Draft — under legal review. This text may change before launch.
Privacy policy
This policy explains what personal data Mandat handles, why, who we share it with, how long we keep it and your rights.
Last updated:
1. Who we are
Mandat provides an AI marketing team to businesses in Ghana and Côte d’Ivoire. For the data of our customers’ own customers (website visitors, leads), the business using Mandat decides how it is used and Mandat processes it on their behalf. For account, billing and application data, Mandat decides how it is used.
Contact for privacy questions: the privacy contact address (to be published before launch).
2. What we collect
Applications: your name, business name, email, country, sector and, if you add them, phone, website and a note.
Accounts: name, email, workspace membership and role, terms acceptance, and security events such as sign-ins and approvals.
Business knowledge: the information you teach Mandat — services, prices, opening hours, policies and documents you upload.
Marketing work: plans, posts, images, approvals and their history, and an audit record of every action.
Your customers: messages sent through your website chat, lead details they choose to share (such as name, phone or email) and the appointments they book.
Connected accounts: the identifiers of your Facebook Page and Instagram account, post results the platforms return, and the access keys you grant. Access keys are stored encrypted in a separate secret store, never in our database, logs or AI prompts.
3. How we use it
To provide the service you asked for: plan, write, publish, answer, book, follow up and report.
To keep it safe: check every action against your rules, detect misuse and keep an audit record.
To review applications and contact you about the founding programme, with your consent.
We do not sell personal data and we do not use your data to train AI models.
4. AI models
Mandat sends the information needed for a task to an AI model run by a cloud provider under contract with us, which processes it to return an answer and does not use it to train its models. Only approved models are used.
6. How long we keep it
Workspace data is kept while your workspace is open. When you close it, workspace data is deleted, except records we must keep by law, such as invoices, and the minimum audit record needed to show what was done on your behalf.
Applications that do not lead to a workspace are deleted within 12 months.
Access keys for a connected account are deleted when you disconnect it or remove Mandat at Meta.
7. Your rights
You can ask to access, correct, export or delete your personal data, or object to how it is used. Your customers can make the same requests through you or directly to us; we will pass them to the business concerned where appropriate.
You can also complain to the data protection authority in your country: the Data Protection Commission in Ghana, or ARTCI in Côte d’Ivoire.
8. Security
Each workspace is kept separate from every other. Data is encrypted in transit; access keys are encrypted at rest; sensitive actions need a second factor; and every action is recorded.
9. Changes
We will post changes here and tell workspace owners about material ones in advance.