a full number, giving a reason, and each time is recorded in the organisation’s audit trail. Your ID’s type, number and any photo are never sent to the organisation’s integrations, webhooks or API keys. ID photos can be opened only by the organisation’s Owners, Admins and Security leads, each time recorded, and are deleted automatically on the schedule the organisation sets: a day by default, and never more than 30 days.
• Face matching is only for staff attendance and never for visitors. An organisation can use it only after it publishes a notice to its staff saying why, on the basis it records: either its legal basis as the employer, or each employee’s consent. Agoo keeps the notice and each acknowledgement or consent. The face template is created and kept, encrypted, on the kiosk where the employee enrols; it never leaves that kiosk, is never sent to Agoo’s servers, reports, the API or anyone else, and is deleted from every kiosk when the employee leaves. If a face match fails, the employee can still clock in another way, and a supervisor reviews it.
• Selfies and exact locations from clock-in are seen only by people the organisation allows to read attendance, every viewing is logged, and location data is removed from photos when they are uploaded.
• Staff profile photos are copied afresh, pixels only, when they are uploaded, which removes location and camera details, and are shown only to people signed in to the organisation who are allowed to see its directory. A photo that is replaced or removed is deleted within the hour, and so is your photo when the organisation deactivates you, unless it has placed a legal hold.
• Your pass and approval links are personal. Each carries a code that works like a key to that visit, so please don’t share it. The code stays in your browser rather than in our server logs, and the visitor pages are never indexed by search engines. When you check yourself in or ask to visit, the page doesn’t look you up by your phone number, so nobody using it can learn whether someone has visited before or see their details. The QR code on your pass is digitally signed by the organisation, so its kiosks and guards can check it without a connection; it holds your pass’s code, its dates, daily hours and gates, and never your name or contact details.
• Adding your pass to Apple Wallet or Google Wallet is your choice. The pass goes to Apple or Google only if you tap Add to Apple Wallet or Add to Google Wallet on it: your name, the organisation, your host, the site and its address, the time of your visit and your pass’s code. Apple or Google then keep it in your wallet under their own terms and privacy policies, not ours, as services you chose for yourself rather than our sub-processors. While the pass is in your wallet, Agoo sends its updates (a new time, or that the visit is cancelled or over) to your device through Apple or Google; for Apple Wallet, your device registers with Agoo for those updates using an identifier Apple gives it, which is used for nothing else. The link that adds the pass works once and expires within minutes. If you don’t add the pass, nothing is sent to Apple or Google.
• Feedback an organisation asks you for. After a visit or a booking, the organisation may ask you once how it went, by SMS, WhatsApp or email in its own name, and its posters may invite anyone to answer. Answering is always your choice. What you answer (your rating, what stood out, a comment and any other questions it asks) goes to that organisation, with the visit or booking it was about unless its survey is anonymous. From a poster, your name and contact are recorded only if you ask to be contacted, and only to reply to you. The organisation decides how long to keep your answers. Every request has a Stop link: you can stop being asked by that organisation, or by every organisation on Agoo, and it stays stopped. So that nobody is asked too often, Agoo keeps a scrambled form of the phone number or email a request went to (never the number or address itself) and allows no more than three requests a week across all organisations; a Stop for every organisation is kept the same way. These scrambled forms are used for nothing else. What you tell an organisation privately never appears on a public review page.
• Invitations to review an organisation on Agoo Reviews. An organisation can ask the people it serves to review it on Agoo Reviews (agoo.reviews), in its own name. It invites everyone or no one: every visitor whose visit checks out or whose booking ends, a few hours later, or customers it names from its own records (typed in, from a customer list, from the receipts and booking emails it copies to its forwarding address, or with a single-use link it hands you after a sale). It never chooses who to ask by what they might say, and nothing is offered for a review. The invitation comes by email, by text or, if you chose WhatsApp for your visit, on WhatsApp, with at most one reminder three days later if you haven't opened it, and never in the organisation's quiet hours. Its link works for 30 days. If you write a review through it, your review says Verified visit (when it came from a visit or booking Agoo recorded) or Invited; the organisation sees how many invitations led to reviews, never which one led to yours. Nobody is invited by the same organisation more than once in 90 days, an organisation's own staff are never invited, and services whose name reveals a health condition send no invitations. For customers an organisation names, we keep their name and contact details sealed (encrypted, and opened only to send the invitation and its reminder) and delete them 30 days after the link ends; the organisation keeps a masked line (“Ama O. · a•••@coastline.example”) with its own records, for a year unless it sets between 90 days and two years. A forwarding address reads only who an email was sent to, never the message itself, and keeps nothing else. Every invitation lets you stop being asked by that organisation, or by every business on Agoo Reviews; we keep that request as a scrambled form of your phone number or email (never the number or address itself) until you ask to be invited again. If your visitor details are erased, your invitations lose their link and their scrambled contact details.
• Writing back on WhatsApp. Messages about visits and bookings come from Agoo's own WhatsApp number. If you write to it, Agoo keeps your message and anything you send with it (a photo, voice note or document), with the name and number WhatsApp gives us (or, if you use a WhatsApp username, the ID WhatsApp gives us instead). You get an automatic reply straight away. If your message is about a visit or booking, it goes to that organisation with its record, and the organisation's team (reception, security, your host) reads it and answers it (on Agoo's free plan, Agoo's own team answers instead); if you could mean more than one organisation, we ask you which in the chat. Otherwise Agoo's own team answers it. The organisation keeps these messages as long as it keeps its visit records. Reply STOP at any time and Agoo sends you nothing more on WhatsApp, for any organisation, until you reply START; your visit messages then come by text message or email.
• Messages about your visit or booking (SMS, WhatsApp or email), including a code that confirms a request to visit, a booking or a place on a waitlist, and the copy of a document you signed, are used only for that visit or booking. Nkonso never uses your contact details for its own marketing.
• Watchlist checks are decided by people. An organisation can screen check-ins against its own watchlist; a match alerts a person, and Agoo never refuses entry automatically. A watchlist is shared only when an organisation in an organisation group chooses to share it with the other organisations in the group: then a watchlist entry's name, phone number and reason can be checked against visitors at their sites, and a match shows them that entry's name and reason. ID numbers are never shared between organisations.
• Organisation groups. Organisations that work together, such as a company and its subsidiaries, can form a group on Agoo. Each organisation decides what the group gets: its totals only (numbers, never names), or access for the group's administrators to see, or also manage, its records as that organisation's own staff would. Everything they do is recorded in that organisation's audit trail, and the organisation can end it at any time. The organisation you visit or work for remains responsible for your information.
• QR code scans never store your IP address. Cloudflare uses it only while it delivers the link, to work out the approximate location and the daily code above. Scans are kept for two years, or the period the organisation sets, and are then deleted automatically.
• Every view, export and change of personal data is recorded in a tamper-evident audit trail.

To see, correct or delete your data, or to stop a use of it, ask the organisation online from Your data at the foot of any of its visitor pages (you confirm your email with a code we send it, and the organisation answers you there), or contact it using the details in its privacy notice, which Agoo shows before you check in. If you contact us instead, we will pass your request to the organisation, tell you we have done so, and help it respond. A request you make online (what you asked, your name, your email and, if you give it, your phone) is kept for the organisation, with its answer, for two years after it is closed, then deleted; the code is kept only as a scrambled form for a day. We do not act on an organisation’s data without its instructions unless the law requires us to.

4. If you use our websites or contact us

Enquiries and early-access requests

When you use the forms on this website we collect your name, work email, phone number (optional), organisation, sector, number of sites, the products and plan you are interested in, and your message. The form emails these details to our team through our email provider and sends you a confirmation. We use them to reply to you and follow up on your enquiry, not to add you to a mailing list.

