Privacy notice
What we collect, and what we don't.
A plain-language version of how we handle your information. Written the way we'd want someone to write it to us.
Last updated: 27 July 2026
The short version
aeTech Digital Hub (“we”, “us”) is a Ghanaian engineering studio based in Accra. This notice explains what information we collect when you use our website or work with us, why we collect it, who sees it, and how you can ask us to change or delete it.
We collect as little as we reasonably can. We never sell your data. We don't use tracking cookies for ads. We hash your IP address before storing it. If you ever want your account or data deleted, one email does it.
Who's responsible for your data
aeTech Digital Hub is the data controller for personal information you give us through this site. You can reach us at:
What we collect, and why
Here's the complete list of what we collect and what we do with it.
Newsletter subscriptions
- What
- Your email address, optional name, and a hashed record of the IP address you subscribed from.
- Why
- So we can send occasional dispatches about our work, and so we can respond to any abuse (spam signups, etc.).
- How long
- Until you unsubscribe. Every email has an unsubscribe link.
Account sign-up
- What
- Your name, email address, hashed password (bcrypt), a hashed record of your sign-up IP, and a consent timestamp. If you sign in with Google, we also store your Google account ID and profile picture URL.
- Why
- So we can identify you when you sign back in, associate your work (briefs, invoices, projects) with your account, and give you access to your portal.
- How long
- For as long as your account exists. You can request deletion anytime — see below.
Project briefs
- What
- Everything you write into the brief editor — company name, industry, budget range, project goals, technical requirements, timelines, and anything else you enter voluntarily.
- Why
- So we can respond with a written scope and estimate. Without a brief, we can't quote work.
- How long
- Draft briefs until you submit or delete. Submitted briefs kept alongside the engagement for our commercial records. Non-engaged briefs pruned after 12 months.
Invoices and receipts
- What
- Client name, billing address, contact email, invoice line items, payment amounts, payment dates.
- Why
- For accounting, tax compliance, and issuing receipts. Ghanaian tax law requires we keep these records for six years.
- How long
- Six years from the end of the tax year in which the invoice was issued, then deleted.
Live chat messages
- What
- The content of messages you send us through the chat widget, your session ID, and (if you provided them) your name and email.
- Why
- So we can respond, and so we have context on prior conversations if you return.
- How long
- Chat sessions are retained for 90 days, then deleted.
Site usage (page views)
- What
- Which pages you visited, when, and a hashed record of your IP. We do NOT use Google Analytics or similar third-party trackers on this site.
- Why
- So we can understand which pages are useful and improve the site. This is our own lightweight analytics — no third-party ad networks are involved.
- How long
- 30 days, then aggregated and the individual records deleted.
Admin action logs (staff-only)
- What
- Which staff member did what admin action, when, and against which record. Only applies to aeTech staff, not clients.
- Why
- So we can audit sensitive operations like sharing an invoice or accessing a client's data.
- How long
- 90 days, then automatically deleted.
What we don't do
- We do not sell your data to anyone.
- We do not use Google Analytics, Facebook Pixel, or any advertising trackers on this site.
- We do not store your IP address in raw form. All IP addresses are hashed (SHA-256) at collection time so we can identify abuse patterns without keeping the actual IP.
- We do not use tracking cookies. The only cookies we set are strictly necessary — session cookies for authentication and a signed session ID for the chat widget.
- We do notread the content of files or projects we're building for you beyond what's needed to build them.
Third parties that see your data
We use a small number of trusted services to run our business. Each is a data processor acting on our instructions.
- MongoDB Atlas — where we store account, brief, invoice, and chat data. Data hosted in an EU region.
- Vercel— where this website is hosted. Vercel processes request logs briefly and does not retain personal data beyond what's needed to serve the site.
- Google (for “Sign in with Google”) — only used if you choose to sign in with Google. Google shares your name, email, and profile picture with us; we don't send them anything.
- Email provider (SMTP)— we use SMTP to send transactional emails (welcome messages, invoice links, newsletter). Email content passes through our provider's servers en route to you.
- SMS provider (Termii) — used only if we need to send you an SMS notification for a booking confirmation. Never for marketing.
We do not share your data with anyone outside these processors. In particular: no advertising networks, no data brokers, no analytics companies.
On what basis we hold your data
Depending on the data, we rely on one of the following bases from the Ghana Data Protection Act (Act 843) and equivalent provisions of GDPR / UK GDPR:
- Consent — for newsletter sign-ups. You can withdraw anytime by using the unsubscribe link in any email we send.
- Contract— for account, brief, invoice, and project data. We need this data to provide the services we've agreed to.
- Legitimate interest— for security logs, audit logs, and hashed-IP analytics. We've balanced this against your interests and take steps (like hashing IPs) to minimise the impact on your privacy.
- Legal obligation — for invoice and tax records we are required to retain under Ghanaian tax law.
Your rights
Under Ghana's Data Protection Act (Act 843), GDPR, and UK GDPR, you have the right to:
- Access a copy of the personal data we hold about you
- Correctdata that's wrong or incomplete
- Deleteyour data (with some exceptions where we're legally required to keep it — like invoice records for six years)
- Restrict how we process your data
- Object to processing based on legitimate interest
- Withdraw consent at any time
- Complainto a supervisory authority — Ghana's Data Protection Commission if you're in Ghana, your national data protection authority if you're elsewhere.
To exercise any of these rights, email ephraim@aetechdigitalhub.com. We'll respond within 30 days.
How we protect your data
Passwords are hashed using bcrypt with a work factor of 12. Session tokens are signed with a private key and marked HttpOnly + Secure. IP addresses are hashed with SHA-256 before storage. Sensitive admin actions (like sharing an invoice) are logged for accountability.
We build with security best practices from OWASP, NIST, and PTES. No system is perfectly secure — if we ever suspect a breach that affects your data, we'll notify you within 72 hours and report to Ghana's Data Protection Commission as required by law.
If you're outside Ghana
We serve clients in the UK and the US, so your data may be transferred to servers in the EU or US region of MongoDB Atlas and Vercel. We only work with providers who meet appropriate international transfer standards (Standard Contractual Clauses, EU-US Data Privacy Framework where applicable).
Children
Our services are for businesses and adults. We do not knowingly collect information from children under 16. If you believe we've collected data from a child, email us and we'll delete it.
Changes to this notice
We may update this notice occasionally. Meaningful changes will be announced via a banner on the site for at least 30 days. The “Last updated” date at the top of this page always reflects the latest revision.
Contact
Questions, requests, or complaints:
This notice is provided in plain language and reflects our actual practices. It is not legal advice. If you need a legal interpretation of your rights, please consult a qualified lawyer in your jurisdiction. For a formal complaint about our handling of data, contact the Ghana Data Protection Commission or your national supervisory authority.