Privacy Policy

This website is operated by Daniel Amekpoagbe, a software engineer resident in Ghana. Under the Data Protection Act, 2012 (Act 843) — the “Act” — I am the data controller for personal data handled by this website: the data you submit through the contact form, and the technical data generated as you browse it.

That role changes when I work for a client. On a client project — web, application, custom AI chatbot or business automation — the client is the data controller and I am the data processor, acting only on their documented instructions. Section 8 sets out exactly what that means.

Ghana's Data Protection Act, 2012 (Act 843) gives effect to Article 18(2) of the Constitution of Ghana, 1992 (the right to privacy). It is supervised by the Data Protection Commission of Ghana, which maintains the Data Protection Register under sections 46 and 47 of the Act.

This policy is organised around the eight principles that section 17 of the Act requires every person who processes personal data to take into account. Section 3 shows how each one is met.

Statutory references in this policy are to the Data Protection Act, 2012 (Act 843) as published on GhaLII. If a reference and the Act ever disagree, the Act governs.

1. 01 Accountability (section 17(a))

   Daniel Amekpoagbe is the data controller for this website and is answerable for how personal data is handled. Accountability is demonstrated in writing: this policy, the Terms of Service, and the contractual data-processing terms agreed with each client. Controllers who process personal data in Ghana must register on the Data Protection Register, and we will declare the categories of data we process, our purposes, our recipients, and every country to which data may be transferred when we register.

2. 02 Lawfulness of processing (section 17(b))

   Personal data is processed only where section 20 permits it: because it is necessary to respond to you before we enter a contract, because the law requires it, or because it is necessary to pursue a legitimate interest of ours that does not override your interests. We do not process special personal data unless section 37 allows it.

3. 03 Specification of purpose (section 17(c))

   Every piece of data I collect has a stated, specific purpose, set out in full in section 4 of the Privacy Policy. I do not collect data for a purpose I have not told you about, and I do not repurpose data later without telling you first.

4. 04 Compatibility of further processing with the purpose of collection (section 17(d))

   Where we intend to use data for a new purpose, we check that the new use is compatible with the original purpose, we tell you, and — where section 20 requires consent for the new purpose — we ask for it again. Data collected to answer your enquiry is not repurposed into a marketing list.

5. 05 Quality of information (section 17(e))

   We collect only what is necessary, relevant and not excessive (section 19), we validate every field before accepting it, and we correct or delete data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or was obtained unlawfully when you ask us to (section 33).

6. 06 Openness (section 17(f))

   This policy is published on this website and is not hidden behind a login or a cookie wall. It describes our actual practices and our actual technical measures in plain language, and it names our processors and the countries they operate in. Where a practice changes, we update this page and change the date at the top.

7. 07 Data security safeguards (section 17(g))

   We apply appropriate, reasonable, technical and organisational measures to prevent the loss, damage or unauthorised destruction of personal data and to prevent unlawful access to or processing of it, as section 28 requires. Every measure I apply is listed in section 11 of the Privacy Policy. I keep them under review and update them when I identify a new risk or a weakness.

8. 08 Data subject participation (section 17(h))

   You can ask what data we hold about you, ask us to correct or delete it, object to how we process it, and complain to the Data Protection Commission. You can exercise these rights by email and we respond within the statutory period. We do not charge for a routine request.

Below is the complete register of personal data this website handles. If a purpose is not on this list, I am not collecting data for it.

Being specific about the exclusions is as important as listing what I do collect:

• I do not ask for, and you do not have to give, your date of birth, your gender, your nationality, your religion, your health information or any political information.
• I do not ask for a national identification number, a passport number, or a photograph of an identity document.
• I do not collect payment card details through this website. Payments are handled on a project-specific basis and never touch this site.
• I do not build advertising profiles and I do not run remarketing, behavioural advertising or cross-site tracking.
• I do not add third-party advertising pixels to this website.
• I do not knowingly collect data from anyone under the age of 18, because this website is a business portfolio rather than a service directed at children.

