Privacy Policy

Criba (“we”, “us”) runs a platform in Ghana where tenants share their place before they move out and people looking for a home can find it. We decide how your personal information is used, so we are the “data controller” under Ghana’s Data Protection Act, 2012 (Act 843).

Questions or requests about your information: hello@getcriba.app. This policy goes with our Terms of Service.

• Account details: your name, email address and password (stored only in scrambled form), and your phone number. If you sign in with Google, we receive your name and email from Google.
• Your profile: anything you choose to add, such as a photo and a short bio.
• Your listing: building or address, area, room type, monthly rent, move-out date, description and photos.
• Feedback: your answers to “how did it go?” after a conversation, and any note you add. Only you and our team can see them. Other members see only counts, such as how many people said it went well.
• Proof of authority (landlords and caretakers): a photo of a document showing you can let a property. Only our team sees it, and it is kept private in the same way as ID photos.
• Identity verification: your Ghana Card number, a photo of your card and a selfie. This is sensitive, so see section 5.
• What you told us when getting started: your answers to our short questions (for example, whether you are looking or listing, and the area or timing you care about) and the contact detail you gave.
• Payments: your plan, amounts, dates and payment reference. Card and mobile money details are handled by Paystack and your provider; we never see your card number or PIN. For manual mobile-money payments we see the payment reference and the details you give us to confirm it.
• Waitlist: if you join the waitlist, the name and email or phone number you give us, and what you told us about what you need, so we can invite you.
• Referrals: if you join through another member’s link, we record who referred you; every member also gets their own link. If you choose to earn from your circle, we also keep your earnings, payouts, the mobile money number you ask us to pay, and the terms you agreed to.
• Fraud checks on referrals: to spot people earning from themselves, we keep a scrambled (hashed) fingerprint of the card or mobile money account used for a payment, and of the browser you sign in from. These cannot be turned back into the original details. We compare them only between people in the same circle, and a match sends the case to a person at Criba to look at. It never blocks anyone by itself.
• Community: the posts, replies and upvotes you add in Community, which other signed-in members can see next to your first name and photo, and any reports you make about other people’s posts.
• Messages: what you write to other members through Criba is stored so both of you can read it. Our team can look at messages when investigating a report or a safety concern, and otherwise does not read them.
• Activity on Criba: which listings you start conversations about, alerts and notifications we send you, and your settings.
• Technical data: basic information our hosting and security tools record automatically, such as IP address, browser type and the pages requested, to keep the service running and safe.

• To run Criba (our contract with you): create your account, show your listing, let members message each other, and provide your plan.
• To keep people safe and trust high (our legitimate interests, and sometimes the law): verify phone numbers and identities, prevent fraud and misuse, and investigate reports.
• To tell you things: verification and payment updates, security notices, and alerts about listings that match what you are looking for. You can turn off listing-match emails in your profile settings.
• To understand and improve Criba (our legitimate interests): for example, how many people sign up and list, so we can fix what does not work. We look at this in aggregate.
• To meet legal duties: such as accounting and responding to lawful requests.

We do not sell your personal information, and we do not use it for third-party advertising.

Other members who are signed in can see what you put on your listing and profile: your first name, photo and bio if you add them, and the listing details and photos. We do not show your phone number or email address on your listing.

The member who referred you, if you joined through their link, is told your first name, and can see how many people they referred and how many of them have verified their phone and listed a place. They do not see anything else about you.

Our team can see your account information as needed to run and protect Criba. Only our review team can see your Ghana Card documents.

Service providers who help us run Criba, and only for that purpose:

• Supabase: our database, sign-in and file storage.
• Vercel: hosting our website.
• Paystack: processing card and mobile-money payments.
• Arkesel: sending one-time codes by SMS to your phone.
• Resend: sending our emails.
• Google: if you choose to sign in with Google.

We may also share information if the law requires it, to protect someone’s safety, or as part of a sale or restructuring of Criba (we would tell you first).

We ask for these only to confirm that people who list a place are who they say they are. They are stored in a private area that is not reachable from the public internet, opened only by our review team using short-lived links, and never shown on your listing or profile.

We keep them while your account is active so we can show you are verified, and delete them when you close your account, unless we must keep them to meet a legal duty or settle a dispute. Your Ghana Card number is also used to stop the same card being used on several accounts.

Our providers store and process data on servers that may be outside Ghana. When that happens we rely on providers that protect information to a high standard and are bound by contract to use it only for our purposes, as the Data Protection Act requires.

• Account, profile and listing information: while your account is open.
• Verification documents: as described in section 5.
• Payment records: for as long as the law requires us to keep accounting records.
• One-time SMS codes: only briefly, while they are valid.
• When you close your account, we delete or anonymise your personal information within a reasonable time, apart from what we must keep by law. Copies in routine backups are removed as those backups expire.

We use only the cookies Criba needs to work: they keep you signed in, remember simple preferences such as whether the admin sidebar is collapsed, and (a random code, kept for two years) help us tell when two members of a circle are using the same browser. We do not use advertising cookies. If that changes, we will update this policy and ask for your permission where the law requires it.

Under the Data Protection Act you can:

• ask what personal information we hold about you and get a copy;
• ask us to correct anything that is wrong or out of date (you can also edit most of it in your profile);
• ask us to delete your information, or to stop using it in certain ways;
• object to us using your information for a particular purpose, such as alerts, and withdraw consent you gave.

To use any of these, email hello@getcriba.app from the address on your account so we can be sure it is you. If you are not happy with how we handle your information, you can complain to Ghana’s Data Protection Commission.

We use encrypted connections, restrict who on our team can see what, keep sensitive documents in private storage, and limit how often someone can request or try a verification code. No system is perfectly secure, so please use a strong, unique password. If a breach affects you, we will tell you and the Data Protection Commission as the law requires.

Criba is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you think we have, tell us and we will delete it.

We may update this policy as Criba changes. We will update the date at the top and, for meaningful changes, ask you to review and agree again the next time you sign in.