Privacy Policy

1. Who we are

Web Rabbit Payments is a payment and messaging platform operated by Web Rabbit Media ("we", "us", "our"). This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have. It applies to our website, the merchant dashboard, our hosted checkout, and our APIs.

2. Who this policy covers

• Merchants — businesses and individuals who hold an account with us, and the people who represent them (owners, directors, team members).
• Customers — people who pay a Merchant through our checkout or a Merchant's integration.
• Visitors — anyone who browses our website or documentation.

For Customer payments, the Merchant decides what they sell and how they handle their customer relationship; we process the payment. Each Merchant is responsible for its own privacy notice and terms. This policy does not cover what a Merchant does with data on its own systems.

3. Data we collect

• Account data — name, email address, password credentials (stored hashed by our authentication provider), profile photo, and login method such as Google or GitHub.
• Business data — business name, website, product category, location, referral source, brands, and team members you invite.
• Verification (KYC/KYB) data — identity document images, selfie or liveness images, date of birth, address, company registration details, tax identifiers, and beneficial ownership information.
• Payout data — bank name, account name and number, branch details, and mobile money wallet details.
• Transaction data — amount, currency, fee and net amount, mobile network, payer phone number and name where provided, references, status, timestamps and provider responses.
• Technical data — IP address, device and browser type, pages viewed, API request metadata, and error logs.
• Communications — messages you send us for support, and records of the transactional emails we send you.

We do not collect or store full card numbers. Payments are processed through licensed payment partners.

4. Where the data comes from

• Directly from you when you sign up, complete verification, add payout details, or contact us.
• Automatically as you use the dashboard, checkout, website or API.
• From our payment partners, banks and mobile network operators — for example account-name verification results and transaction outcomes.
• From identity, sanctions and fraud-screening providers where checks are required.

5. How and why we use it

• To create and operate your account and provide the dashboard, API and checkout.
• To process collections, calculate fees, settle balances and make payouts.
• To verify identity and business details and meet know-your-customer and anti-money-laundering obligations.
• To detect, investigate and prevent fraud, abuse and prohibited business activity.
• To send transactional emails such as payment receipts, payout notifications, verification updates, password resets and team invitations.
• To provide support and respond to your questions.
• To keep records, resolve disputes and comply with legal, tax and regulatory requirements.
• To monitor performance, debug issues and improve the platform.

We do not sell personal data, and we never use verification documents for advertising.

Promotional SMS from Web Rabbit merchants. If you pay a merchant through Web Rabbit, the phone number used for that payment and the type of business you bought from may be used to send you promotional SMS from other Web Rabbit merchants in similar categories. Merchants never receive your number; they only see a masked form (for example 024***9847) and whether the message was delivered. You will get at most two of these messages a week, every message says who it is from, and you can stop all of them at any time by replying STOP or emailing hello@webrabbitmedia.com. Contacts a merchant uploads are only included if that merchant chooses to share them with the network.

6. Our legal bases

• Contract — to provide the services you signed up for.
• Legal obligation — for KYC/AML checks, tax and record-keeping.
• Legitimate interests — for security, fraud prevention, service improvement and business operations.
• Consent — for optional communications such as product updates, which you can withdraw at any time.

7. Who we share it with

Our Third-Party Service Providers Privacy Notice identifies confirmed providers and explains these disclosures in more detail.

• Payment partners — our licensed payment service provider and aggregator, used to process collections, verify wallet names and execute disbursements.
• Banks and mobile network operators — to move funds and confirm account details.
• Infrastructure providers — our database, authentication, storage and edge hosting provider, and our CDN and API gateway provider.
• Email provider — used to deliver transactional and authentication emails.
• Verification and screening providers — where identity, sanctions or fraud checks are required.
• Professional advisers — accountants, auditors and lawyers, under confidentiality.
• Regulators and law enforcement — where we are legally required to disclose, or to establish or defend legal claims.
• Acquirers — if our business is reorganised, merged or acquired, subject to this policy continuing to apply.

Merchants can see the transaction data relating to payments made to them, including the payer's phone number and name where the network provides it.

8. International transfers

Some of our providers operate outside Ghana. Where personal data is transferred abroad, we use reputable providers and rely on appropriate contractual safeguards to keep the data protected to a standard consistent with this policy and applicable law.

9. How long we keep it

• Account and business data — for as long as your account is active.
• Verification (KYC/KYB), beneficial ownership, screening and risk records — for at least 5 years after the business relationship ends.
• Transaction, payout and settlement records — for at least 5 years from the date of the transaction.
• Longer where a law, regulator, investigation or legal claim requires it. See our AML, CTF & Sanctions Policy.
• Technical logs — for a shorter operational period, usually months rather than years.

When data is no longer needed we delete it or irreversibly anonymise it.

10. Security

We use encryption in transit, access controls and role-based permissions, row-level security on our database, hashed storage of API secret keys and passwords, private storage buckets for verification documents with staff-only access, and audit logging of administrative actions. No system is perfectly secure, so we also ask you to protect your own credentials and API keys and to tell us promptly if you suspect a compromise.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion, object to or restrict certain processing, request a portable copy, and withdraw consent for optional communications. Some data must be retained for legal reasons even if you ask us to delete it. To exercise a right, email us at the address below. If you are a Customer of a Merchant, contact that Merchant first, and we will support them in responding.

12. Cookies and analytics

We currently use only essential cookies and browser storage to keep you signed in, protect sessions, complete requested activity and remember essential dashboard preferences. We do not currently set non-essential advertising or behavioural-tracking cookies. See our Cookies Policy for details and browser choices.

13. Children

Our services are for adults operating a business. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

14. Changes to this policy

We may update this policy as our services or the law change. The "Last updated" date above reflects the latest version, and material changes will be communicated by email or in the dashboard.

15. Contact

For privacy questions or requests, email hello@webrabbitmedia.com or call +233 59 896 9229.