Privacy Policy

This policy explains what Kompound records about you when you browse the platform, create an account, publish a listing or contact someone about a property — why we hold it, who else sees it, and what you can do about it.

It describes the personal data we handle as the party deciding how and why it is used. Ghana’s Data Protection Act 2012 (Act 843) calls that role the data controller, and the Data Protection Commission oversees it.

It does not cover what another user does with information you send them. When you contact an agent, a landlord or an agency through the platform, they receive your message and your contact details and handle them under their own arrangements, not ours.

When you create an account we ask for your name, your email address and your phone number, and you choose a password. We store phone numbers in the full international format, beginning with the country code, so that calls, SMS and WhatsApp messages reach you wherever you are — including from outside Ghana.

We never store your password itself. It is put through a one-way hashing function, and what we keep cannot be turned back into the password you typed.

After that, you give us information as you use the platform:

• listings you publish — the property’s address and location, price, description, photographs and documents
• enquiries, messages and viewing requests you send, including whatever you write in them
• searches you run and the filters you set, properties you save, and agents you contact
• profile details you choose to add — a photograph, a biography, service areas, business and social links
• for agents and agencies, your business details and, where you have one, your Real Estate Agency Council (REAC) licence number

Some parts of the platform ask you to prove who you are, or that you hold a licence, before they open up. Where you submit a verification request we collect the documents it needs — a national identity document or passport, a REAC licence for an agent, and registration documents for an agency — and our team reviews them.

Alongside the document we keep a record of the review — its status, who handled it, any note or reason they recorded, and, where the credential has one, its expiry date. We re-check those expiry dates daily so that a badge does not outlive the licence behind it.

We record the IP address the upload came from with every file you submit, including these.

Some information is recorded by the platform itself, whether or not you are signed in and without you entering anything.

Your IP address is stored exactly as we receive it. We do not shorten it, mask it or replace it with a code. An IP address can point to roughly where you are and, with help from your internet provider, can sometimes be traced back to a person, so we treat it as information about you rather than as a technical detail.

We record the following when you:

• open a property page — with the property, your browser’s user-agent string, the page you arrived from, and the time. Your IP address is used at the moment you open the page, to stop the same visitor inflating a property’s view count, but it is not kept with the record
• run a search — with your search text, the filters you applied, how many results came back, and the time
• sign in, or stay signed in — with the IP address and device the session was opened from
• ask to reset a password, recover a username or change your email — with the IP address the request came from
• upload a file, or change a privacy or profile setting — with the IP address, and, for settings, what the value was before and after

We also count failed sign-in attempts against an IP address so that nobody can sit and guess their way into other people’s accounts.

Kompound sets no cookies of its own. We write none for analytics, none for advertising and none for signing you in. Instead the platform uses your browser’s own storage, which stays on your device and is never attached automatically to requests the way a cookie is.

The network that delivers this site sits in front of it and may set a strictly necessary cookie of its own — the kind used to tell a real visitor from automated traffic. That is a security measure, it builds no profile of you, and we neither read it nor use it to study how you behave.

The rest of what we keep in your browser is:

• your sign-in token and basic account details, so you are not signed out on every page
• a second identifier that lasts only until you close the tab, used to group one visit’s activity
• activity events waiting to be sent to us, held briefly if the network drops so they can be retried
• conveniences you would notice the loss of — recent searches, unsent listing drafts, and which notices you have dismissed

Clearing your browser’s site data for Kompound removes all of it, including the visitor identifier, and a fresh one is generated on your next visit. Reload the page afterwards: until you do, the tab you already have open keeps using the old identifier it is holding in memory.

Two honest limits on that. Identifiers we have already received stay on the records they were attached to — we do not go back and erase them. And if you were signed in when you sent an enquiry, that enquiry carries your account alongside the identifier of the day, so an old and a new identifier belonging to the same signed-in person can still be matched up through the account. Clearing site data gives you a new identifier going forward; it does not unpick the history.

