Effective date: 10 August 2026
We collect account details such as name, email, and login activity, along with workspace and estimation data needed to provide ExactoCost services. Where a referral or Brand Growth Partner programme is enabled, we also collect referral attribution signals described in section 5.
We use data to authenticate users, deliver product features, process subscriptions, attribute eligible referrals, calculate partner compensation, communicate service updates, prevent abuse, and support customer requests.
Payments are processed by Paystack. ExactoCost does not store full card numbers or CVV. We retain tokenized payment references and limited card metadata required for billing, fraud prevention, and subscription lifecycle management.
ExactoCost uses secure, HttpOnly session cookies for authentication and account security. We also apply rate limiting and request-level protections to reduce unauthorized access.
When referral capture is enabled, we may also set a short-lived referral cookie named
exacto_referral_state to remember a valid referral touch for attribution
at registration. That cookie expires after 30 days and is not used for advertising
profiles.
ExactoCost may operate a Brand Growth Partner / referral programme. When enabled, we process referral codes and related attribution data so we can determine which partner (if any) introduced a subscriber, calculate commission or retainer amounts, and keep an auditable compensation ledger.
Typical referral data includes: the referral code or campaign identifier, time of the referral touch, limited technical diagnostics (such as IP address and user-agent) used for fraud and integrity checks, and the locked acquisition identity created when an eligible user registers.
Raw referral-touch diagnostics are ordinarily deleted or irreversibly de-identified within 90 days. Financial and tax records supporting commission, withholding, and remittance (including partner invoices, payout evidence, GRA remittance records, and withholding certificates) are retained for at least seven (7) years, or longer where required by law or an unresolved audit or dispute.
Authorised Brand Growth Partners may receive role-restricted customer-success or onboarding information needed for an assigned support task (for example name, business contact details, subscription tier, and relevant support history). Partners do not receive card data, Paystack authorisation codes, passwords, security secrets, or unrelated customer records. Commission statements provided to partners use pseudonymous subscriber references unless a separate lawful basis and workflow expressly require limited identifiable fields.
ExactoCost does not provide a prospect-list store. Personal data of prospective subscribers that a Brand Growth Partner collects for an ExactoCost campaign (Prospect Information) is processed by the Partner as a processor on our documented instructions, outside this application, under Ghana's Data Protection Act, 2012 (Act 843) and the partnership agreement. Partners must not upload prospect names, contact details, or message extracts into ExactoCost.
We retain account, billing, referral-attribution, partner-compensation, and operational records for as long as needed to provide the service, meet legal and tax obligations, resolve disputes, and enforce agreements. Financial and tax records for partner compensation follow the seven-year retention described in section 5 unless a longer period is required.
You may request access, correction, or deletion of eligible personal data, subject to legal and operational constraints (including retention required for billing, tax, fraud prevention, and dispute resolution).
Contact: support@exactocost.com
Your data may be processed in jurisdictions outside your home country where our service providers operate. We apply safeguards appropriate to the processing context.
We may update this policy to reflect legal, technical, or product changes. Material updates will be communicated through email or in-app notice.