To stop spam, the form uses automated anti-spam checks. The form doesn’t store your IP address.

Sponsoring a front door

If you pledge to sponsor a front door through Agoo for Good, we keep the sponsor’s name, the contact person’s name, email address and phone number (optional), your website (optional), any message you send and, for a place you name, its name, town and someone we can reach there. We keep these contact details to run the sponsorship: to confirm your email address, verify and match places, ask for payment, issue your receipt and write to you before a term ends. The place you sponsor is told who paid for its plan.

We name a sponsor in public (on our Agoo for Good page, on a certificate and, if the place chooses, on its front door) only if you ask us to. Card and Mobile Money payments are handled by Paystack; we never receive your full card number or Mobile Money PIN. A pledge whose email address is never confirmed is deleted after seven days.

Agoo Reviews accounts

Anyone can read Agoo Reviews (agoo.reviews), and search engines list its pages. Making an account opens at its public opening: until then, only people we invite can make one, and organisations on Agoo aren’t listed there. To invite someone, we keep the email address or mobile number they’ll sign in with on a short list until the opening, or until we take it off; it’s never shown to anyone. To write reviews on Agoo Reviews (agoo.reviews) you make an account with your mobile number or your email address. There’s no password: we send a one-time code by text or email each time you sign in on a new device. We keep:

• the number or address you confirmed with a code. It is never shown to anyone: not to businesses, not to other reviewers. If you also use it to sign in to Agoo at work, it’s the same sign-in account, but your organisation never sees whether you review, and signing in to Agoo Reviews opens nothing of any organisation;
• the name shown on your reviews: your first name and the initial of your last (“Kofi M.”), or a name you choose. We don’t keep the first and last names you type, only the name shown;
• your choice of a private profile, your confirmation that you’re 18 or over, and the month you joined;
• a photo, if you add one: on your Agoo ID, shown in every Agoo product you use, or for Agoo Reviews only. We keep the square copy we make of it (never the file you sent, its location or other details), show it beside your name on your reviews and profile unless you turn that off or your profile is private, and delete it when you remove it or delete your account;
• each sign-in to Agoo Reviews (the browser or app, the IP address and the approximate town and country it points to, and when it was last used), so you can see where you’re signed in, sign out everywhere and be told of a sign-in on a new device, kept as described in section 5;
• a record of each code asked for (which account, whether by text or email, when, a mobile number without its last three digits, the internet address it was asked from, and whether it was used), to stop abuse and keep what texts cost in check. It’s deleted after 45 days.
• your reviews: the stars, title, words and month of your visit, the label saying how your account was confirmed, your declaration that it’s your own experience with no link to the business, when you accepted the guidelines and, at a school, how you know it (shown only to our moderators). Your reviews are public on each place’s page under your name; reviews of clinics, schools, places of worship and the other places that need care never appear on your profile;
• when you change a review, its earlier words, kept privately in case a question about the review comes up (never public, and deleted with the review), and what our automatic checks found in each version (the rule and the words that matched, and what our AI check found: the guideline it may break, how sure it was and the words concerned), so a moderator can see why a review was held. All of it is deleted with the review;
• each decision our moderators make about your review (published, held, removed or a request to change it, with the reason from our guidelines and anything they wrote to you), kept with the review and, without anything that names you, after it’s deleted, so the record of moderation stays complete;
• at a clinic or hospital, your confirmation that health details in your review are your own and may be public: your explicit consent to publishing them, which you withdraw by changing or deleting the review;
• the date you last wrote about each branch, with no words, so a new review of the same branch waits for its period even after a review is deleted;
• if you write a review through an invitation, which invitation it came through and whether that followed a visit or booking Agoo recorded, so your review gets the right label. The business never sees this: it sees only how many of its invitations led to reviews;
• if you start a review in a form on a business's own website, the stars and words you typed, kept for a day while you sign in on agoo.reviews to post it, and nothing else about you or your device;
• if you use the Agoo Reviews app and turn on its notifications: for each phone or tablet, the address Apple or Google gives the app for notifications (a device token), the kind of device, the app’s version, your language and time zone, which of the four kinds of notification you want, and for up to 7 days each notification waiting to go and whether it reached the device. They’re delivered through Apple’s push notification service or Google’s Firebase Cloud Messaging, name the business and say what happened. Signing out of the app, turning them off or deleting your account removes them;
• the people you block in the Agoo Reviews app, so their reviews and profile stay out of your view, kept until you unblock them or delete your account. They aren’t told, and blocking changes nothing about a review or a score;
• your choice of the weekly roundup (your reviews that went live that week, and replies you didn’t already get by email), one of your emails from Agoo Reviews, off until you turn it on in your account, with a stop link in each one;
• to spot reviews that aren’t genuine: when you write a review, a scrambled form of the network it came from (the first part of the internet address, never the whole address, made with a secret key so it can’t be read back), kept 90 days; and, when our checks see a pattern (many accounts acting together, the same words on different pages, a link to the business or a rival, a sudden flood of reviews), a note for our moderators of which reviews it concerns and what they decided, kept 24 months after the decision. A check never removes a review or decides anything about you: it holds a review for a person to read;
• any decision a moderator makes about your account (a warning, writing paused, or the account closed), with the guideline, what we told you, why, who decided and the version of the guidelines it applied, and your appeal, kept 24 months after it ends; it’s on your account page and in your data download, and never shown to a business;
• a business you add to Agoo Reviews: what you typed, the pages we showed you as possible duplicates and what a moderator decided, kept 24 months after the decision. Your name is never shown with it, and the business isn’t told who added it.

Before a review appears, an AI (Anthropic’s Claude) reads its title and words against our guidelines, to hold for a person anything that may break them. It isn’t sent your name, contact details or stars, it can’t change or remove a review, and a person makes every decision to remove one; if the AI isn’t sure or can’t be reached, a person reads the review first. Our lawful basis is our legitimate interest in keeping Agoo Reviews lawful and safe. Codes by text are sent through our SMS provider in Ghana and codes by email through our email provider (see sub-processors). You can change your name, make your profile private and sign out everywhere in Settings, download everything Agoo Reviews keeps about you, change or delete any review at once, and delete your account at any time, on the website or in the app; deleting removes your profile and every review you wrote. How deleting works is explained at agoo.reviews/account/delete. Agoo Reviews accounts are for adults. Nobody at a business can change, hide or delete your review, and we never tell a business who you are without your consent or a court order.

