Privacy Policy

1. Objective & Regulatory Alignment

Welcome to Fafa. Fafa is an anonymous wellbeing platform that gives people a safe place to express what they are going through. Users can connect with a caring community, access practical coping resources and speak with licensed therapists when they need professional support. Fafa is built around psychological safety: people should feel able to talk without fear of judgment, exposure or shame.

Operated by FAFA AI Technology Ltd, a registered company in Ho, Volta Region, Ghana, FAFA AI Technology Ltd serves as the primary Data Controller under the Ghana Data Protection Act, 2012 (Act 843). This Privacy Policy explains in plain, transparent language how we handle your information, safeguard your privacy rights, and maintain a secure digital environment for users regionally and globally.

2. Legal Definitions

To ensure absolute clarity, the following statutory terms are adopted in accordance with Section 96 of Act 843:

• Data Controller: The entity that determines the purposes and the overall means of processing personal data. For Fafa, FAFA AI Technology is the Data Controller.
• Data Processor: Any natural or legal person, other than an employee of the Data Controller, who processes personal data strictly on behalf of and under the documented instructions of the Data Controller.
• Data Subject: The living individual who is the subject of the personal data processed. This includes Platform users, peer mentors, and licensed counselors.
• Personal Data: Any data relating to an individual who can be identified directly or indirectly from that data, or from that data in conjunction with other information in the possession of the Data Controller.
• Special Personal Data: Historically referred to as sensitive personal data, this includes statutory classes under Section 37 of Act 843, specifically health status, mental condition, DNA, racial or ethnic origin, religious beliefs, sexual life, or criminal records of an individual.

3. The Principles That Guide Us

When we collect, store, process, and handle your information, we are guided strictly by the law to protect your personal information. In accordance with Section 17 of the Ghana Data Protection Act, 2012 (Act 843), our service is governed by these core principles:

• Lawfulness, fairness, and transparency: We only process your personal information in a way that the law permits, and we are always open, fair, and transparent about how we handle your information.
• Purpose limitation: We only collect and process personal information for the specific, explicit, and legitimate reasons we tell you about before we collect it.
• Data minimization: We do not collect more information than we actually need to serve you. We keep our data collection strictly minimized to protect your identity.
• Accuracy: We ensure that any personal information we hold about you is accurate, complete, up-to-date, and not misleading.
• Storage limitation: We do not store your personal information for longer than necessary to fulfill the specific purpose for which it was collected or as permitted by law.
• Integrity and confidentiality: We implement reasonable administrative, technical, and physical precautions to secure your data and protect it against unauthorized access, loss, or misuse.

4. The Information We Collect

We believe in strict data minimization. Depending on how you interact with Fafa, we collect the following limited categories of information:

• Account Linking & Authentication Metadata: When you create an account, we collect your account email address, age and gender and a secure, hashed password strictly to link, hook, and authenticate your account on your device and enable password recovery. We do NOT collect your real name, phone number, or offline street address.
• System-Assigned Pseudonym & Avatar: Fafa automatically assigns every user the pseudonym "Norvi" for community interactions. Users do not choose their pseudonym but may select their avatar.
• Voluntary Wellness & Community Inputs: Text entries, venting posts, and comments you voluntarily share in the anonymous community venting space.
• Voluntary Therapy & Booking Inputs: Information you voluntarily provide when scheduling a session with a licensed counselor, including preferred appointment times and voluntary intake responses.
• Technical Diagnostics & System Telemetry: Automatic, temporary technical metadata (such as device telemetry, app crash diagnostics, and temporary IP address caches) processed by our cloud hosting infrastructure strictly to maintain server stability, prevent automated spam, and protect platform security.

5. How We Process Your Personal Information

We use the information we collect strictly for the following operational purposes:

• Account Management: To establish your pseudonymous account, authenticate your sign-ins, and allow secure password resets via your registered email.
• Facilitating Peer Support: To display your voluntary venting posts and comments under your chosen screen pseudonym in the community space.
• Connecting You with Licensed Therapists: To process private booking requests and connect you with certified mental health professionals.
• Maintaining Platform Security: To detect system errors, block malicious bot attacks, and safeguard platform integrity.

6. How We Share Your Personal Information

We do NOT sell, rent, monetize, or commercially trade your personal data under any circumstances. Information is shared only in the following controlled operational contexts:

• With Licensed Therapists: Verified counselors receive only your system-assigned pseudonym "Norvi," age group, and the voluntary intake forms you explicitly choose to submit for a booking.
• With Payment Processors (Paystack): For paid consultations or premium organizational dashboards, financial transactions are securely processed by Paystack (Merchant Provider). Paystack receives standard financial transaction tokens only. Paystack NEVER receives access to your mental health chats, venting posts, or counseling notes.
• With Institutional Partners: Schools or NGO sponsors receive ONLY aggregated, fully anonymized statistical reports (e.g., total platform usage count). Individual user profiles, messages, and counseling bookings are strictly decoupled from institutional join codes.

7. How We Protect Your Information

We are dedicated to safeguarding the confidentiality and integrity of your data. FAFA AI Technology Ltd implements reasonable administrative, technical, and physical security measures to help prevent unauthorized access, alteration, disclosure, or destruction of your personal information.

