Privacy Policy

Akoben is operated by Coskon Technologies Ltd, a company registered in Ghana with its office at Plot 46 Block D Adumasa, Santasi, Kumasi. For the personal data your organisation puts into Akoben, your organisation is the data controller and Coskon Technologies is the processor acting on your instructions. For the account and billing data we hold about you directly, we are the controller.

• User account data — name, email address, phone number, job title, employee ID, role, and sign-in timestamps.
• Organisation records — company name, address, contact details, branding, subscription state, and facility, building, floor and room hierarchy.
• Work orders — descriptions, priorities, assignments, comments, time entries, checklists, and completion locations where a technician records one.
• Assets — equipment registers, serial numbers, meter readings, depreciation and maintenance history.
• Inventory — stock items, quantities, transactions and purchase orders.
• Financial records — invoices, payments, expenses and budgets you enter. Card details are not among them; those stay with Paystack.
• Uploaded attachments — photographs and documents attached to work orders, assets and contracts.
• Audit logs — a record of who changed what and when, including the acting user and timestamp.
• Security module records — where you use it: visitor logs, patrol scans, incident reports, vehicle logs and access control events.

Akoben runs on Supabase, a managed PostgreSQL platform. Your data is stored on Supabase cloud infrastructure and the application is hosted outside Ghana. Data is not hosted in Ghana, and processing therefore involves a transfer of personal data outside the country. Data is encrypted in transit and at rest by the underlying platform. If your organisation is subject to a requirement that data remain in Ghana, tell us before you onboard — Akoben cannot meet that requirement today.

Every record carries a company identifier, and row-level security is enforced in the database itself rather than only in the application. A request that is not scoped to your company returns nothing, even if it is crafted by hand against the API. Server-side functions re-check your membership of a company before returning anything. Roles are scoped per company, so holding an administrator role in one organisation grants nothing in another.

Accounts sign in with an email address and password. Passwords are hashed by the authentication provider and are never visible to us or stored in the application database. Time-based one-time password (TOTP) multi-factor authentication is available and can be enabled per user from Settings; where it is enabled, sensitive records require the stronger authentication level before they can be read. Sessions sign out automatically after 30 minutes of inactivity.

We use the following third parties. This list reflects the services the application actually calls; we will update it before adding another.

Email and SMS are only sent where your organisation has enabled the corresponding notification. Push notifications are only sent to devices that have granted permission.

We process your data to run the service you have asked for: authenticating users, storing and displaying your records, sending the notifications you configure, and generating your reports. No billing takes place during the pilot. We also use aggregate technical information — error reports and performance measurements — to keep the platform working.

We do not sell, share or use your operational data to train anything.

What you can do today:

• Export records from the reporting module to CSV, Excel or PDF at any time.
• Edit or correct any record you have permission to change.
• Deactivate a user, which removes their access while preserving the audit trail of what they did.

What is not automated yet, stated plainly:

• There is no self-service button that deletes an entire company workspace. Email us and we will carry the deletion out manually.
• There is no published retention schedule that expires old records automatically. Data you enter is kept until you or we delete it.
• Audit logs are deliberately retained even when the records they describe change, because their purpose is to be tamper-evident.

Nothing is deleted automatically if you leave the pilot programme; ask us and we will remove your data, and exports remain available until then.

If you are in Ghana, the Data Protection Act 2012 (Act 843) gives you rights over your personal data, including access, correction and objection. These are set out, together with how to exercise them and how to reach the Data Protection Commission, on our Data Protection page.

Akoben is in an active pilot programme and this document will change as the product does. The "Last updated" date at the top records the current version. Material changes will be notified to company administrators by email.