What you do on Agoo Reviews

• “Useful” votes: which reviews you marked useful and when. Readers see only how many people found a review useful, never who; votes never change a score. To stop votes being piled on, we also keep when you voted, saved or followed, for two days.
• Saved and followed places, and your lists: the places you save and follow, and since when; and the lists you make, with their names, notes, the places in them and whether each is private or shared by link. Only you see them, unless you share a list: then anyone with its link sees the list, with your name only if your profile is public, and search engines are told not to list it. Making a new link stops the old one. The businesses never learn who saved, listed or follows them, and nothing about any of it is counted in public.
• Questions and answers: the questions you ask on a business’s page and the answers you give, with when, and which answers you marked helpful. Your questions and answers are public on the page under your name, checked by the same rules as businesses’ replies, and one that our checks question is read by a person at Agoo first. Readers see how many people found an answer helpful, never who. They never change a score.
• Notifications and emails: your notices (new reviews and replies at places you follow, replies to your reviews, answers to your questions, messages from businesses), whether you read them and when we emailed them, kept 90 days; and your emails from Agoo Reviews, one set of choices in Settings: places you follow (each, daily, weekly or none), replies to your reviews and answers to your questions, and messages from businesses (each at once, or none) and the weekly roundup (only if you ask). Every email has a link that stops just that one without signing in. We never text notices.
• Messages from a business: only if you allow it on a review, a business can send you a message about it through us. We keep the message for 12 months, and whether you read, stopped or reported it. The business never gets your contact details or your name beyond the one on your review. Messages go one way: to answer, you use the business’s own contact details if you wish.
• Aspect stars and language: any optional stars you give parts of a visit, kept with the review; and the language of each review, which we guess from its words on our own systems (nothing is sent anywhere for it). If you choose “Translate” on a review, your browser opens Google’s translator on that review’s public page: Google sees that address and the page, as it would any page you open, and we send it nothing.
• AI summaries: on business pages with enough reviews, an AI (Anthropic’s Claude) reads the published reviews’ titles, words, stars and months, without any reviewer’s name or contact details, and writes a short summary and the topics people mention, with links to the reviews behind each line. It isn’t made for clinics, schools, places of worship and the other places that need care. Our lawful basis is our legitimate interest, and readers’, in a fair overview of what reviewers say.

Your data download includes all of this, and deleting your account deletes your votes, saved and followed places, lists, questions and answers, notices, settings and the messages sent to you.

Businesses and places on Agoo Reviews

Agoo Reviews lists businesses and public places that serve people, so customers can read and write honest reviews of them. For each page we keep the place’s name, category, branches (their names, towns and addresses; only the town for a business run from a home), and any website, email address or phone number the place publishes. For an organisation that uses Agoo, the branches come from its sites in Agoo. A page can also show the place’s profile: its logo and a cover image, a short description, the year it was founded, its social media pages, a WhatsApp number it publishes, its opening hours, what it offers and the languages spoken, with when and where the facts were checked. Agoo takes these from public sources (the place’s own website, a public register, its signboard) until the business claims its page and keeps them itself; for an organisation that uses Agoo, its logo is the one it set in Agoo, and it comes off the page when the organisation leaves. These are facts about businesses, not about people: we never add a person’s own phone number, email address or photo, and a logo or cover we stop using is deleted within a week.

• Before a page opens, we tell the place once, 14 days ahead. An organisation that uses Agoo is told by email at the addresses its Owner and Admins use to sign in to Agoo, and its Owner or an Admin may choose to open its page at once instead. A place that doesn’t use Agoo is told at the email address it publishes, or by a text to the phone number it publishes, sent only between 8 a.m. and 7 p.m.; never on WhatsApp, and never to sell anything.
• “Don’t contact me again” in that notice stops every email and text from Agoo Reviews to the place. We keep a record that it asked, and its page stays.
• Questions about a listing (a site that is secure, someone’s home or not open to the public) are kept with the page, with the name of the person who asked and our answer.
• Claiming a page. When someone claims a business’s page we keep their name and role at the business, how they proved it, and our decision. A code sent to prove it goes to an email address at the business’s own website or to the phone the page publishes; we keep only a scrambled form of the code, and forget the address or number 30 days after we decide. A document sent to prove it (a registration certificate or a bill in the business’s name) is stored privately, seen only by our moderators, and deleted 30 days after we decide, or when the claim is withdrawn. Our lawful basis is our legitimate interest in making sure only a business manages its own page.
• Managing a page. For each person on a page’s team we keep their role, whether they want emails about new reviews, who invited them, the branches they manage if they look after particular branches, and the invitation’s email address until it’s accepted or lapses (then 30 days). Every change to the page’s facts is kept with who made it. Replies are public under the business’s name, never the person’s, and so are its answers to questions on its page. A business’s branch league table and its settings are kept with its page and seen only by its team. A page shows how quickly the business usually replies, worked out from its published replies over 12 months, once it has replied to 5 reviews or more.
• Photos. A business that manages its page can add up to 30 photos of the place, its products or its services, and Agoo can add photos too. They belong to the business’s page, not to a person. We keep the copy we make of each one (never the file that was sent, its location or its camera details), its caption, the branch it shows, who added it and our decision. A person at Agoo checks each photo before it shows, and a photo must not show anyone who hasn’t agreed to be shown. A photo we remove or don’t approve is deleted within a week. Our lawful basis is our legitimate interest, and readers’, in seeing the places they’re choosing.
• Branches. For each branch we keep its name, type, town and address, its business’s own code, a map point and how precise it is (never more than the town for a business run from a home), opening hours and phone, whether it’s closed for now or for good, and where the facts came from and when they were checked. An organisation that uses Agoo chooses, site by site, whether each of its sites is a branch; we keep the choice, why a site isn’t listed, and who chose. If you suggest a branch or a correction, we keep what you suggested and your account until a moderator decides, tell you the outcome, and never show your name with it; if you delete your account, the suggestion stays without your name. When a branch’s poster is scanned we count the scans for that branch and day, and nothing about who scanned, for 13 months. Our lawful basis is our legitimate interest, and readers’, in accurate branches.
• Near me, in a business’s branch finder, uses your phone’s or computer’s location only after you tap it and your browser asks you: the distances are worked out on your device, and your location is never sent to us or anyone else. The free map’s tiles come from OpenFreeMap, which sees the parts of the map your browser asks for, as any website would; Google’s map, on some businesses’ pages, loads only when you choose it.
• Reports, legal notices and appeals. A report (of a review, a reply, a photo, a question or an answer, a page or a reviewer’s profile) keeps what was reported, the reason and your words, and either your account or, if you gave one, your email address for our answer, which we forget 90 days after we decide. A legal notice keeps the name, email and phone you give, your capacity, the words complained of, why, and your declaration and signature: we forward the complaint to the person who wrote what it’s about without your contact details, and forget your details three years after the decision, keeping the record of what was decided. An appeal keeps your reasons and our decision. Our lawful basis is our legal obligation to act on notices (the Electronic Transactions Act, 2008) and our legitimate interest in keeping Agoo Reviews lawful and safe.

Agoo Forms

Agoo Forms (agooforms.com and its apps) lets organisations, teams and people make forms. Until its opening, only people we invite can sign in: to invite someone, we keep the email address they’ll sign in with on a short list until the opening, or until we take it off.

If you make forms

You sign in with your email address and a one-time code we send it (or, where we offer them, with a passkey or with Google, Microsoft or Apple: see one Agoo account across our products, which also says how you can add a mobile number). We keep your name, your email address, the workspaces you belong to and your role in each, the invitations you send and receive, and a record of where you’re signed in (such as “Chrome on Android”, with the IP address and the approximate town and country it points to), so you can end a sign-in you don’t recognise and we can tell you of a sign-in on a new device. We keep what you build: your forms, their drafts and every published version, with who published each and when. We send you the emails you choose about responses and about your workspace, and records of what members do in a workspace are kept in its history. If you ask Agoo AI to draft a form, we send your description to Anthropic’s Claude and keep it, with the draft, for 30 days (see section 7). If your forms belong to an organisation that uses Agoo, its Owners and Admins run its workspace, and section 5 also applies.

Agoo Forms shares one safety team, one safety policy and one record of decisions with the rest of Agoo. To keep the people who answer forms safe, Agoo’s checks read the words of each form when it’s published: its title, description, questions, options and endings, and who it says it’s from, never anyone’s answers. The forms of new workspaces, and some others such as reported ones, are also read by AI (see section 7). When a form is held, taken down or sent back for a change, or a workspace’s publishing is paused or the workspace suspended, we keep a record of it: what happened, the rule, and the words we send the workspace’s Owners and Admins. They see that record, and can appeal a decision once within 90 days; an appeal keeps their reasons and our answer. When people on our safety team look at a case, they see the form’s words and its workspace’s name, level and history, never what anyone answered. The record stays with the workspace and goes when the workspace is deleted; the cases behind it go two years after they are decided.

