01 · Controller and contact
Who is responsible for your information?
Croccifixo Cole, operating OneCedi from Accra, Greater Accra Region, Ghana, is responsible for the personal information OneCedi controls. Send privacy questions or rights requests to support@onecedis.com. You may also use onecedighana@gmail.com if the branded address is unavailable.
02 · Information we collect
Only the information needed to run the service.
- Account information: Ghana mobile number, display name, verification status and an optional email address.
- Security information: your four-number member PIN is stored only as a salted and peppered cryptographic hash. OneCedi cannot display the original PIN.
- Contribution records: amount, project or Live pool, giving frequency, payment reference, provider transaction identifier, channel, status and timestamps.
- Verification and fraud prevention: short-lived SMS verification status and a hashed combination of phone number and network address used to limit repeated PIN requests.
- Device information: session cookies and, only when you choose “remember this number,” a local device preference stored in your browser.
- Support information: messages and information you send when requesting help, cancellation, correction or a refund.
- Optional public information: a chosen display name, character avatar, photo or short quote when public member features open and you opt in.
03 · Why we use it
To verify, process, account and protect.
OneCedi uses information to create and secure accounts, start the checkout you request, confirm payment results, issue receipts, connect a contribution to the selected purpose, maintain project accounts, answer support requests, investigate misuse and meet legal or regulatory duties.
We do not sell personal information. We do not use a phone number to create a public profile without the user's choice.
04 · Payment and SMS providers
Specialist providers process parts of the service.
The payment provider receives the information required to process Mobile Money or card transactions. It independently collects payment credentials; OneCedi does not receive or store your card PIN, CVV, Mobile Money PIN or payment approval code.
OneCedi currently uses Paystack for payment processing and Arkesel for SMS one-time PIN delivery. Cloudflare provides website, security and database infrastructure. These providers may process information outside Ghana under their own safeguards and applicable contracts. We may also disclose information to professional advisers, auditors or public authorities where lawfully required.
05 · Storage and retention
Records stay only as long as their purpose or law requires.
- Signed-in sessions expire after 30 days unless ended sooner.
- Verification rate-limit records are removed after no more than 24 hours.
- Browser-saved number preferences remain on that device until you remove them or clear site data.
- Account records remain until deletion is requested, subject to records that must be retained for security, disputes or law.
- Transaction and accounting records are retained for the period required by Ghanaian law, payment-provider rules and legitimate dispute handling.
When a photo-to-character feature is offered, the transformation is designed to run on your device. The selected photo is not uploaded to OneCedi by that feature.
06 · Your choices and rights
You can ask to see, correct or remove information.
Subject to Ghanaian law, you may request access, correction, objection, restriction, deletion or information about how your personal data is handled. You may withdraw optional public-profile consent at any time and ask us to remove the public display.
Contact support@onecedis.com with enough information to verify the request. Never send a card PIN, Mobile Money PIN or one-time payment approval code. If a concern is not resolved, you may contact Ghana's Data Protection Commission.
07 · Children, security and changes
Accounts and payments are for adults.
OneCedi does not knowingly create contribution accounts for children under 18. Projects may benefit children, but identifiable stories or close-up images involving a minor require appropriate institutional and parent or guardian permission.
We use access controls, encrypted transport, secure cookies, rate limits and restricted database access. No online service can promise absolute security, so report suspected misuse promptly. Material policy changes will be posted here with a new effective date.