Privacy policy

1. Who is responsible

Domicium is the data controller for the personal data described here. We operate in Ghana and process personal data under the Data Protection Act 2012 (Act 843).

2. What we collect

• Account details — name, email address, phone number, role and password (stored only as a hash, never in readable form).
• Identity and verification evidence — Ghana Card details and image, a selfie for liveness and likeness comparison, and where relevant proof of ownership or authority to manage a property.
• Property and tenancy records — listings, photographs, applications, agreements, rent schedules and tenancy history.
• Financial records — payments, receipts, arrears and accounting entries. We do not store full card numbers.
• Communications — messages sent between users on the platform, complaints, and support correspondence.
• Technical data — IP address, device and browser information, and pages visited.

3. Ghana Card and selfie processing

These are the most sensitive items we hold, so we describe them separately.

• Purpose.To confirm that a person is who they claim to be before they can list a property or enter a tenancy. This is the control that makes “verified landlord” mean something and is the platform’s principal defence against listing fraud.
• Storage. Held in private storage, never in a public bucket, and never served through public image URLs. They are not reachable by guessing a URL.
• Access. Opened only through a link that expires shortly after it is issued, and only by verification staff who are authorised to see it. Every time one is opened it is written to a record that cannot be edited or deleted — not even by an administrator.
• Not published. Your Ghana Card and selfie are never shown to other users. Other users see only the resulting verification tier and the type of checks completed.
• Not used for anything else. They are not used for marketing, not sold, and not used to train models.

4. Who else processes your data

We use third-party processors to run the service. Each receives only what it needs:

• Hosting and database — application hosting and our Supabase database and storage.
• Payments — our payment provider processes card and mobile-money transactions. Card details go to them, not to us.
• Email and SMS — notification delivery providers receive your address or number and the message content.
• Mapping — approximate property locations are rendered through a mapping provider.
• AI providers — where an AI feature assists with drafting or classification. AI never makes a decision about you: it cannot reject an application, approve a payment, deduct a deposit or terminate a tenancy.

5. How long we keep it

Proposed retention, subject to confirmation by counsel and to any overriding legal obligation:

• Account and profile data — while your account is open.
• Verification evidence — while your account is open and for a period afterwards to defend against fraud claims.
• Tenancy, payment and accounting records — retained after a tenancy ends because they are financial records and may be needed in a dispute.
• Audit and complaint history — kept, and only ever added to. These exist to be a lasting record, so individual entries cannot be picked out and erased.

6. Your rights

Under Act 843 you may request access to your personal data, correction of anything inaccurate, and deletion. You may also object to processing and ask us to restrict it.

Deletion has limits we would rather state up front than surprise you with: we cannot delete accounting entries, audit records or a tenancy history that another party also relies on, because those are records of events rather than profile data about you. Where we cannot delete, we will say so and explain why.

7. Security

Every record checks who is asking before it is handed over — we do not rely on hiding pages in the interface. Identity documents and other sensitive files are kept in private storage and can only be opened through a link that expires shortly after it is issued. Every administrative action is written to a record that can be added to but never edited or erased.

8. Contact and complaints

Data questions and requests: info@domicium.com. If you are not satisfied with our response you may complain to Ghana’s Data Protection Commission.