If you answer a form

The person, team or organisation named on the form receives your answers and decides what they’re for; their own privacy notice applies, and the form links to Your data, which says how to ask them about it. We keep your answers for them, with when you sent them, how long the form took, the version you answered and the link you came through. You don’t need an account and no cookies are set. As you type, your answers are kept in your own browser for up to a day, so a dropped connection or a closed tab loses nothing; they’re cleared when you send them. Answers marked sensitive, such as a Ghana Card number, are sealed as they arrive: only people the maker allows can reveal them, and each time is recorded.

To stop robots and floods, each form runs a robot check from Cloudflare, and we keep a scrambled form of your connection’s address with your response for 30 days, scrambled with a key that changes every day, so it can’t follow you from one day to the next. We never call a form anonymous: the form says plainly what its maker sees. Agoo Forms will never ask for your password or PIN, and a form that tries to is against our rules.

Reporting a form. Report this form, on every form, lets you tell us a form breaks our rules. We keep your report: the form, the version you saw, the rule you chose, your note and, if you give one, your email address. We use the address only to tell you the outcome, and forget it a day after we have, or after 90 days. To stop floods of reports, we keep a scrambled form of your connection’s address with the report, made the same way as above. The form’s maker is never told who reported it. People on our safety team read your report with the form; reports and our decisions about them are kept for two years after the decision, longer only while a restriction from them lasts or where the law or a child’s safety requires it.

Asking about your data. Your data, on every form, lets you ask its maker for a copy of what you sent, a correction, deletion, or to stop using it. We send a code to your email address to check it’s yours, then pass on your name, email address, what you ask and the form it’s about. An organisation’s form sends your request to that organisation’s own data request inbox, which answers you by email; for any other form, the workspace’s Owners and Admins answer on agooforms.com, and we email you their answer. They have 40 days for a copy and 30 days for anything else, and we remind them before the date. If a maker hasn’t answered by then, we follow it up with them and help you ourselves (see section 12). We keep a request, with its notes and answer, for the maker for two years after it’s closed.

Status updates

If you subscribe at status.agoo.ardent.africa, we keep your email address to send you updates about incidents and planned maintenance, once you’ve confirmed it from the email we send. One click in any of those emails unsubscribes you and deletes the address; one you never confirm is deleted after two days. We use it for nothing else. To stop abuse, the form counts requests from your network for an hour without storing your IP address.

Emails, calls and WhatsApp

If you email, call or message us on WhatsApp, we keep what you tell us and our reply so we can help you and keep a record of the conversation. On WhatsApp that includes the name and number (or username ID) WhatsApp gives us and anything you send; see writing back on WhatsApp.

Technical data

When you load a page or download one of our apps, our hosting and DNS providers (Vercel and Cloudflare) process your IP address, browser type, the page requested and the time, and keep them briefly in server logs to deliver the page, keep it secure and fix problems.

One Agoo account across our products

If you use more than one of our products (Agoo at work, Agoo Reviews or Agoo Forms), they share one account, and we keep one record of it: when you first came to Agoo, which of our products you use and since when, how you sign in (your email address or mobile number, a password, a passkey, Google, Microsoft or Apple, and when each was confirmed and last used) and a record of security events on it (a sign-in, a way of signing in added, changed or removed, a product started or stopped, a recovery). A sign-in’s event keeps the IP address and the approximate town it points to for 90 days, then only the country and the kind of device. We use it to keep your account secure and to show you, on your own account page, where you use Agoo. Each product keeps its own profile: an organisation sees only what you do in its work apps, never whether you review, make forms or anything else you do with Agoo. Our staff look at it only to help you or protect your account, and each look is recorded. It is deleted with your account.

• Your mobile number: Agoo Reviews already lets you sign in with a mobile number. If you make forms on Agoo Forms, you may also add a mobile number to your account, confirmed by a code we text it, to sign in to our other products and to get back in if you lose access to your email. We check that it is a real mobile number before we text it. Your Agoo Forms account always keeps an email address.
• Changing how you sign in: to add, change or remove an email address or number, you confirm it’s you with a code sent to a way you already sign in, and confirm a new one with a code of its own. If the new one already belongs to another Agoo account, the two accounts are joined only because you proved both are yours, never because two addresses look alike; signing out everywhere then covers both, and nothing in either is moved or merged. You always keep at least one way to sign in.
• Passkeys: where we offer them, you can sign in with a passkey, using your phone’s or computer’s screen lock or a security key. We keep only its public key, the name you give it, when it was added and last used, and a counter that shows if a key has been copied. The private key never leaves your device, and we never see your fingerprint, face or PIN. You can remove a passkey at any time.
• Google, Microsoft or Apple: where we offer it on Agoo Reviews or Agoo Forms, you can continue with Google, Microsoft or Apple. Your browser goes to them to sign in, under their own terms and privacy policies, and they tell us your account’s ID with them, your email address and your name. We keep the link between that account and your Agoo account and note on each sign-in that it was used; we keep no password or token from signing in. If the address is already an Agoo account’s, we don’t link it on our own: you sign in with your code first, then add it.
• Security notices: when a way of signing in is added, changed or removed, a passkey is added or removed, two accounts are joined, you sign out everywhere, or someone starts, finishes or stops a recovery of your account, we tell you at every email address and mobile number you sign in with (and at the old one when it changes), so you hear of it even if one of them is no longer in your hands.
• Getting back in: if you lose one way to sign in, you can recover your account by proving another with a code. To keep you safe, a recovery waits 24 hours while we tell every way you sign in, and signing in with the lost one, or pressing Cancel, stops it. When it finishes, every sign-in on the account ends. We keep a record of each recovery (which kind of sign-in was lost and which proved it, a replacement if you gave one, when, and how it ended) for about 13 months, then delete it.
• One-time codes: for each code we send to confirm a change, a recovery or a second check, we keep which account it was for, whether it went by email or text, when, and whether it was used. The code itself is kept only in a form that can’t be read back, and the address or number it went to is dropped once the code is used or expires. These records are deleted after 45 days.
• Numbers that change hands: mobile networks give numbers that go unused to someone new. So if a number hasn’t been confirmed for about six months, or we learn it has moved to a new SIM, its code alone no longer opens your account: we email you a second code, or, if the number was the account’s only way in, the number is taken off that account and whoever holds it now starts afresh. The old account is kept, and we can help its owner back in with other proof. To do this we keep a note that a number may have changed hands, where the note came from (our support team or the mobile network) and when, for about 13 months.
• Signing out everywhere: you can end your sign-ins on any or all of our products at once, on every account joined to yours; an ended sign-in stops working straight away.
• Protecting sign-in: our sign-in and recovery pages may run a robot check from Cloudflare, which looks at your browser and connection to tell people from automated attacks. To stop guessing, we count recent tries from your connection and against each account and code, and after several wrong ones the next try waits longer; each count, with the connection’s address it was kept under, is deleted about an hour after the last try.
• Breached passwords: when you choose a password, we check it isn’t on public lists of passwords exposed in data breaches. Only the first five characters of a scrambled form of it are sent, never the password, so nobody, us included, learns it, and nothing about you is sent.
• Backup codes: if you make backup codes for two-step verification, we keep them only in a form that can’t be read back, with when they were made and when each was used, until you make a new set or your account is deleted.

