Young Cyber Knights Foundation · Bright Cyberhub

Privacy Policy

Effective date: 29 September 2026

This Privacy Policy explains how Young Cyber Knights Foundation (“YCKF”, “we”, “us” or “our”) collects, uses, shares, protects and retains personal data when you use the Bright Cyberhub mobile application and its companion apps (Bright Report, Bright Locate and Bright Car Locate), the website www.youngcyberknightsfoundation.org and our related services (together, the “Services”). YCKF is the data controller. We process personal data in line with Ghana's Data Protection Act, 2012 (Act 843) and other applicable law.

Please also read our Terms of Service. The Services are for people aged 13 and over.

1. Information we collect

Information you give us

Account and identity (KYC): full name, email address, phone number, password (stored only as a secure hash), role, the app you signed up in, email and phone verification status, and two-factor authentication settings.
Reports and evidence: descriptions of incidents, suspects, amounts lost, phone numbers, emails, websites or accounts involved, and photos, videos, voice recordings and files you attach, with your contact details if you choose to give them.
Emergency alerts: your name, phone number, the type of emergency, messages, photos or audio, and your location.
Devices and vehicles: device name, model and an app-generated device identifier, emergency contact number and theft reports; vehicle registration details, tracker identifiers and fleet membership.
Bookings, enquiries and applications: name, contact details and the information you give when you book a specialist, contact us, request account deletion, apply to volunteer or become a member, including any target phone numbers or emails you ask us to investigate.
Learning and portfolio: course enrolments, progress and certificates, and content you publish in a portfolio.
Payments: plan, amount, currency, date, payment status and the payment reference from Paystack or Google Play; for manual payments, the payment method, transaction reference, the receipt screenshot you upload and any note; coupons, activation codes, credits and referral rewards. We do not receive your full card number, CVV or mobile-money PIN.
Communications: messages you send us by email, contact form, WhatsApp, Telegram or phone, and messages you type into the website's AI chat assistant.

Information collected automatically

Location: precise or approximate GPS location, address and nearest police station, only when you use a feature that needs it (reports, emergency alerts, finding nearby services, current or live location sharing, device protection or vehicle monitoring) and have granted permission.
Security and log data: sign-in attempts, date and time, IP address, browser or device type, app version and, where available, approximate sign-in location; notification tokens; and actions recorded in our audit logs.
Cookies and local storage: the website uses essential cookies to keep you signed in and secure your session. The apps store your session securely on your device. We do not use advertising cookies or advertising identifiers, and the apps contain no ads.

Information from others

Payment status from Paystack and Google Play, delivery status from email and SMS providers, and information another person gives about you in a report, booking or location-sharing invitation.

2. App permissions

Location to add GPS details to reports and emergency alerts, show nearby police and fire stations, and share your location when you choose to.
Camera, microphone and photos to capture or attach photo, video and voice evidence.
Notifications to send case updates, security codes and emergency messages.

You can refuse or withdraw any permission in your device settings. The related features will then stop working, but the rest of the app will still work.

3. How we use information and why

To provide the Services (performing our contract with you): create and secure your account, receive and handle reports and emergency alerts, run location sharing, device and vehicle protection, bookings, courses and Premium plans, and provide support.
To protect life and safety (vital interests): share your location and report with responders when you raise an emergency.
With your consent: live or background location sharing, optional permissions and marketing messages. You can withdraw consent at any time.
To meet legal obligations: keep financial and tax records, respond to lawful requests from authorities and comply with court orders.
For our legitimate interests, balanced against your rights: prevent fraud, abuse and false reports; secure our systems; investigate misuse of the Services; improve the Services; and produce anonymous statistics.

We do not sell your personal data or use it for advertising.

5. International transfers

Some of our providers store or process data outside Ghana. When that happens we rely on providers with strong security commitments and contractual safeguards, and we transfer only what the service needs.

6. How long we keep information

We keep personal data only for as long as we need it for the purposes above. Our standard periods are:

Data	Kept for
Active account profile, settings and verification status	While your account is active
Live-location sessions and location points	30 days after the session ends
Cybercrime and emergency reports, evidence files and related notifications	90 days after submission (longer for deleted accounts and legal holds, below)
Identity details, account activity, reports, location history, devices and login records of a deleted or deactivated account	2 years after deactivation (the phone number is cleared at the end of this period)
Orders, payments, subscriptions, wallet and credit records, and the name and email needed to identify them	6 years after deactivation, then anonymised
Any record placed under legal hold because of an investigation, court order or other lawful request	Until the hold is lifted
Audit logs of staff actions and data exports	As long as needed for security and accountability

When a period ends, we delete the data or anonymise it so it can no longer identify you.

7. Deleting your account

You can ask us to delete your account at any time in the Bright Cyberhub app under Settings → Delete account, on our account deletion page, or by emailing yckfadmin@youngcyberknightsfoundation.org from your registered address. We verify the request before acting on it. Then:

your account is set to Inactive and the reason for closure is recorded;
you are signed out everywhere, your password, security codes and notification tokens are revoked, and linked devices stop sending location;
your email address and phone number are released so they can be used to register again; and
we email you to confirm.

Your account is not erased immediately. Because the Services deal with crime reports, emergencies, location tracking and payments, we keep a restricted copy of your identity details, account activity and financial records for the periods in section 6. This lets us meet legal and tax obligations, prevent fraud and abuse (for example, someone deleting an account to hide misuse of the Services), resolve disputes and respond to lawful requests from the police, courts and other authorities. The retained record is used only for those purposes, is available only to a small number of authorised administrators, and cannot be used to sign in or restore your account. If an investigation, court order or other lawful request requires it, we may place a legal hold that keeps the relevant records until the matter is closed.

We apply the same process when we deactivate an account for breaching our Terms of Service.

8. Your rights

Under the Data Protection Act, 2012 (Act 843) and other applicable law, you can ask us to:

confirm whether we hold your personal data and give you a copy;
correct data that is inaccurate or incomplete;
delete data we no longer need, subject to the legal retention described above;
stop or limit certain processing, or object to processing based on our legitimate interests; and
withdraw consent you have given, without affecting processing already carried out.

Contact us at yckfadmin@youngcyberknightsfoundation.org to use these rights. We may need to verify your identity and will reply within the time the law requires. If you are not satisfied, you can complain to Ghana's Data Protection Commission.

9. Security

We use encrypted HTTPS connections, hashed passwords, optional two-factor authentication, one-time codes, secure on-device session storage, role-based staff access, audit logs, and restricted access to retained records. No system is completely secure, so please use a strong, unique password and tell us straight away if you suspect unauthorised access. We will notify you and the relevant authorities of a data breach where the law requires.

10. Children

The Services are not for children under 13, and we do not knowingly collect their personal data. Users aged 13 to 17 should use the Services with a parent or guardian's permission. If you believe a child under 13 has given us personal data, contact us and we will deal with it. Reports about harm to a child are handled with extra care and may be passed to the appropriate authorities.

11. Changes to this Policy

We will update this Policy when our Services or the law change, post the new version here with a new effective date, and tell you in the app or by email about significant changes.

12. Contact us

Data protection enquiries: Young Cyber Knights Foundation, Ghana. Email yckfadmin@youngcyberknightsfoundation.org or call +233 20 145 4014.