The Act gives extra protection to a category of data called special personal data. Section 37 prohibits processing it unless specific conditions are met, and it covers:

• data relating to a child who is under parental control
• religious or philosophical beliefs
• racial, ethnic or tribal origin
• political opinion or political affiliation
• physical or mental health, or medical records
• sexual life or sexual orientation
• trade union membership
• criminal behaviour, and proceedings for an offence

I do not ask for any of this. If you include it in a message through the contact form, I will not use it for anything other than replying to you, I will not store it beyond the enquiry record, and I will suggest a way to send it more safely if the matter is sensitive.

This matters more than usual for AI work. Section 7.2 explains the specific position on special personal data in chatbot and automation projects.

You have asked specifically what happens to data inside the AI chatbots and automations I build for clients. Here is the position in full.

7.1 Your data stays in your project. Every client system runs on its own credentials, its own storage namespace and, where retrieval is involved, its own search index. Nothing is shared between clients. I do not use one client's data to improve, tune or debug another client's system, and I do not reuse one client's chatbot content in another engagement.

7.2 I do not train on special personal data. Chatbots and retrieval indexes are built from material the client supplies and approves. I do not build a model or an index on special personal data unless section 37 of the Act permits the processing and the safeguards agreed in the contract are in place. If a project would require that, it is raised before the build starts, not discovered afterwards.

7.3 Your data is not used to train a provider's general model. Where a build sends data to a third-party model provider, the engagement contract requires that provider not to use the client's data to train its models, and the provider's data-retention settings are configured accordingly. Where that commitment cannot be obtained from a provider, I tell the client before I build, so the decision is theirs rather than mine.

7.4 Model calls happen on the server. Prompts and retrieved content are sent from the application server, never from the end user's browser. This means client data is never exposed to browser extensions, to injected scripts, or to anyone watching a user's network tab, and it means provider keys stay off the client entirely.

7.5 Conversation logs are scoped and time-limited. Chat transcripts are retained for the period agreed in the contract — typically to tune the system or to evidence what the bot said — and are then deleted or irreversibly aggregated. Personal identifiers are stripped from logs before they are used for diagnostics.

7.6 Retrieval is tenant-scoped. Where a bot retrieves from a client's knowledge base, the query is filtered to that client's own records. A query issued by one user or one tenant cannot return another's documents, and permissions are enforced in the database rather than in the prompt.

7.7 You stay the controller. The client decides what their users' data is for, on what lawful basis, and how long it is kept. My obligations as a processor are set out in section 8.

On a client project the client is the data controller and I am the data processor. Sections 29 and 30 of the Act govern that relationship, and it is written into every engagement contract. What I commit to:

• I process your personal data only with your prior knowledge and authorisation, and only for the purposes set out in our agreement. That is the duty placed on a data processor by section 29 of the Act.
• I treat your personal data as confidential and do not disclose it to anyone except where the law requires it or where it is necessary to discharge one of my duties.
• I do not sell your data, and I do not use it for any purpose other than delivering your project.
• I never use one client's data in another client's project. Each engagement gets its own credentials, its own storage namespace and, where retrieval is involved, its own search index.
• I never use your data to train a general-purpose model. Where a build sends data to a third-party model provider, the engagement contract requires that provider not to use your data to train its models, and I configure the provider's data-retention settings accordingly. Where that commitment cannot be obtained, I tell you before I build rather than after.
• I do not build models or indexes on special personal data — data about health, race or ethnic origin, political opinion, religious belief, political affiliation, sexual life, trade-union membership, criminal behaviour, or a child — unless section 37 of the Act permits it and the agreed safeguards are in place.
• I apply the same technical and organisational safeguards to client systems as I apply to this website, and I keep them current as new risks emerge.
• I instruct each of my own subprocessors to meet the security requirements of section 30, and where a subprocessor sits outside Ghana I ensure it complies with the laws that apply to it.
• I return or delete your data, on your instruction and at the end of the engagement, in line with section 33 and section 44.
• I assist you with data-subject requests and with security-compromise notification, as sections 31 and 35 require of a processor on behalf of its controller.