Your data across our products

Because your Agoo account is one account across our products, you can use your rights over your data in one place: in the Agoo Console under Your data, and on Agoo Forms and Agoo Reviews under Your data across Agoo.

• See and take it: download, at any time, one file with everything we keep about you as controller across our products: your account and how you sign in, its security record and sign-ins, your choices, your reviews, the forms you made and the forms you answered, verification and anything else you do with us. What an organisation keeps about your work, and the answers you gave to someone else’s form, belong to them: the file names them, and you ask them.
• Your choices: where we would use your data beyond what a product needs to work, we ask you first, or, where we rely on our legitimate interest, let you object. You can change a choice at any time; withdrawing it or objecting stops that use at once, everywhere, including anything one of our products was showing from another on its strength. We keep a record of each choice you make and when, with the version of this notice it was made under, while your account exists.
• Shown from one product in another: when one of our products shows something from another (a business’s public listing, for example, or your reviews, if you choose), it shows only the details set for that use, checks them first under its own rules, and stops showing them as soon as the original changes, is removed, or you withdraw your choice. It keeps no copy of anything else.
• Correct it or ask us: change most of your details yourself where you use us. For anything else (something to correct, a use you object to, a copy of something not in your download, or something to erase) ask us from the same place: because you are signed in, we don’t need more proof of who you are. We answer within 30 days, or 40 for a copy of your data.
• Delete it: delete your whole Agoo account at once, from Agoo Forms or Agoo Reviews, after a code to confirm it’s you. If nothing else needs it, everything goes. If you use it for work, everything personal goes (your reviews, your own forms and everything else you do with us outside work) and the account stays for your work, with what your organisation keeps. A shared workspace that others use and only you own needs another owner first, and an open legal notice about a review must be settled first. We keep decisions about your conduct on our services for up to two years without your words, and anything under a legal hold until it is released.
• Backups: our backups are kept only for a short while. We keep a record that something was deleted (what kind it was and the internal number it had, nothing else) for about 13 months, and a copy of that record outside our main systems, so that if we ever restore from a backup, everything you deleted is deleted again before the service opens.

Verification and the Agoo gold mark

You can ask us to verify you, or an Owner or Admin can ask us to verify their organisation, for the Agoo gold mark. The mark says exactly what we checked and nothing more. We use what you give us only to decide and to show the mark, on the basis of your request (and, for an organisation, our legitimate interest in stopping impersonation).

• Your Ghana Card: we check a person’s Ghana Card only through the National Identification Authority’s verification service, which tells us only whether the card and the details you gave match. Until Agoo is connected to that service, applying with a Ghana Card isn’t open. Nobody at Agoo looks at your card, or at a photo, copy or video of it, and we never ask for one, as the National Identity Register (Amendment) Regulations, 2026 (L.I. 2523) require. If the Authority doesn’t answer, we keep nothing and you can try again. We keep the outcome, and the number only sealed (encrypted) for 30 days after our decision, so a recheck or an appeal needn’t ask for it again, then we delete it. We also keep a one-way fingerprint of the number, which can’t be turned back into it, so that one card can’t quietly verify two people.
• Your age and name: we ask your date of birth and keep only whether you are 16 or 17, or 18 or over. A mark never shows a young person’s name, age or school, and verification can never be bought by anyone under 18. Your legal name is checked only if you ask for the name you use to be shown as matching your card.
• Organisations: we keep the legal and trading names, the registration number where there is one, the role of the person who applied and how they are authorised, and our reviewer’s outcome.
• What we keep, and for how long: each check’s outcome, its method and date, why the mark is free or paid, any restriction and its reason, appeals, and a record of every decision and who made it. We keep these while you have your account (or the organisation uses Agoo), and delete them with it; an organisation’s are in its full export. A mark can be suspended or removed for a good reason, and you can always appeal to someone who didn’t make the first decision.

Amee

Amee by Agoo is our social platform at amee.social, open for now only to people we invite. You sign in with your Agoo account; your Amee profile is separate from Agoo at work, and an employer that uses Agoo never sees it. We use what follows to run your profile and the connections you choose, on the basis of our contract with you, and to keep Amee safe, on the basis of our legitimate interest and our legal duties.

• Your profile: your handle (and, for 30 days after you change it, your old one, so links still reach you), your name and whether it’s your real name, and what you choose to add: a bio, pronouns, a town or area, a link, a photo and a cover. Each version is checked against Amee’s rules before others see it; photos are looked at by a person on our safety team, never by an automated system.
• Your age: we ask your date of birth when you make your profile and keep only whether you are 16 or 17, or 18 or over, and for 16- and 17-year-olds the month they turn 18. Profiles of under-18s are private, and adults they have no connection with can’t find or see them.
• Who you follow and connect with: follows, follow and connection requests, connections, close friends, and the people you block, mute, take a break from or restrict, with when each happened. Muting, breaks and restricting are never shown to the other person.
• Finding people you know: only if you turn it on, people who already have your mobile number or email address can find your profile with it. When you search this way, we turn each number or address you type into a one-way fingerprint, compare it, and keep nothing you typed.
• Your reviews on your profile: only if you turn it on, reviews you’ve published on Agoo Reviews show on your Amee profile. Turning it off takes them all down at once.
• How long we keep it: while your profile exists. You can rest your profile (hidden until you return) or delete it; a deleted profile is gone after 30 days (we hold its handle for a while so nobody can pretend to be you), and deleting your Agoo account deletes it too. Photos you replace or remove are deleted once the time to appeal any decision about them has passed. On a family’s request, confirmed with them, a profile can be kept as a memorial. Your profile and connections are in your data download.

Where our services are available

Some of our services open country by country. Who may use them depends on where you are, never on your nationality: anyone in a country where a service is open can use it, with the same account requirements for everyone. To check, we read the country your internet connection comes from (not your exact location) each time you use the service, and when you join we also check that your mobile number belongs to that country’s numbering plan.

• What we keep: the latest decision only (whether the service is available to you, why, the country we read and when), replaced each time, so we never build a record of where you travel. When you join, or ask us to look again at your location, we also keep the network address and country we saw, for 7 days, to protect the service from abuse. We note which country your account joined from; a trip or a new phone number doesn’t change it.
• If we get it wrong: office networks, private relays and some mobile connections can make it look as if you’re somewhere else. You can ask us to look again, and our staff decide with a note; a mistaken reading is never treated as misconduct. We keep your request for 90 days after it is decided.
• If a service pauses where you are: your account, what you’ve shared and anything you’re owed stay yours; nothing is deleted because a service isn’t available somewhere.
• If a service is full: new people wait their turn on a list, in the order they asked. We keep your place, the country and the date, until you join or close your account.

