Privacy Policy
What BrandGora collects about you, why, who else sees it, and what you can ask us to do with it.
Last updated 18 September 2026
1. Who is responsible for your data
BrandGora is the data controller for the personal data described here. We operate from Ghana and handle personal data under the Data Protection Act, 2012 (Act 843).
For anything in this policy, write to privacy@brandgora.com.
2. What we collect
What you give us
- Your name, email address, country and — if you provide one — your phone number.
- Your password, stored only as a cryptographic hash. We never hold the password itself.
- Creator profiles: date of birth, gender, location, industry, content types, languages, rates, biography and social usernames.
- Brand profiles: company name, industry, size, website, location and logo.
- Campaign briefs, applications, deliverables you upload, and the messages you send on the platform.
What we generate
- Your wallet balance, escrow records and a ledger of every movement of money.
- Notifications raised by things that happen to your work.
- Records of moderation decisions, including suspensions and the reasons for them.
What we collect automatically
- Session records: the IP address and browser you signed in from, and when you were last active. We use these to keep accounts secure and to expire stale sessions.
- Sign-in and password-reset attempts, counted so we can rate-limit them.
What we get from others
- If you sign in with Google, we receive your email address and name from Google. We do not receive your Google password.
- Paystack tells us whether a payment succeeded and gives us a reference for it. Your card details go to Paystack, never to us — we do not receive or store them.
3. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Running your account and the campaigns you take part in | Performance of our contract with you |
| Holding funds in escrow and paying them out | Performance of our contract with you |
| Verifying your email, and rate-limiting sign-in attempts | Our legitimate interest in keeping accounts secure |
| Settling disputes between a brand and a creator | Our legitimate interest in a marketplace that works |
| Keeping financial records and meeting tax obligations | Legal obligation |
| Telling you about things that happened to your work | Performance of our contract with you |
4. What other people see
A creator profile has a public page at /creators/your-username,
readable by anyone without signing in. It shows what you put in your profile. It does not
show your email address, your phone number, your wallet or your earnings.
Within a campaign, the brand and the creator see each other's names, the messages between them and the deliverables submitted. Brands browsing for creators see creator profiles.
BrandGora staff can see accounts, escrows, payments and wallet balances in order to settle disputes and investigate fraud. They cannot read your password, and they cannot edit your profile on your behalf.
5. Who we share it with
We use a small number of processors, each for one job:
- Paystack — processing payments and payouts.
- Resend — delivering email, such as verification codes and password resets.
- Google — only if you choose to sign in with Google.
- Our hosting and database providers, which store the data described here.
We share data with them only so they can do that job. We do not sell your personal data, and we do not share it for anyone else's advertising.
We will disclose data where the law requires it, or where it is necessary to establish or defend a legal claim.
6. Where your data is held
Our providers may store or process data outside Ghana. Where that happens, we take reasonable steps to ensure the recipient protects it to a standard comparable to Act 843.
7. How long we keep it
- Account and profile data — while your account exists, and for a reasonable period afterwards.
- Financial records — payments, escrows and ledger entries are kept for as long as accounting and tax law requires, even after an account closes. These we cannot delete on request.
- Messages and deliverables — kept while they may be needed to settle a dispute about the campaign they belong to.
- Session records — expired sessions are destroyed rather than kept.
- Verification codes — short-lived, and cleared once used.
8. Your rights
Under Act 843 you may ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything inaccurate — much of it you can edit yourself in your profile;
- delete data we no longer have a lawful reason to keep;
- stop processing that relies on our legitimate interests, where your rights outweigh them.
Write to privacy@brandgora.com and we will respond within the time Act 843 allows. If you are not satisfied with how we have handled a request, you may complain to Ghana's Data Protection Commission.
9. Cookies
We use cookies that the platform needs to function: one that keeps you signed in, and one that protects forms against cross-site request forgery. Both are restricted to this site. We do not use advertising or cross-site tracking cookies. Blocking the essential cookies will stop you being able to sign in.
10. Security
Passwords are stored hashed. Traffic is encrypted in transit. Sessions expire, and are destroyed rather than left to be reused. Sign-in and password-reset attempts are rate limited. No system is perfectly secure, and we do not claim otherwise — if we discover a breach affecting your personal data, we will tell you and the Data Protection Commission as Act 843 requires.
11. Children
BrandGora is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.
12. Changes to this policy
We may update this policy. Where a change materially affects how we handle your data, we will tell you. The date at the top of this page is when the text last changed.