Privacy Policy

CashMango is a software platform operated by Hotlab Company Limited in Ghana. CashMango helps business owners see what is happening across the businesses, projects, and other operations they own or oversee—by bringing together the records, receipts, photos, and updates that their team enters.

CashMango is non-custodial software. We do not hold, move, or process your money, and we are not a bank, wallet, or payment service provider.

Some features shown on our website—such as Mango Vision, Mango Track, Mango Counter, and Mango Sensors—are planned and marked as coming soon. They are not operating or collecting data today. We will give additional notice, and obtain any permissions required by law, before introducing materially new data collection.

For any privacy question or request, contact us at hello@cashmango.africa.

CashMango as controller. For the personal data we collect to create and secure accounts, operate the platform, provide support, and improve the service, CashMango (Hotlab Company Limited) acts as the data controller.

You as controller. When you use CashMango to record information about your own staff, customers, suppliers, drivers, or other people—such as their names, phone numbers, sales, receipts, photos, or activity—you act as the data controller for that information, and CashMango processes it on your behalf and on your instructions. You are responsible for having a lawful basis to collect that information and for informing the people concerned about how you use it.

The legal roles depend on the actual processing involved, not only the labels used in this policy.

For a request about information a workspace operator controls, please contact that operator first. You may also contact us, and we will assess our responsibilities and work with that operator where appropriate.

Depending on how you use CashMango, we may collect:

• Account and profile data — your name, phone number, email address, role, and the businesses, projects, or operations you set up. Your password is handled securely by our authentication system; we do not store it in readable form.
• Operational records your team enters — sales, expenses, payments, amounts, references, notes, and timestamps for each business or project.
• Supporting evidence — receipts, screenshots, and photos (including progress photos for projects) and other documents uploaded to support a record. These can incidentally contain faces, phone numbers, or addresses, so please avoid uploading unnecessary personal information about other people.
• Payment-message data (Mango Auto) — where you choose to enable it, CashMango reads supported mobile-money payment alerts (for example from MTN, Telecel, or AirtelTigo) to record transactions. This can include the amount, reference, timestamp, and the sender name or number contained in those messages. A forwarded message can also contain unrelated personal information, and we may keep the message and the record we derive from it to resolve matching, disputes, or duplicates. You control whether this feature is turned on.
• Team and activity records — which user recorded or changed an entry, under which role, and shift open/close activity. Where you enable location-based features, this may include a location stamp captured at the moment a recorded action takes place. Using CashMango does not imply precise, background, or continuous location tracking.
• Device, app, and usage data — device and browser type, IP address, app version, diagnostics, and usage information needed to operate, improve, and secure the service.
• Consent and audit records — the version of any consent text you agreed to, with timestamp, and logs of key actions taken in your account.
• Support messages and communications you send to us.

This information reaches CashMango directly from you, from other authorised users in your workspace, from the receipts and documents you upload, and from any device or feature you choose to connect. When an owner sees an update from a staff member or caretaker, that is the team's own record reaching the owner—not CashMango independently observing the activity. Records can be late, incomplete, mistaken, or disputed.

We use personal data to:

• Create and manage user accounts, businesses, projects, and workspaces.
• Record, organise, review, and reconcile the activity your team enters.
• Produce summaries, reminders, notifications, and insights (see Section 5).
• Keep the service secure and protect it against fraud, misuse, and unauthorised access.
• Respond to support requests and communicate important service updates.
• Comply with legal obligations and resolve disputes where required.

CashMango can turn the information already recorded in your account into plain-language summaries, trends, and things worth checking ("Mango AI"). These features are built on your own data; they do not invent figures, and they are intended to help you understand your operations—not to make decisions for you. An insight can be incomplete or mistaken; it is not a certification of payment, a financial audit, or proof of wrongdoing by any worker.

Where an AI-assisted feature is enabled, we may use a trusted third-party AI provider to process your data and generate a response, sending only the information needed to answer. CashMango does not use CashMango data to make lending or credit decisions.

CashMango does not make decisions that produce legal or similarly significant effects about you by automated means alone. Under Act 843, where any decision that significantly affects you would be based solely on automated processing, you may ask for human review.

Under the Data Protection Act, 2012 (Act 843), we process personal data where we have a lawful basis to do so, including:

• Your consent — for optional features (such as Mango Auto payment-message capture or location-based features) and for any processing you explicitly opt into.
• Performance of a contract — to provide the CashMango service you have signed up for.
• Compliance with a legal obligation — to meet applicable Ghanaian law.
• Our legitimate interests — for security, fraud prevention, and improving the service, balanced against your rights and freedoms.

