Terms of Service

By accessing this website you accept these terms. If you do not accept them, please stop using the website. If you are accepting on behalf of an organisation, you confirm that you are authorised to bind that organisation.

This website is operated by Daniel Amekpoagbe, an independent software engineer resident in Ghana. These terms are between you and Daniel Amekpoagbe. Data protection obligations are governed by Ghana's Data Protection Act, 2012 (Act 843), administered by the Data Protection Commission of Ghana.

I provide software engineering services, including full-stack web and application development, custom AI chatbots, AI customer support automation, business workflow automation, database and backend work, and related technical work. These are described on the services page.

Every engagement is governed by:

• A written scope of work, with the specific deliverables listed
• A written statement of what is explicitly out of scope
• An agreed timeline and a payment schedule
• Your provision of the content, credentials, access and decisions I reasonably need to proceed
• A data-processing term describing how your personal data will be handled, per section 7 below

Where a written agreement exists for a project, that agreement takes precedence over these website terms in the event of a conflict. Where no written agreement exists yet, nothing on this website — including any price, estimate or timeline — is binding.

I will tell you promptly if a change in scope is needed, with the reason and its likely effect on cost and timeline, and I will not begin the additional work until you have approved it.

Some work depends on services I do not control — hosting providers, payment gateways, messaging platforms such as WhatsApp or Telegram, model providers, and third-party APIs. I will tell you which parts of a build carry a third-party dependency and what happens if that dependency degrades, changes pricing, or is withdrawn. I am not responsible for the availability, pricing, terms or policies of third parties, and their terms also apply to you.

This website, its design, its written content and its code are owned by Daniel Amekpoagbe and protected by copyright and other intellectual property laws.

For work delivered under an engagement, intellectual property in the deliverables transfers to you on full payment, unless the engagement agreement says otherwise. I retain ownership of any pre-existing libraries, internal tooling, general-purpose components and techniques I bring to the project, and I grant you a perpetual licence to use them as embedded in the deliverables.

You keep ownership of everything you send me. By sending it you grant me a non-exclusive licence to use it only for the purpose of responding to you or delivering the agreed work. I do not use your content, name, logo or project details in my portfolio, case studies or marketing unless you have given specific written permission.

You confirm that you hold the rights to everything you send me, and that sending it does not infringe anyone else's rights or breach a duty of confidentiality you owe to a third party.

This section is written to sections 29, 30 and 35 of the Data Protection Act, 2012 (Act 843).

7.1 Roles. In a client project, you are the data controller for the personal data processed in your systems, and I am the data processor. For this website and its contact form, the roles are reversed: I am the controller.

7.2 My commitments. These are the processor obligations I accept on every engagement:

• I process your personal data only with your prior knowledge and authorisation, and only for the purposes set out in our agreement. That is the duty placed on a data processor by section 29 of the Act.
• I treat your personal data as confidential and do not disclose it to anyone except where the law requires it or where it is necessary to discharge one of my duties.
• I do not sell your data, and I do not use it for any purpose other than delivering your project.
• I never use one client's data in another client's project. Each engagement gets its own credentials, its own storage namespace and, where retrieval is involved, its own search index.
• I never use your data to train a general-purpose model. Where a build sends data to a third-party model provider, the engagement contract requires that provider not to use your data to train its models, and I configure the provider's data-retention settings accordingly. Where that commitment cannot be obtained, I tell you before I build rather than after.
• I do not build models or indexes on special personal data — data about health, race or ethnic origin, political opinion, religious belief, political affiliation, sexual life, trade-union membership, criminal behaviour, or a child — unless section 37 of the Act permits it and the agreed safeguards are in place.
• I apply the same technical and organisational safeguards to client systems as I apply to this website, and I keep them current as new risks emerge.
• I instruct each of my own subprocessors to meet the security requirements of section 30, and where a subprocessor sits outside Ghana I ensure it complies with the laws that apply to it.
• I return or delete your data, on your instruction and at the end of the engagement, in line with section 33 and section 44.
• I assist you with data-subject requests and with security-compromise notification, as sections 31 and 35 require of a processor on behalf of its controller.