Cookies and similar technologies

• Our websites set no cookies, except the ones that keep you signed in to Agoo Reviews and Agoo Forms (below), and use no advertising, no tracking pixels and no outside analytics service. Fonts are served from our own site, not from a third party.
• We count visits to our websites ourselves (this website, our developer docs and Agoo Reviews at agoo.reviews), and keep numbers, not people: how many times each page was opened each day, the website a visitor came from, the country our hosting provider works out from the connection, whether the device was a phone, a tablet or a computer, a campaign named in the link, how many times a button to get one of our apps was pressed, and how many downloads of our Android apps were started, with the page each started from. On Agoo Reviews, a reviewer's profile is counted as one page for all profiles, never by person. To count different visitors in a day, we use a one-way code made from your connection and your browser. It is scrambled with a key that we delete after a day, so it can’t be used to follow you from one day to the next, and it doesn’t identify you. We keep neither your IP address nor your browser’s details with these numbers, and nothing is stored on your device for them.
• The website stores one setting in your browser’s local storage: whether you chose the light or dark theme. It stays on your device, and you can clear it in your browser’s settings at any time.
• The Agoo console and apps use cookies and device storage that are strictly necessary to keep you signed in and secure, to keep what you have typed but not yet saved (see drafts), and, on kiosks and staff apps, to keep working offline. The visitor pages set no cookies. They use your browser’s storage only to keep a form you are filling in, for up to 24 hours, and, once you confirm a code on a Guest Wi-Fi poster, to show you the Wi-Fi until you check out. A front-desk computer that an organisation uses as an Agoo kiosk keeps its own device key in the browser, and never anything a visitor types.
• Agoo Reviews widgets on a business's own website (its rating badge, its latest reviews or a review form) set no cookies, store nothing on your device and count no one, and they load from agoo.reviews without passing on the page you were reading.
• If you sign in to Agoo Reviews, agoo.reviews keeps your sign-in in strictly necessary cookies that only that site can read (scripts on the page can’t), until you sign out, for up to 30 days, ending sooner after 14 days unused.
• On agooforms.com, makers who sign in are kept signed in by strictly necessary cookies that only that site can read (scripts on the page can’t), for up to 30 days, ending sooner after 14 days unused, with one more that remembers the workspace they last opened. The pages of a form to answer, and forms on other websites, set no cookies: they use your browser’s storage only to keep what you are typing, for up to a day.
• The emails our website forms send don’t track whether you open them or which links you click.

If we ever add analytics or other non-essential cookies, we will update this notice first and ask for your consent where the law requires it.

5. If your organisation is an Agoo customer

• Account details: the names, work email addresses, phone numbers, roles and sites of your administrators and users; sign-in records; two-step verification (including when backup codes were made and used) and single sign-on settings; and each user’s console appearance (light, dark or same as their device).
• Sign-ins: for each time someone signs in, the part of Agoo they used, the kind of browser or device and its system (such as Chrome on Windows or an iPhone; never the device’s own name), the IP address, the approximate town and country it points to, and when it was first and last used. We use these to keep each sign-in to its time limit, to show people and their organisation’s Owners and Admins where they’re signed in so they can end it, and to warn people by email and on their phone when their account is used on a new device. They’re kept for 90 days after the sign-in ends, then deleted.
• Signing in with Google or Microsoft: if your organisation allows it and you choose Continue with Google or Continue with Microsoft, your browser goes to Google or Microsoft to sign in, under their own terms and privacy policies. They tell us your account’s ID, your name, your email address and whether they have confirmed it belongs to you; for a Google Workspace account, its domain; for a Microsoft work or school account, which organisation it belongs to. We ask only for that basic profile: never your mail, contacts, files or calendar (connecting a calendar is separate, and your choice: see Connected calendars and meeting links), and we keep no Google or Microsoft password or token from signing in. We keep the link between that account and your Agoo account (its ID, organisation or domain, email and kind, when it was added and last used), and note on each sign-in that it was made with Google or Microsoft. The first time, we link it on our own only when Google or Microsoft confirms the email equals your Agoo account’s; otherwise you add it yourself from Sign-in and security after confirming it’s you. If you start an organisation by signing up with Google or Microsoft, we make your Agoo account from the name and email address they confirm (only for a work account whose email they confirm), that email becomes your Agoo email, and we keep a record of when the account was made and with which provider; you then set a password and two-step verification as the Owner. We email you whenever one is added or removed. Your organisation’s Owners and Admins can see which Google or Microsoft accounts you sign in with, and may require them; they never see more. You can remove a link at any time (an Owner keeps their password and authenticator), and it is deleted with your account. Agoo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Agoo does not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• Billing details: your organisation’s name, address and tax details (including a TIN you add), invoices, receipts and payment records, bank-transfer references and purchase-order numbers, and any proof you send with an offer application (such as a registration certificate), kept privately and seen only by Agoo’s platform owner. Card and Mobile Money payments are handled by Paystack; we never receive or store full card numbers or Mobile Money PINs. For a saved card we keep its type, issuing bank, last four digits and expiry date, and, to renew with it, Paystack’s authorisation for it (encrypted), its signature and the email it was paid with. When you remove the card in Billing, or replace it with another, the authorisation, signature and email are deleted; the card type, bank, last four digits and expiry stay with the payment records they belong to.
• Support: what you tell us when you ask for help. If our support team needs to look at your organisation’s data to help you, that access is read-only, time-limited and given a reason; your organisation’s Owners are told when it begins and can end it, changes need an Owner’s approval, and every view and change is recorded in your audit trail. In an emergency that can’t wait (for example, nobody can sign in, or a security incident), our platform owner may act without prior approval after checking the request through contact details we already hold; your Owners and Admins are told at once and receive a written report within 72 hours.
• Account recovery: if you lose access to your two-step verification, the request, the email address it was confirmed from, who approved it and how they checked it was you (for example, in person or on a video call, with a note of the kind of identity document seen, never a copy of it; we never check a Ghana Card by looking at it). If your organisation’s Owner has gone and we are asked to appoint a new one, a description of the evidence we were shown and how we checked it. These are kept with your organisation’s audit trail.
• Feedback you send Agoo: if you tell us what you think of Agoo (from the menu in Agoo, from an occasional question on its Home page, or from the link at the foot of our emails), we keep your rating, the part of Agoo it’s about, your comment, the page you sent it from and the app’s version, with your name, role and organisation. Only Agoo’s own staff read it: your organisation can’t, not even in its data export. Two choices are yours, and both start unticked. If you say we may contact you, we reply to your sign-in email address. If you say we may quote you, we first send you the exact words, with the name and role we’d show, to approve or decline in Agoo; we use a quote only once you approve it, and stop if you withdraw your approval. Owners and Admins are asked how likely they are to recommend Agoo at most once every 90 days, never in their first 30 days, and whoever sets up an organisation is asked once how easy it was; you can close either question without answering. Please don’t include visitors’ or colleagues’ personal details in your comments.
• Agoo Reviews for your organisation: your team's replies to reviews (published under your organisation's name) and flags, with who made them, in your audit trail; the AI reply drafts and review summaries your team asks for, kept for a year, during which your page says it may use AI-assisted replies; and the emails about your page: a weekly overview every Monday to the people whose role can see it, and a monthly report with the paid review tools. Each email has a one-click stop link, and anyone can turn it back on in Public reviews; we keep only a scrambled form of each stop link, for 120 days.
• Unsaved work (drafts): so that a power cut, a dropped connection or a closed tab doesn’t lose what you are typing in Agoo, it is kept as you type in your browser or the Agoo app on that device, until you save or discard it. It belongs to you in the organisation you are working in, so nobody else who signs in on the same device sees it, and it is removed from the device when you sign out or someone else signs in there. In larger editors, such as the visitor form builder and the QR code studio, your work in progress is also saved to your account every few seconds, so you can continue on another device. These drafts are your personal working copies: only you can see them, not your organisation’s Owners or Admins, they aren’t part of your organisation’s data export, and they are deleted when you leave the organisation or your account is deleted. Drafts that contain visitors’ details are kept for at most 7 days, and others for at most 30 days. Passwords, one-time and two-step codes, card, bank and Mobile Money details, keys and secrets, protected answers, and photos and files are never kept as drafts.
• Usage and device data: which features are used, usage against your plan’s limits (such as messages and AI credits), API request logs, and the health of paired kiosks (model, operating system, app version, battery, connectivity and last sync).