We use what we hold to:

• run the platform — show listings, run searches, deliver enquiries, arrange viewings and keep you signed in
• verify identities and licences, and decide whether to grant or withdraw a verification badge
• send you what you have asked for or need — enquiry alerts, viewing confirmations, password resets, security notices and account updates
• tell owners and agents how their own listings are doing, as counts and trends over time rather than as a list of who looked
• keep the platform safe — spotting duplicate or fraudulent listings, limiting abuse, and investigating reports
• understand which parts of the platform work, so we can improve them
• meet our legal obligations, and deal with disputes and claims

We do not sell your personal data, and we do not share it with advertising networks or data brokers.

Anything you publish is public. A listing — its photographs, description, price and location — can be seen by anyone, signed in or not, and may be picked up by search engines.

Your profile is more restrained. By default your phone number is hidden, your social links are hidden, and your profile is shown to other signed-in agents rather than to the open web. Contacting you by WhatsApp is allowed by default; contacting you by phone or by direct email is not. You can change any of this in your privacy settings.

When you send an enquiry or request a viewing, the person on the other side sees your name and the contact details needed to reply to you, whatever your profile shows to everyone else. That is the point of sending it — but it does mean an enquiry is a decision to share.

Administrators can see account records, verification cases and reports where their role requires it, and those views are logged.

We use outside services to run the platform. They act on our instructions and only get what their job needs:

• Email delivery — an email provider receives your email address and the contents of the message we are sending you
• SMS delivery — an SMS gateway receives your phone number and the text of the message
• WhatsApp — messages we send over WhatsApp pass through the WhatsApp Business platform, which is run by Meta and governed by its own terms
• Browser notifications — if you turn them on, your browser’s own push service delivers them, which means Google, Apple, Mozilla or Microsoft depending on the browser you use
• Hosting, storage and error reporting — the platform, its database, uploaded files and our diagnostic logs sit with infrastructure providers

Some of these providers operate outside Ghana, so running the platform means your information is processed abroad. We choose established providers and use them under their standard data-protection terms.

We will also disclose information where the law requires it, where a court or regulator properly demands it, or where it is needed to investigate fraud or protect someone’s safety. If the business is ever sold or reorganised, account records would transfer with it.

Signed in, you can edit or remove most of what you have given us, use your privacy settings to control what other users see, and choose which notifications reach you by email, SMS, WhatsApp or in the app. Browser notifications can be switched off in your browser at any time.

So the recording in sections 4 and 5 happens for everyone. Separately, the records the platform needs in order to run and to stay secure — sign-in sessions, uploads, settings changes, failed sign-in attempts — would be kept in any case.

You can also clear your browser’s site data at any time, which removes the visitor identifier described above.

We keep information for as long as your account is open and the purpose it was collected for still applies, and after that for as long as we need it to meet a legal obligation or to deal with a dispute or claim. Short-lived security records — password reset links, username recovery requests, expired sessions — stop being usable well before they stop being stored.

If you want more than that, or want to know exactly what is held about you, ask us through the contact form and we will deal with it individually.

Passwords are stored only as one-way hashes. Traffic between your device and the platform is encrypted. Identity documents are kept in private storage and reached only through short-lived links issued to reviewers. Sensitive actions — changing your email address, upgrading your account — ask you to confirm your password again, and you can end any signed-in session.

No platform can promise perfect security, and we do not. If something goes wrong that affects your information, we will act on it and tell the people who need to know.

Under the Data Protection Act 2012 (Act 843) you can ask what personal data we hold about you, ask us to correct it if it is wrong, object to how we are using it, and ask us to stop or to delete it. Where the law allows us to keep something despite your request, we will tell you what and why rather than simply refusing.

Ask through the contact form. We may need to confirm who you are first, so that nobody can obtain your data by pretending to be you.

If you are not satisfied with how we have handled it, you can complain to Ghana’s Data Protection Commission, which supervises compliance with Act 843.

The platform is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, please tell us and we will remove it.

We will update this policy as the platform changes or as the law requires. The revision date at the top of this page always tells you when the current version took effect. Where a change materially affects what we collect or why, we will do more than change the date.

This policy sits alongside our Terms of Service, which you also accept when you create an account.