7.3 Your commitments. As controller, the following are yours:

• You decide what personal data your users give me, why, and on what lawful basis under section 20.
• You are the data controller; I am the data processor. You must hold the relevant consent or other lawful basis yourself — I cannot create it for you.
• You must tell your users that a chatbot or automated system is in use, that it is powered by artificial intelligence, and what it does with their data.
• You must not use the system to make decisions that significantly affect a person without a human able to review the outcome. Section 41 gives data subjects rights in relation to automated decision-making.
• You remain responsible for the accuracy and lawfulness of the content you ask me to train or configure the system on.
• If you operate a service used by children, or process special personal data, you must tell me so at the start so the correct safeguards can be designed in.

7.4 Safeguards. I apply appropriate, reasonable, technical and organisational measures as section 28 of the Act requires, including:

• Encryption in transit. Every page, form submission and API call is served over HTTPS/TLS. Plain HTTP is redirected to HTTPS.
• A restrictive Content Security Policy is sent with every response, limiting which scripts, styles, images and network connections the browser is permitted to load, so injected code cannot call home to an attacker's server.
• Strict browser security headers are sent on every response: X-Frame-Options denies framing (clickjacking), X-Content-Type-Options blocks MIME-type sniffing, Referrer-Policy limits referrer leakage to cross-origin requests, and Permissions-Policy disables the camera, microphone and geolocation APIs entirely.
• Server-side input validation on every endpoint. The contact form, the analytics ingestion endpoint and the blog reaction endpoint all validate every field against a strict schema, reject unknown values, and enforce length limits before anything is processed.
• Output encoding and header-injection defence on contact submissions. User-supplied text is HTML-escaped before it is placed into the notification email, and newlines are stripped from any value used to build an email header, which blocks header injection.
• Rate limiting on every public write endpoint, keyed to the client IP address, to prevent abuse, spam and scraping of personal data.
• Administrative sessions use HttpOnly, Secure, SameSite=Lax cookies. Session tokens are never readable by client-side JavaScript, so a cross-site scripting bug cannot exfiltrate them.
• Privileged database credentials live only in server environment variables. The service-role key that can bypass row-level security is never included in the browser bundle and is only reachable from server-only modules that perform their own authorisation check first.
• Administrative areas are protected at the edge. Middleware requires a valid session cookie before any /admin or /dashboard request is served, and the API routes repeat the authorisation check independently rather than trusting the middleware.
• Cross-origin requests are refused. The analytics and data endpoints are same-origin only; they do not send permissive CORS headers, so another website cannot read their responses from a visitor's browser.
• No production database credentials, API keys or secrets are exposed in page source, client bundles or public environment variables.
• For AI and automation work: model and third-party API calls are made from the server, never from the visitor's browser, and each client project is given its own scoped credentials, its own storage namespace and its own retrieval index.

7.5 Special personal data. I will not process special personal data — data relating to a child who is under parental control, religious or philosophical beliefs, racial, ethnic or tribal origin, and the other categories listed in section 37 of the Act — unless you tell me it is involved, the processing is permitted under section 37, and the safeguards we have agreed are in place. If I become aware that a system I have built is processing special personal data without a lawful basis, I will tell you and stop the affected processing.

7.6 Security compromises. I will notify you without undue delay if I become aware of a security compromise affecting your data, and I will cooperate fully with your obligations to notify the Data Protection Commission of Ghana and affected individuals under section 31 of the Act.

7.7 Subprocessors. I may use subprocessors to deliver the work. I will keep the list short, will pass on to each of them the confidentiality and security obligations the Act requires of a processor, and will notify you before adding a new subprocessor that will handle your personal data.

7.8 On termination. On your instruction or at the end of the engagement, I will return or securely delete your personal data, subject to any record I am legally obliged to retain.

AI chatbots, AI customer support and workflow automation are sold on a scope-based basis. No price is published, because the cost depends entirely on the data source, the integrations, the volume and the accuracy bar you need.

When you engage me to build an AI system, I commit to the engineering and data-protection standards set out above. I do not commit to outcomes that depend on factors outside the build:

• That the system will produce a particular commercial result, revenue figure or conversion rate. Any uplift depends on your product, pricing, offer, traffic and sales process, none of which I control.
• That a chatbot will be right every time. Language models make mistakes, and I will design for graceful failure, escalation to a human, and honest uncertainty — but I cannot eliminate error.
• That a third-party model provider will not change its pricing, availability, or terms. I build so that a provider can be swapped, and I will tell you where that exposure sits.
• That an automation will run unattended forever. Automations depend on the systems they connect to, and I build in alerting and failure handling rather than pretending otherwise.