We send account holders service messages about billing, security, and changes to Agoo or these documents, and we email Owners and Admins about planned maintenance and anything their organisation needs to do. These aren’t marketing, so they continue while you have an account. Some end with a link to tell us how Agoo is working for you; using it is up to you. News about Agoo’s features is shown only inside Agoo, and we keep a note of which announcements you’ve read or closed so they don’t show again; it’s deleted with your account.

Connected calendars and meeting links

If your organisation’s plan includes it and its Owners or Admins allow it, you can connect your own Google account, Microsoft 365 or Outlook.com account, or Zoom account to Agoo, in Your account → Calendars. You choose to connect, on Google’s, Microsoft’s or Zoom’s own page, and you can disconnect at any time. The connection is yours: if you work with more than one organisation on Agoo, each uses it only as far as its own settings allow, and none of them can see what is in your calendar.

• What Agoo asks for. From Google: to see your list of calendars, to see when you are free or busy, and to add, change and remove events. From Microsoft: access to your calendars, which Agoo uses only to see when you are busy and to add, change and remove its own events, with their Teams meetings. From Zoom: to make, read, change and remove meetings, and to read your Zoom profile. From each, your account’s name and email address, so you can tell your connections apart. Agoo never asks for your email, contacts, files, chats or recordings.
• What Agoo reads and keeps. The account’s name and email address, and whether it is a work or personal account; the list of your calendars, with each one’s name and colour, so you can choose which count; from the calendars you choose, only the start and end of each time you are busy (and whether it is marked tentative or out of office), never titles, descriptions, places or who is invited; and, for the events and Zoom meetings Agoo makes for your bookings, the IDs Google, Microsoft or Zoom give them and the meeting link. Busy times are deleted a day after they end, at once when you disconnect, and a day after a connection stops working. The record of an event or meeting Agoo made is kept with its booking, for as long as your organisation keeps its bookings.
• What Agoo adds to your calendar. When a booking with you is confirmed, Agoo adds it to the one calendar you chose, saying as much as your organisation allows (the guest’s name, the kind of booking and where; also their company; or only “Agoo booking”), with a link back to Agoo, and moves or removes it when the booking changes. If the booking type makes video meetings, Agoo adds a Google Meet or Microsoft Teams meeting to the event, or makes a Zoom meeting in your account with its waiting room on and recording off. Agoo only changes the events and meetings it made, and doesn’t invite the guest from your calendar.
• Keeping your access safe. The tokens Google, Microsoft and Zoom give Agoo are encrypted with a key kept only for them, bound to your connection, and never shown to anyone, your organisation’s Owners and Admins and Agoo’s support team included. Your organisation’s Owners, Admins, HR and site admins can see whether you have connected and whether it is working, never what is in your calendar.
• Disconnecting. When you disconnect, Agoo stops reading your calendars at once, deletes your busy times and calendar list, removes the future events and meetings it added if you ask it to, and gives up its access. Google and Zoom withdraw it when Agoo asks; Microsoft offers apps no way to do that, so remove Agoo in your Microsoft account too (at myaccount.microsoft.com for a work or school account, or account.live.com/consent/Manage for a personal one). Your tokens are deleted at once, and the note that the account was connected (its provider, name and email address) 30 days later. If you remove Agoo in Zoom, Agoo deletes your Zoom connection at once. If you remove it in Google or Microsoft, or change your password there, Agoo finds out the next time it looks and emails you to reconnect, at most once a week for a month.

Google user data. Agoo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Agoo does not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.

Microsoft and Zoom. Microsoft and Zoom hold the events and meetings Agoo adds to your account as your own providers, under your agreement with them and their privacy policies; they are not Agoo’s sub-processors. Agoo uses what it receives from Google, Microsoft and Zoom only to provide these features to you and your organisation: never for advertising, never sold, and never to train AI models.

Your private calendar link

On every plan, you can make a private link that shows your Agoo diary in Apple Calendar, Google Calendar, Outlook or another calendar app: for the past 30 days and the next 180, the bookings you take, the visitors you are expecting and your approved leave, saying as much as your organisation allows, and never anyone’s phone number or email address. Anyone who has the link can read it without signing in, so keep it to yourself: if you think it has been shared, get a new link in Your account → Calendars, and the old one stops working at once. Your calendar app fetches the link from Agoo on its own timetable, and its copy is held by that app’s provider under its own terms. Agoo keeps the link encrypted so you can copy it again, notes when it was last used and by which calendar app, and keeps an ended link’s record for 90 days. A link stops when you leave the organisation, or if the organisation switches private links off.

6. Why we use personal data and our lawful bases

Act 843 allows personal data to be processed with the person’s consent, or without it where processing is necessary for a contract they are party to, is required or authorised by law, protects their legitimate interest, is needed for a statutory duty, or is necessary for the legitimate interest of the controller or a third party to whom the data is supplied (section 20).

When we process visitor and staff data as a processor, the customer organisation is responsible for having a lawful basis, and we act only on its instructions. That includes its invitations to review it on Agoo Reviews: messages about a real visit, booking or purchase, sent in its name with a way to stop them, never marketing.

7. Agoo AI and automated decisions

• AI is optional and off by default. Agoo AI (asking questions about your data, reading IDs the kiosk can’t read itself, never a Ghana Card, digitising paper logbooks and drafting) is arriving in stages. Nothing is sent to an AI model until an organisation’s administrator turns it on.
• Agoo Reviews. Every review written on agoo.reviews is read by Anthropic’s Claude against our guidelines before it appears (see section 4). The AI can only pass a review on or hold it for a person: a person makes every decision to remove one, and you’re told why.
• Reply drafts and summaries on Agoo Reviews. When a business asks, from its AI credits, Anthropic’s Claude drafts a reply to a review or summarises the business’s reviews. It is sent the business’s name and kind, the reviews’ stars and words, any reply already posted and a note from the business, never a reviewer’s name or contact details. What it writes is a draft the business reads, changes and posts itself; the AI never posts anything. A business that has drafted a reply with AI in the last 12 months shows “May use AI-assisted replies” on its page.
• Parcel labels. When an organisation turns on reading labels with AI, Anthropic’s Claude reads the photo of a parcel’s label and returns what it says: who it’s for, their organisation or department, the tracking number, the courier, the sender and what it is. Agoo matches that against the organisation’s directory and suggests who the parcel is for; a member of staff always chooses. Only the label photo is sent, never the parcel’s other photos, the courier’s details or the directory. Each reading uses one of the organisation’s AI credits.
• Form drafts on Agoo Forms. When a maker asks, from their AI credits, Anthropic’s Claude drafts a form from their description and who it’s for. It is sent only those words, never anyone’s answers to a form. What it writes is checked like any form and is a draft the maker reviews, changes and publishes themselves; the AI never publishes anything. It won’t draft forms that ask for passwords, PINs or card numbers. We keep the description and the draft for 30 days to look into abuse, then delete them.
• Safety checks on Agoo Forms. When a new workspace publishes a form, and for some others such as reported ones, Anthropic’s Claude reads the form’s words against our safety policy within a minute: its title, description, questions, options and endings, and who it says it’s from, never anyone’s answers. Agoo pays for it, so it uses no AI credits. The AI can only let a form carry on or hold it for a person: it never takes a form down or restricts a workspace. People on our safety team make every decision, and makers can appeal it.
• Provider. Agoo AI uses Anthropic’s Claude models. We send only what each task needs, and remove phone numbers, ID numbers and other personal details where the task doesn’t need them.
• No training. Customer data is never used to train AI models, ours or anyone else’s. Anthropic’s commercial terms do not allow it to train models on customer content sent through its API.
• People decide. Agoo doesn’t make decisions that significantly affect people based solely on automated processing. AI never denies entry, adds anyone to a watchlist or approves a visit. Watchlist matches and AI suggestions are shown to a person, who decides. Face clock-in either finds a confident match or offers another way to clock in, which a supervisor reviews; it never guesses.
• Assistants you connect. If an organisation connects its own AI assistant to Agoo (through our planned MCP server), data the assistant reads goes to that assistant’s provider under the organisation’s own agreement with it, not ours.