We strictly restrict access to your personal details to our designated employees, verified counselors, and engineers who have a direct, professional need to handle the data to deliver our services. All personnel with data access are bound by strict, contractual confidentiality obligations and are subject to severe disciplinary proceedings, termination, or referral to law enforcement if they fail to respect your privacy.

Please be aware that while we take reasonable, proactive precautions to secure our systems, no digital platform or data transmission over the internet can be guaranteed to be 100% secure. We urge you to use strong, unique passwords for your Fafa account and to avoid sharing your login credentials with anyone.

8. How Long We Retain Your Information

We do not retain your personal information for longer than necessary to fulfill the specific well-being and administrative purposes for which it was collected:

• Venting & Forum Posts: Your user-generated venting posts and comments are retained on our active servers until you choose to delete the post, close your account, or request its erasure.
• Technical Server Logs: Standard platform logs hosted on Supabase Cloud are retained temporarily for operational security (typically up to 180 days based on platform defaults), after which they are systematically purged or overwritten.

9. Crisis Support & Emergency Helpline Architecture

Fafa is an anonymous well-being platform, not an emergency psychiatric hospital. To protect life safety while maintaining user privacy, our emergency features operate through specific technical channels:

• AI Chat Keyword Detection: Inside the AI Chat feature ('Talk to Fafa'), automated crisis keyword detection (detectCrisis) scans chat messages for severe distress indicators (e.g., self-harm or suicidal intent). When detected, the app automatically overlays a localized emergency banner: 'You're not alone. 💚 Ghana Crisis Line: 0800-111-909' and prioritizes human crisis support guidance.
• Community Venting Space: In the public peer venting feed (/rants), escalation relies on community post reporting and manual flagging by platform moderators. There is no automated real-time keyword pop-up in the venting feed.

10. Cloud Infrastructure & International Data Transfers

To ensure high availability and robust data resilience, Fafa's backend databases and API endpoints are hosted on international cloud infrastructure via Supabase Cloud on Amazon Web Services (AWS Europe, eu-west-1 region, located in Ireland).

In accordance with Section 18 of Act 843 regarding cross-border data processing, FAFA AI Technology Ltd ensures that our international cloud hosting partners maintain strict ISO/IEC 27001 and SOC 2 security certifications and execute industry-standard data protection agreements that safeguard user records to Ghanaian statutory standards.

11. Consents and Minor Safeguarding

Fafa is designed for individuals aged 13 and above. Protecting the emotional well-being and privacy of young people is central to our mission:

• Pseudonymous Registration for Minors: Because Fafa is completely anonymous and collects ONLY email addresses, age and gender, which is strictly for account linking and authentication (no real names, phone numbers, or physical addresses), we do not require a forced parental consent verification screen at sign-up. This low-barrier, anonymous access ensures that young people in distress can safely seek emotional support without fear of social exposure, stigma, or judgment. All users are automatically assigned the pseudonym "Norvi." Users do not choose their own pseudonym but may select their preferred avatar.
• Institutional & School Settings: When Fafa is introduced through secondary schools or youth organizations, institutional administrators coordinate parental information and counseling disclosures in accordance with standard student welfare policies.

12. Know Your Rights

Under Sections 32 through 35 of the Ghana Data Protection Act, 2012, all users possess enforceable privacy rights:

• Right to Access (Section 32): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Section 34): You have the right to request the correction of inaccurate profile metadata.
• Right to Erasure (Section 33): You may request the deletion of your account and venting history.
• Statutory Response Window: In compliance with Section 39(2) of Act 843, FAFA AI Technology Ltd will respond to all verified data subject requests within twenty-one (21) working days.

Profile Controls & Account Email Note: You cannot change your system-assigned pseudonym "Norvi." You can change your visible avatar anytime within your profile settings. Please note that your account email address is fixed upon account creation to maintain account linking integrity. If you require an email change or account deletion, please contact support@usefafa.com

13. Your Privacy Controls

We put the controls directly in your hands. You can limit how we use your personal information at any time:

• Post Deletion: You can delete any venting posts or comments you have shared in our public forums directly from the application's interface.
• Profile Customization: You can easily change your visible screen pseudonym.
• Avatar Customization: You can select and change your visible avatar within your profile settings. Your pseudonym is automatically assigned as "Norvi" and cannot be changed.

14. Click Through To Other Websites

This privacy policy applies strictly and exclusively to the Fafa platform. If you click through to other websites, you should ensure that you read the privacy policy that applies to that specific website before submitting any personal information.

15. Updating Our Privacy Policy

FAFA AI Technology Ltd reserves the right to modify, update, or replace this Privacy Policy in whole or in part at any time. Only the Board of Directors of FAFA AI Technology Ltd may approve an official update to this policy. The current version of our privacy policy is always the version published on useFafa.com and within our application settings, and you will be bound by the contents of the policy on the day you access the platform. We encourage you to read this privacy notice carefully each time you engage with our services.

16. Contact Us

If you have any questions or comments about this Privacy Policy, wish to submit a Data Subject Access Request, or want to exercise your rights under Act 843, please do not hesitate to reach out to us:

Email: support@usefafa.com

Phone: +233 598 961 657

Physical Address: FAFA AI Technology Ltd, Togbe Tawiah Building, Ho, Volta Region, Ghana.