What the client is responsible for, so there is no ambiguity about who must do what:

• You decide what personal data your users give me, why, and on what lawful basis under section 20.
• You are the data controller; I am the data processor. You must hold the relevant consent or other lawful basis yourself — I cannot create it for you.
• You must tell your users that a chatbot or automated system is in use, that it is powered by artificial intelligence, and what it does with their data.
• You must not use the system to make decisions that significantly affect a person without a human able to review the outcome. Section 41 gives data subjects rights in relation to automated decision-making.
• You remain responsible for the accuracy and lawfulness of the content you ask me to train or configure the system on.
• If you operate a service used by children, or process special personal data, you must tell me so at the start so the correct safeguards can be designed in.

I do not sell personal data. Under the Act, offering to sell another person's personal data is itself an offence. I share data only with the processors below, and only to the extent each needs it to do the job I have asked it to do.

Some of the processors above operate outside Ghana. Ghanaian law does not require personal data to stay in Ghana, but it does require transparency and safeguards:

• Ghanaian law does not require personal data to be kept inside Ghana. What it requires is transparency and safeguards.
• Section 47(g) requires a data controller to declare, in its registration, the country to which personal data may be transferred and the safeguards protecting it. The processors listed above operate outside Ghana, and I declare those destinations when I register.
• Where a data processor is not domiciled in Ghana, section 30(4) requires the controller to ensure that processor complies with the laws that apply to it. That duty is mine to meet on client engagements, and it is a term of every engagement.
• Ghanaian data sent abroad remains subject to Ghanaian law. Third-party providers are contractually required to apply the same protection standards we apply in Ghana.

Section 28 of the Act requires a data controller to take the necessary steps to secure the integrity of personal data by adopting “appropriate, reasonable, technical and organisational measures”, to identify foreseeable risks, to verify that safeguards actually work, and to keep updating them as new risks emerge. These are the measures in place on this website and on client systems:

• Encryption in transit. Every page, form submission and API call is served over HTTPS/TLS. Plain HTTP is redirected to HTTPS.
• A restrictive Content Security Policy is sent with every response, limiting which scripts, styles, images and network connections the browser is permitted to load, so injected code cannot call home to an attacker's server.
• Strict browser security headers are sent on every response: X-Frame-Options denies framing (clickjacking), X-Content-Type-Options blocks MIME-type sniffing, Referrer-Policy limits referrer leakage to cross-origin requests, and Permissions-Policy disables the camera, microphone and geolocation APIs entirely.
• Server-side input validation on every endpoint. The contact form, the analytics ingestion endpoint and the blog reaction endpoint all validate every field against a strict schema, reject unknown values, and enforce length limits before anything is processed.
• Output encoding and header-injection defence on contact submissions. User-supplied text is HTML-escaped before it is placed into the notification email, and newlines are stripped from any value used to build an email header, which blocks header injection.
• Rate limiting on every public write endpoint, keyed to the client IP address, to prevent abuse, spam and scraping of personal data.
• Administrative sessions use HttpOnly, Secure, SameSite=Lax cookies. Session tokens are never readable by client-side JavaScript, so a cross-site scripting bug cannot exfiltrate them.
• Privileged database credentials live only in server environment variables. The service-role key that can bypass row-level security is never included in the browser bundle and is only reachable from server-only modules that perform their own authorisation check first.
• Administrative areas are protected at the edge. Middleware requires a valid session cookie before any /admin or /dashboard request is served, and the API routes repeat the authorisation check independently rather than trusting the middleware.
• Cross-origin requests are refused. The analytics and data endpoints are same-origin only; they do not send permissive CORS headers, so another website cannot read their responses from a visitor's browser.
• No production database credentials, API keys or secrets are exposed in page source, client bundles or public environment variables.
• For AI and automation work: model and third-party API calls are made from the server, never from the visitor's browser, and each client project is given its own scoped credentials, its own storage namespace and its own retrieval index.

I re-examine these measures as new risks appear and as the Commission issues further guidance. If a material change is made, this section is updated.

