Legal
Privacy Policy
Your privacy matters to us. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it. We are committed to transparent, responsible data practices in compliance with the Ghana Data Protection Act, 2012 (Act 843).
1. Overview
The Hue Factory ("we", "us", or "our") operates the Vexx platform. This Privacy Policy explains how we collect, use, store, and protect information about you when you use Vexx. By using the Platform, you consent to the practices described in this policy. We are committed to protecting your privacy in accordance with the Ghana Data Protection Act, 2012 (Act 843).
2. Information We Collect
We collect: (a) Account information — name, email address, organisation name, and password when you register; (b) Profile and workspace data — team member details, roles, and preferences you configure; (c) Business data — client records, project details, invoices, contracts, quotes, expenses, and financial reports you create or import; (d) Payment information — billing details processed securely by Paystack (we do not store card numbers); (e) Usage data — log files, IP addresses, browser type, pages visited, and feature usage for product improvement; (f) Communications — messages you send to our support team.
3. How We Use Your Information
We use your information to: provide and maintain the Platform; process payments and manage your subscription; send transactional emails (invoices, contract notifications, verification codes); notify you of service updates, scheduled maintenance, and security alerts; analyse usage patterns to improve the Platform; respond to support requests; comply with legal obligations; and enforce our Terms of Service.
4. Legal Basis for Processing
We process your personal data on the following bases: (a) Contract performance — processing necessary to deliver the Service you subscribed to; (b) Legitimate interests — usage analytics, fraud prevention, and security monitoring; (c) Legal obligation — retaining financial records as required by Ghanaian tax and corporate law; (d) Consent — marketing communications, where you have opted in.
5. Data Sharing & Third Parties
We do not sell your personal data. We share data only with: (a) Paystack — for payment processing; (b) Resend — for transactional email delivery; (c) Convex — our database and backend infrastructure provider; (d) Clerk — for authentication and identity management; (e) Vercel — for hosting and content delivery. All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Financial records (invoices, payments, expenses) are retained for 7 years in accordance with Ghanaian tax regulations. After account termination, you have 30 days to export your data. Following that period, we will delete your personal data unless retention is required by law.
7. Security
We implement industry-standard security measures including encryption in transit (TLS), secure storage, access controls, and audit logging. Payment data is handled exclusively by PCI-DSS compliant processors. We conduct periodic security reviews. However, no system is 100% secure — if you believe your account has been compromised, contact us immediately at security@thehuefactory.co.
8. Your Rights
Under the Ghana Data Protection Act and applicable law, you have the right to: access the personal data we hold about you; correct inaccurate or incomplete data; request deletion of your data (subject to legal retention requirements); restrict or object to certain processing; receive your data in a portable format; withdraw consent at any time. To exercise any of these rights, contact us at privacy@thehuefactory.co.
9. Cookies & Tracking
We use essential cookies to maintain your authenticated session. We may use analytics cookies to understand how the Platform is used. You can manage cookie preferences through your browser settings. Disabling essential cookies may impair Platform functionality. We do not use third-party advertising trackers.
10. Push Notifications
If you enable push notifications, we store your browser's push subscription endpoint and encryption keys. This data is used solely to deliver in-app notifications about your workspace activity (invoice payments, contract signatures, project updates). You can revoke push notification permission at any time from your browser or account settings.
11. International Transfers
Your data may be processed on servers located outside Ghana (including the United States and European Union) by our third-party providers. Where we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms, in accordance with applicable data protection law.
12. Children's Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at privacy@thehuefactory.co and we will promptly delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the Platform at least 14 days before they take effect. The "Effective" date at the top of this page reflects when the current version was published. Continued use after changes take effect constitutes acceptance.
14. Contact & DPA
For privacy enquiries or to exercise your data rights, contact our Data Protection Officer at privacy@thehuefactory.co. You also have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe your rights under the Data Protection Act have been infringed.