Under section 41 of Act 843 you can ask that a decision which significantly affects you is not based solely on automated processing, and ask for such a decision to be reconsidered.

8. Who we share personal data with

• Sub-processors who run parts of Agoo for us, such as hosting, email, SMS, WhatsApp, payments and AI. They may use the data only to provide their service to us, under written contracts that require confidentiality and security. The current list, with what each does and where, is on our sub-processors page.
• The organisation you visit or work for, which controls the data it keeps in Agoo.
• Google, Microsoft or Apple, only if you sign in with them: you sign in on their pages, under their own terms, and we send them nothing about you (see Signing in with Google or Microsoft and one Agoo account across our products).
• Google, Microsoft or Zoom, only if you connect your calendar or Zoom account: Agoo adds your bookings’ events and meetings to your own account there, under your agreement with them (see Connected calendars and meeting links). A guest’s name may appear in those events, as your organisation’s settings allow.
• Apple or Google, only if you add your pass to their wallet, under their own terms (see Adding your pass to Apple Wallet or Google Wallet).
• Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities, when the law requires it, such as a court order or a regulator’s lawful request. We check that each request is lawful and limited to what it needs, and, for customer data, tell the customer unless the law forbids it.
• A successor, if the Agoo business is reorganised or transferred. The data would stay protected by this notice and our agreements, and we would tell customers first.

We do not sell personal data, and we do not share it for advertising.

9. Where data is stored and international transfers

Agoo’s primary data is stored in the United Kingdom. Files such as photos and signatures are stored in Western Europe, and offline working for Agoo’s apps runs in the European Union. Some providers are elsewhere: email, AI and push notifications are delivered by providers in the United States, WhatsApp runs on Meta’s global infrastructure, SMS is sent through Hubtel in Ghana, and payments through Paystack in Ghana and Nigeria. The sub-processors page lists each location. A pass you choose to add to Apple Wallet or Google Wallet is held by Apple or Google on their own infrastructure, which may be anywhere in the world, as are the events and meetings Agoo adds to a Google, Microsoft or Zoom account someone connects.

When personal data leaves Ghana, we protect it with:

• written contracts with each provider that require confidentiality and appropriate security, and limit use to providing their service;
• encryption in transit (TLS) and at rest;
• access controls, so only people and systems that need data can reach it;
• sending only what each provider needs, for example removing personal details from AI tasks where they aren’t needed.

You can ask us for more information about the safeguards for a particular provider.

10. How long we keep personal data

Deleted data can remain in our encrypted daily backups until those backups expire on their normal cycle, within a further 30 days. We don’t restore deleted data from backups except to recover from an incident, and if we ever do, we delete it again.

11. How we protect personal data

Act 843 requires us to keep personal data secure with appropriate technical and organisational measures (section 28). Agoo is designed with:

• encryption in transit (TLS) and at rest, with ID numbers encrypted individually;
• tenant isolation: every record carries its organisation’s ID, and the database itself refuses to show it to anyone else;
• roles and site permissions, so people see only what their job needs;
• two-step verification for administrators, and mandatory two-step verification for Nkonso staff with access to internal systems;
• a tamper-evident audit trail of views, exports and changes, including any access by our support staff;
• least-privilege access to production systems, secrets kept out of code and scanned for automatically, and daily backups.

More detail is on our security page. No system is perfectly secure. If a security compromise affects your data, we will tell you and the Data Protection Commission as section 31 of Act 843 requires; for data we process for a customer, we tell the customer without undue delay and help it notify the people affected.

12. Your rights

Under Act 843 you can:

• Access your data: ask whether we hold personal data about you, what it is, why we use it and who we have shared it with, and get a copy in a form you can understand (sections 32 and 35).
• Correct or delete data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and ask us to delete data we are no longer entitled to keep (section 33).
• Object to our processing and ask us to stop (sections 20 and 39).
• Stop direct marketing at any time (section 40).
• Challenge automated decisions that significantly affect you (section 41).
• Withdraw consent where we rely on it, without affecting what we did before.
• Seek compensation if you suffer damage because we fail to comply with the Act (section 43).

To use a right, ask us online: confirm your email with a code, and we answer you by email. You can also email agoo@ardentafrica.com with “Privacy” in the subject, or write to us at the address in section 16. We will ask you to prove your identity before we share or change anything. We don’t normally charge, and we reply as soon as we can: within 30 days, or 40 for a copy of your data (section 35). If a request is complex, we will tell you why we need longer.

For data an organisation keeps about you in Agoo, contact that organisation first: its visitor pages have a Your data link in every footer, and if you work there, the Agoo Workspace app shows your HR record under My record, where you can ask HR to correct it. If you contact us, we will pass your request on and help the organisation answer it.

For your answers to a form on Agoo Forms, use Your data on the form: it goes to the form’s maker, who answers within the same times. If they don’t, we follow it up and help you; write to us with your reference. About your Agoo Forms account, a report you made or our safety records, ask us as above.

13. If you are outside Ghana

Act 843 requires personal data of people from other countries to be processed in line with the data protection law of their country (section 18). If you are in Nigeria (Nigeria Data Protection Act, 2023), Kenya (Data Protection Act, 2019), the United Kingdom or the European Union (UK GDPR or GDPR), or another country with a data protection law, you have the rights that law gives you, and you can use them by contacting us as described above. For customers outside Ghana, we support their own compliance under the data processing agreement.

14. Children and special personal data

Our websites and customer accounts are for adults acting for organisations, and we don’t knowingly collect children’s data for our own purposes. If we learn that we have, we delete it.

Some organisations use Agoo in ways that involve children or sensitive data. A school may record pupils and the people allowed to collect them; a church may record children at check-in, and its attendance records can reveal religious belief; a hospital’s visitor records can suggest something about a patient’s health; and an employer's leave certificates, such as medical notes, and a disability a member of staff chooses to declare on their HR record, are about their health (see section 3and HR records). Act 843 treats data about a child under parental control, and data about religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life or criminal behaviour, as special personal data, which may be processed only where it is necessary or the person consents (section 37). The organisation is responsible for meeting those conditions, including parental consent where it is needed; Agoo helps by limiting who can see such records and keeping them only as long as the organisation sets.

On Agoo Forms, the maker of a form is responsible in the same way: our acceptable use policy requires a parent’s or guardian’s consent before a form collects a child’s details, and a lawful reason before it collects special personal data. A report about a child’s safety goes to the front of our safety team’s queue and stops the form taking answers while a person looks.

15. Marketing

We send product news only to people who have agreed to receive it, and every message has a way to stop. We never use visitor or staff data held in Agoo for our own marketing, and we never sell it. Service messages about your account aren’t marketing.

16. Contact us and complaints

For questions or requests about privacy, contact us:

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Data Protection Commission, Ghana’s data protection regulator, at dataprotection.org.gh. If you live elsewhere, you can also complain to the data protection authority where you live.

17. Changes to this notice

We will update this notice when our services or the law change, and show the new date at the top. If a change materially affects how we use personal data, we will tell customers by email or in the console at least 30 days before it takes effect. Earlier versions are available on request.