For anything customer-facing, health-adjacent, financial, or legally consequential, I will tell you during scoping which decisions must stay with a human. Section 41 of the Act gives data subjects rights in relation to automated decision-making, and that is a legal obligation, not a preference.

You agree not to use the website, or anything I build for you, to:

• Break the law, or infringe anyone else's rights
• Send unsolicited bulk email, or use the contact form to send marketing
• Probe, scan, overload, or attempt to gain unauthorised access to the website or any connected system
• Scrape, harvest, or systematically extract content from the website
• Upload or transmit malware
• Process special personal data in a way that breaches section 37 of the Act
• Build a system whose purpose is to deceive people, impersonate a person or organisation, or generate disinformation

The contact form is rate-limited and every submission is validated server-side. Abuse will be blocked and, where necessary, reported.

You are granted a limited, revocable, non-exclusive, non-transferable licence to view the website for personal, non-commercial purposes. This is a licence, not a transfer of ownership. You may not:

• Copy or modify the materials
• Use the materials commercially or reproduce them publicly
• Reverse engineer any software on the website, except to the extent that such restriction is prohibited by law
• Remove copyright or other proprietary notices
• Mirror or reproduce the materials on another server

This website links to external sites I do not control. I have not reviewed them, I am not responsible for their content or their privacy practices, and the inclusion of a link is not an endorsement. A link is not a guarantee of quality, safety or availability. Use them at your own risk.

The website and its content are provided on an “as is” basis. I do not warrant that they are accurate, complete, current, or error-free, and I may change them at any time without notice. Nothing on this website is professional, legal, financial or medical advice.

To the fullest extent permitted by law, I am not liable for indirect or consequential loss, loss of profit, loss of business, loss of data, or business interruption arising from your use of this website or of any system I have built, even if I was advised that such loss was possible.

Where liability cannot be excluded, it is limited to the fees you paid me in the twelve months preceding the event giving rise to the claim. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

Because some AI and automation outcomes depend on third-party providers whose behaviour I cannot control, the exclusions in this section apply to such outcomes too. The detailed treatment of that is in the Disclaimer.

You agree to indemnify me against reasonable costs arising from a breach by you of these terms, of the law, or of a third party's rights — including any claim that material you supplied to me, or that a system I built at your instruction processes or publishes, infringes that party's rights or breaches Ghana's data protection laws.

You may stop using the website at any time. I may suspend access to the administrative areas or to the website where I have a reasonable belief the site is being abused, or where required by law or by a binding order. Either of us may terminate an engagement as set out in the engagement agreement, and on termination my data-handling duties in section 7 survive.

I may revise these terms at any time. The date at the top shows the current version, and continued use of the website after a change means you accept the revised terms.

If a provision of these terms is held unenforceable, the rest remains in force. A failure to enforce a provision is not a waiver of it. These terms are the entire agreement between us on their subject matter.

These terms are governed by the laws of Ghana, including the Data Protection Act, 2012 (Act 843). Subject to any mandatory dispute resolution requirement in your engagement agreement, you and I submit to the exclusive jurisdiction of the courts of Ghana.

Personal data

Information that relates to an identified or identifiable individual — including your name, your email address, your IP address and the content of what you write to me.

Data controller

The person who decides why and how personal data is processed. For this website, and for enquiries sent through the contact form, that person is Daniel Amekpoagbe.

Data processor

The person who processes personal data on the controller's behalf and under the controller's authority. In a client engagement, Daniel Amekpoagbe is the data processor and the client is the data controller.

Data subject

The individual whose personal data is processed. That is you, or your customer.

Special personal data

A narrower and more sensitive category of personal data, listed above, which sections 37 and 96 of the Act prohibit us from processing unless specific conditions are met.

Processing

Any operation on personal data, whether or not by automated means — including collecting, storing, analysing, transmitting, retrieving and deleting it.

For any question about these terms, or about how I handle your data, contact me at:

Email: work@amekpoagbe.com

Data protection complaints may also be brought before the Data Protection Commission of Ghana.