Privacy Policy

1. Who this policy is for, and who controls what

DuesFam is operated by Breezy ArtDrop Studios Ltd. ("DuesFam", "we", "us"), a company based in Accra, Ghana. This policy covers duesfam.com, the DuesFam web app, and the member portal.

Two different kinds of people appear in DuesFam, and the law treats them differently:

• Account holders — the treasurer, secretary or admin who signs up, creates an organisation and enters records. We are the data controller for their account data. This policy governs that relationship directly.
• Members — the people an organisation tracks. Members usually do not sign up themselves; their names, phone numbers and payment records are entered by their organisation. For that data, the organisation is the data controller and DuesFam is a data processor. We hold and process member records on the organisation's instructions, and we do not decide what is collected or why.

2. What we collect

Account data (you give us this)

• Email address — required to sign in
• Name and profile photo, if you sign in with Google or add them yourself
• Authentication tokens and session records, managed by Supabase
• Subscription and plan status, and your AI credit balance
• Your referral code and the count of people who joined through it

Organisation and member data (you enter this)

• Organisation name, type, currency, dues amount and collection schedule
• Member names, and optionally phone or WhatsApp numbers and email addresses
• Payment records — amount, period, method, and any note
• Payment evidence images you upload, such as Mobile Money screenshots or photographs of receipts
• Campaigns, projects, welfare cases, events, pledges and expenses
• Team roles, job titles and invite links you create
• An audit log of actions taken in your organisation — who logged a payment, edited a member or changed settings, and when

Technical data (collected automatically)

• IP address, device type, browser and operating system
• Pages visited within the app, and feature-usage events such as "a flyer was generated"
• Error reports, including a stack trace and the page you were on, via Sentry
• Cookies and similar storage — see section 9

Messages you send us

• Contact-form submissions — your name, email and message — are stored so our support team can reply and keep track of the conversation

3. Why we process it, and on what basis

4. Artificial intelligence features

Some DuesFam features send data to AI providers to do their work. These features are always started by you — nothing is sent to an AI provider in the background.

Your data is not used to train AI models. We do not train models on your data, and we use these providers under terms where they do not train their models on data submitted through their APIs.

AI output can be wrong. A scanned ledger can be misread and an insight can be mistaken. Always review AI output before relying on it — every scanned record is shown to you for confirmation before anything is saved, and no AI feature moves money or changes a payment record on its own.

5. Money: what we never touch

DuesFam is a record-keeping and accountability tool. We do not hold, receive, transmit or process your organisation's dues. Contributions move directly between members and your treasurer by cash, Mobile Money or bank transfer — entirely outside DuesFam. We are not a bank, a payment service provider, or an electronic money issuer, and we hold no licence to act as one.

The only money that reaches us is your own subscription or AI credit payment, taken by Paystack. We never see or store your full card number.

6. Who we share data with

We do not sell personal data, and we never have. We share it only with the sub-processors below, each of whom is contractually bound to protect it and to use it only to provide their service to us.

We may also disclose data where we are legally required to — a valid court order or lawful request from a Ghanaian authority — or to establish or defend legal claims. If DuesFam is ever acquired or merged, data may transfer to the new owner, who would remain bound by this policy or give you notice before changing it.

7. International transfers

DuesFam serves organisations across Africa, Europe, North America and beyond, and the providers above operate internationally. Your data may therefore be processed outside your country, including outside Ghana and the European Economic Area. Where we transfer personal data internationally we rely on the providers' standard contractual clauses and equivalent safeguards, and we choose providers with a documented security posture.

8. How long we keep it

9. Cookies and similar technologies

We use the minimum that makes the app work, plus a small amount of analytics:

• Essential — session and authentication cookies that keep you signed in, and local storage for your theme choice. These cannot be turned off without breaking sign-in.
• Analytics — aggregate page and usage measurement so we can see which features are used. We ask for your choice through the cookie banner.

You can clear or block cookies in your browser at any time; if you block the essential ones you will not be able to sign in.

10. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843) — and, if you are in the EU or UK, under the GDPR — you have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate
• Delete your data — see our Data Deletion page, which you can action yourself in the app
• Export your records — the Reports screen produces a full Excel export at any time, without asking us
• Object to or restrict processing based on our legitimate interests
• Withdraw consent for marketing email, without affecting anything else
• Complain to a supervisory authority — in Ghana, the Data Protection Commission

Write to us and we will respond within 30 days. We do not charge for these requests.

11. Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider. Access to production data is limited to the people who need it to run the service. Row-level security rules in the database are intended to keep each organisation's records reachable only by that organisation. Passwords are never stored by us — authentication is handled by Supabase, and Google sign-in never exposes your Google password to us.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Commission without undue delay, and tell you plainly what happened and what to do.

12. Your responsibilities as an organisation

If you enter other people's data into DuesFam, you take on obligations of your own. You should:

• Only enter data you have a lawful reason to hold — normally your organisation's membership relationship
• Tell your members that their contribution records are kept in DuesFam
• Keep records accurate, and remove people who leave
• Give invite links and team roles only to people who should have that access, and revoke them when someone steps down
• Handle members' requests about their own data, or pass them to us

13. Children

DuesFam accounts are for people aged 18 and over. We do not knowingly create accounts for children. An organisation may legitimately record a contribution made on behalf of a minor — for example a child in a family association — but should keep this to the minimum needed. If you believe we hold a child's data that should not be there, contact us and we will remove it.

14. Changes to this policy

When we change this policy we update the date at the top. For changes that materially affect your rights we will also notify you in the app or by email before they take effect. Continuing to use DuesFam after a change means you accept the updated policy.