Privacy Policy

We collect account data (name, work email, password credentials), entity and KYB data (company name, registration details, country of operation, intended commodity and volume), contact preferences (phone number for SMS/WhatsApp alerts), and transaction data (purchase amounts, quantities, funding method, corridor, timestamps, and settlement stage history).

Identity verification data submitted through our KYB providers (currently Didit, with document uploads) is collected for compliance purposes. Uploaded documents are stored in access-controlled storage visible only to the submitting organisation and authorised reviewers.

• Operating the settlement pipeline and generating settlement certificates.
• Performing KYB, sanctions, and anti-money-laundering checks.
• Sending status alerts by email, SMS, or WhatsApp where you have opted in.
• Providing operations and stakeholder personnel with oversight of the corridors they are assigned to.
• Meeting legal, audit, and regulatory obligations.

Purchase and KYB data is shared on a need-to-know basis: the corridor partner fulfilling your purchase (for the Ghana gold corridor, LFG), authorised Canza operations staff, and compliance reviewers. Aggregate, non-identifying corridor metrics may be shown to stakeholder viewers. We do not sell personal data.

We use third-party processors including: cloud database and authentication hosting ([PLACEHOLDER: processor list]); identity verification (Didit); messaging delivery (Africa's Talking, when enabled); and market data providers. Each processes data under its own terms and our instructions.

Transaction and KYB records are retained for [PLACEHOLDER: retention period, e.g. 7 years] to satisfy financial-crime and audit obligations, even after account closure. Account and contact data is retained while your account is active. You may request deletion of data we are not legally required to keep.

Depending on your jurisdiction you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. Contact [PLACEHOLDER: privacy contact email]. Identity and transaction records subject to AML retention requirements cannot be deleted early.

Data is encrypted in transit and access is restricted by role. Data may be processed in countries outside your own; where required, transfers rely on [PLACEHOLDER: transfer mechanism]. Questions: [PLACEHOLDER: privacy contact email].