Privacy Policy

This Privacy Policy explains how Klosa Technologies Inc. (“Klosa”, “we”, “us”, or “our”) collects, uses, shares, and protects your information when you use the Klosa mobile app, our website at klosa.app, and related services (together, the “Services”). Klosa is a regulated financial-services provider that lets members of the Ghanaian diaspora, primarily in Canada, send money to Ghana, pay bills, and manage payments for family.

By using the Services you agree to this Policy. We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Ghana’s Data Protection Act, 2012, and other applicable privacy laws.

Information you provide

• Identity and contact details: your first, middle, and last name, date of birth, email address, mobile phone number, residential address, and occupation.
• Account credentials: your password (stored only as an irreversible hash) and, if you enable it, a device biometric unlock.
• Your remittance corridor: your country of residence and the destination country you send to.

Identity verification (KYC)

To meet our legal anti-money-laundering obligations, we collect a government-issued photo ID (front and back), a selfie used to confirm the ID belongs to you, and optionally proof of address. These documents are uploaded directly to encrypted storage located in Canada and are not stored on the general app servers.

Transaction and recipient information

When you send money or pay a bill, we collect the transaction details (amounts, currencies, and history) and the recipient information you enter, including the names, phone numbers, and mobile-money or bank payout details of your beneficiaries and family members, and bill account references such as an electricity meter, TV smartcard, school, or water account number.

Payment information

Card and wallet payment details (including Apple Pay and Google Pay) are collected and processed directly by our payment processor and are not stored on Klosa’s servers.

Information collected automatically

• Device information: a unique device identifier and platform, used to secure your account and recognize your devices.
• Push notification tokens: used to deliver transaction and security alerts.
• App and log data: basic interaction and diagnostic data used to operate and secure the Services.

Information from third parties

When you type your address, our address-autocomplete provider (Google) processes the text you enter to suggest matches. We may also receive verification results from identity-verification and sanctions-screening providers we use to comply with the law.

We do not collect your device’s GPS location or access your contacts.

We use your personal information to:

• Provide, operate, and maintain the Services;
• Verify your identity, authenticate your access, and send one-time verification codes (OTPs);
• Process your transfers, bill payments, and related transactions;
• Detect, prevent, and investigate fraud, and comply with anti-money-laundering, sanctions-screening, and other legal obligations;
• Provide customer support and send transactional and security notifications; and
• Maintain the security of, and improve, the Services.

When you enter your mobile phone number in the Klosa app to sign up, log in, verify your number, reset your password, or verify a new device, you consent to receive one-time verification codes (OTPs) and other transactional, account-related text messages from Klosa. These messages secure your account. We do not send marketing or promotional text messages.

No mobile information, including your phone number and the fact that you opted in to receive SMS, is sold or shared with third parties or affiliates for their marketing or promotional purposes. Phone numbers used for SMS are shared only with our messaging providers strictly to deliver the messages you requested.

• Message frequency varies with your activity (for example, each sign-in or password reset generates a code you request).
• Message and data rates may apply, depending on your mobile carrier and plan.
• Help: for assistance, email support@klosa.app.
• Opt out: because these codes are required to secure your account, they are sent only when you request access. You can stop receiving them by discontinuing use of the app or contacting support; where supported, replying STOP unsubscribes you from further messages.

We do not sell your personal information or share it for third-party marketing. We share it only to operate the Services and as required by law, with the following categories of recipients:

• Payment processors: to fund your transactions (card, Apple Pay, and Google Pay via Stripe; bank transfers via Interac).
• Payout partners in Ghana:to deliver your money and bill payments (Fidelity Bank Ghana for mobile-money and bank payouts; expressPay for bills). Completing a payout necessarily shares the recipient’s payout details with these partners.
• Messaging providers: to deliver texts, emails, and push notifications (Twilio for SMS to Canada/US numbers; UBSApps for SMS to Ghana numbers; Resend for email; Expo and Firebase for push).
• Identity verification and compliance providers: to verify your identity and screen against sanctions/PEP lists, and Google for address autocomplete.
• Cloud infrastructure: Amazon Web Services, for hosting and encrypted document storage located in Canada.
• Authorities: regulators, law enforcement, and other parties where required to comply with the law or lawful requests.
• Corporate transactions: a successor entity in a merger, acquisition, or similar transaction, under appropriate confidentiality protections.

Klosa is based in Canada and stores customer data and identity documents in Canada (Amazon Web Services, Montreal region). To provide the Services, some information is processed outside Canada:

• United States: our payment, messaging, push notification, and address-autocomplete providers.
• Ghana:our payout and bill-payment partners and our Ghana SMS provider. Sending money to Ghana necessarily transfers the recipient’s payout details to partners located there.

Where information crosses borders, we use contractual and technical protections and require providers to protect it consistent with this Policy and applicable law.

The app asks for certain device permissions, each tied to a specific feature. You can review and change these at any time in your device settings.

• Camera: to capture your ID and selfie during identity verification.
• Photos: to upload identity documents and a profile picture.
• Face ID / fingerprint (biometrics): to unlock the app. Your biometric data stays on your device and is never sent to Klosa.
• Notifications: to send transaction and security alerts.
• Microphone: reserved for optional voice features, used only if you choose to enable them.

The app does notaccess your device’s location or your contacts.

We keep personal information for as long as your account is active and as needed to provide the Services. As a regulated money-services business, we are legally required to retain identity-verification and transaction records for a period set by law (generally several years) after your last activity or account closure, even if you delete your account. When information is no longer required, we securely delete or anonymize it.

We use administrative, technical, and physical safeguards to protect your information, including: encryption in transit (TLS) and encryption of sensitive data at rest; additional field-level encryption (AES-256-GCM) for payout details; irreversible hashing of passwords (Argon2id) and one-time codes; encrypted, access-controlled storage of identity documents; and strict access controls with signed, short-lived access tokens. No method of transmission or storage is completely secure, but we work continuously to protect your information and limit access to authorized personnel and providers.

Subject to applicable law, including Canada’s PIPEDA, Ghana’s Data Protection Act, 2012, and applicable U.S. state privacy laws, you may:

• Access a copy of the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your information and close your account;
• Withdraw consent, noting that some information is required to provide the Services or to meet legal obligations;
• Object to or restrict certain processing; and
• Complain to a privacy regulator.

Deleting your account and data

You can request deletion of your account and associated personal data from within the app or by emailing privacy@klosa.app. We will delete the data we are not legally required to keep; information subject to regulatory retention (such as transaction and identity-verification records) is kept for the required period and then deleted.

The Services are not directed to individuals under the age of majority in their province, territory, or country of residence, and we do not knowingly collect their personal information. If you believe a minor has provided us information, contact us and we will delete it.

The Services rely on third-party providers (such as Stripe and Google) that have their own privacy policies. This Policy does not cover, and we are not responsible for, the privacy practices of third parties. We encourage you to review their policies.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice through the app or by email.

If you have questions about this Policy or how we handle your information, or to exercise your rights, contact our privacy team at privacy@klosa.app.

Klosa Technologies Inc.
61 Carrol Street, Kitchener, Ontario, Canada

If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada. See also our Terms of Service.