Section 31 of the Act governs what happens if personal data is accessed or acquired by an unauthorised person. My procedure:

• Where there are reasonable grounds to believe that personal data has been accessed or acquired by an unauthorised person, I notify both the Data Protection Commission and the affected data subject.
• I make that notification as soon as reasonably practicable after discovering the unauthorised access or acquisition, which is the standard section 31(2) of the Act sets — the Act does not prescribe a fixed number of hours.
• The notification contains enough information for the data subject to take protective measures, and includes the identity of the unauthorised person where I know it.
• I notify at least by email to your last known email address, or by registered mail, by placing a notice in a prominent position on this website, or by publication — whichever is appropriate.
• I take steps to restore the integrity of the information system.
• If the security agencies or the Commission tell me that notifying the data subject would impede a criminal investigation, I delay notifying the data subject for as long as I am told to.
• If the Commission is satisfied that publicity would better protect an affected data subject, it may direct me to publish the fact of the compromise.

I publish this procedure rather than keeping it secret because you should know in advance who is responsible for telling you if something goes wrong.

This website does not use advertising cookies, tracking pixels or cross-site tracking. What it does use:

• Local storage: a randomly generated analytics visitor identifier and a session identifier, kept in your browser's local storage, used only by first-party analytics on this site. Removing local storage for this domain resets the identifier and gives you a fresh, unlinkable analytics profile.
• Essential cookies: session cookies named sb-access-token and sb-refresh-token. These are set only when an administrator signs in, and are HttpOnly, Secure and SameSite=Lax. They cannot be read by JavaScript.
• Google Analytics: if enabled, Google sets its own cookies to measure audience. These are governed by Google's own terms and retention settings, not by me. Blocking cookies in your browser, or using a browser or extension that blocks third-party cookies, will stop both Google Analytics and my first-party analytics from recording your visit — the site itself will still work normally.

You can control cookies through your browser settings at any time. The only thing that degrades is my own measurement of which pages are useful, which is not a trade I think needs protecting.

This website is a business portfolio. It is not directed at children and I do not knowingly collect personal data from anyone below the age of 18, which is the age at which Ghanaian law defines a child. Data relating to a child under parental control is special personal data under section 37 of the Act and is treated accordingly.

If you believe a child's information has reached me, contact me immediately and I will delete it.

The Act gives you the following rights. This list is drawn directly from the statutory provisions:

I respond to a properly evidenced request promptly and, in any event, within forty days of receiving it, as section 35(10) requires. I do not charge for a routine access, correction or deletion request.

I may need to ask you to confirm your identity before I act on a request, so that I do not disclose your data to somebody else. If you are not satisfied with my response, you can complain to the Data Protection Commission.

Sections 46 and 47 of the Act require a data controller established in Ghana to register on the Data Protection Register, and section 53 prohibits processing personal data without registration. Registration involves describing the personal data processed, the categories of individuals, whether special personal data is held, the purposes, the recipients, the countries data may be transferred to and the safeguards protecting it, and the retention period.

I am completing that registration. Until it is granted, the accurate position is that registration is pending rather than held — and saying so is more useful to you than claiming a certification I cannot yet evidence. If you need confirmation of my registration status for a vendor, security or compliance questionnaire, ask and I will tell you the current position in writing.

Personal data

Information that relates to an identified or identifiable individual — including your name, your email address, your IP address and the content of what you write to me.

Data controller

The person who decides why and how personal data is processed. For this website, and for enquiries sent through the contact form, that person is Daniel Amekpoagbe.

Data processor

The person who processes personal data on the controller's behalf and under the controller's authority. In a client engagement, Daniel Amekpoagbe is the data processor and the client is the data controller.

Data subject

The individual whose personal data is processed. That is you, or your customer.

Special personal data

A narrower and more sensitive category of personal data, listed above, which sections 37 and 96 of the Act prohibit us from processing unless specific conditions are met.

Processing

Any operation on personal data, whether or not by automated means — including collecting, storing, analysing, transmitting, retrieving and deleting it.

I may update this policy as the site changes or as the Commission issues further guidance. The date at the top always reflects the current version. Where a change materially affects how your data is used, I will say so on this page rather than changing the text silently.

For any privacy question, access request, correction, deletion or objection, or to report a security concern, contact me at:

Email: work@amekpoagbe.com

You can also lodge a complaint with the Data Protection Commission of Ghana, which is the supervisory authority for the Act.