Where processing depends on your consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal.

CashMango is a records, visibility, and workflow platform. Payments are made outside CashMango using your own channels—such as mobile money, bank transfer, or cash. We are not your wallet, bank, payment processor, or funds custodian.

A record, receipt, or payment message shown in CashMango is part of the review layer of the service. It is not, on its own, a guarantee from CashMango that money was transferred, cleared, settled, or finally received.

A user-entered sale, a payment message, an estimated balance, and independently counted cash are different kinds of evidence. We do not guarantee that every transaction is captured, or that a provider's records and the physical cash always match.

We do not sell personal data. We share data only in limited cases:

• With service providers that help us run the platform under contract—including our hosting and authentication provider (Supabase), and, where enabled, a messaging/SMS provider and a third-party AI provider. These providers act as our processors and may only use the data to provide their service to us.
• With other authorised users in your own workspace, according to the roles and permissions you set.
• Where you instruct or authorise us to share data with another person or service.
• Where disclosure is required by law, regulation, court order, or a lawful request from a public authority.
• In connection with a business transfer, restructuring, or financing transaction, subject to appropriate confidentiality safeguards.

We do not routinely report your sales to the Ghana Revenue Authority or any other authority. We cannot promise that records will never be disclosed where the law requires it, and you remain responsible for meeting your own tax obligations.

An earlier version of this policy described an optional lender-referral service. CashMango does not offer lending today. If it is introduced, we will publish separate information about the lender and the data involved before any data is shared.

CashMango relies on infrastructure providers (including Supabase) that may store or process personal data on servers located outside Ghana. Where personal data is transferred outside Ghana, we take steps to ensure it continues to receive a level of protection consistent with the Data Protection Act, 2012—including putting data-processing agreements in place with those providers. Access by our support or engineering staff located in another country may also involve processing outside Ghana.

We keep personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymise it. In general:

• Account, business, and project data is kept while your account is active.
• When you ask us to delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records for legal, tax, audit, or dispute-resolution reasons.
• Financial and activity records are kept as an append-only ledger for integrity; where required for tax or audit purposes, these may be retained for the period required by law.
• Security and access logs are kept for a limited period on a rolling basis.

Some data may be kept longer where the law requires it, or where it is necessary to resolve a pending dispute or defend a legal claim.

We use reasonable technical and organisational safeguards to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include encryption in transit, access controls, audit logging, and least-privilege role separation. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for limiting access to the people you authorise in your workspace.

If we become aware of a personal-data breach that poses a risk to your rights, we will notify the Data Protection Commission and affected individuals as soon as reasonably practicable, as required by Act 843.

Subject to the conditions in Act 843, you have the right to:

• Ask what personal data we hold about you and request access to it.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete data where it is no longer necessary or lawful to keep it.
• Object to, or ask us to stop or restrict, certain processing in defined circumstances.
• Withdraw consent where processing is based on consent.
• Ask for human review of a decision based solely on automated processing that significantly affects you.
• Complain to the Data Protection Commission if you believe your rights have been infringed.

To exercise any of these rights, contact hello@cashmango.africa. We will respond within a reasonable time and, where practicable, within 21 days. We may need to verify your identity and, where the request concerns data a workspace operator controls, consult that operator before acting.

Under Act 843, additional protections apply to direct marketing—which requires your consent—and to decisions based solely on automated processing that significantly affect you.

Our website and app use cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember basic preferences. Where we use any additional analytics to understand how the service is used, we do so in a way consistent with this policy and applicable law.

We send essential account, security, and service messages. Any promotional messages are sent on an appropriate lawful basis and include a way to opt out.

CashMango is intended for users aged 18 and over, and we ask you to confirm this when you create an account. CashMango is not intended for use by children. If your use of the service involves information about a person under 18, you are responsible for ensuring you have the appropriate authority and lawful basis to collect and use that information.

Photos and documents can incidentally include bystanders or people under 18. Please take care with what you upload and with who in your workspace can view it.

Hotlab Company Limited operates CashMango in line with the Data Protection Act, 2012 (Act 843), and is taking the steps required of a data controller under that Act, including registration with the Data Protection Commission. We will update this section as our registration status is confirmed. A data controller's registration status can be checked on the Commission's public register.

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, for material changes, provide additional notice through the service.

For privacy questions, requests, or complaints, contact us at hello@cashmango.africa or support@cashmango.africa. You may also contact or lodge a complaint with Ghana's Data Protection Commission at dpc.gov.gh.