Loading…Loading…Effective date: September 25, 2026.
This policy covers visitors, buyers, sellers, staff users, and people interacting with TrustCart checkout links, storefronts, Discover, dashboards, support, and payment-protection workflows.
Information comes directly from users, sellers responsible for an order, devices and browsers, payment and messaging providers, identity or compliance providers, and platform activity. A seller may provide a buyer's fulfilment details when creating or managing an authorised order. TrustCart may combine records that are verified as belonging to the same person, including buyer and seller workspaces linked to the same account.
TrustCart uses information to authenticate users; create storefronts and checkouts; process and reconcile payments; connect orders to Buyer Center; prevent fraud; manage delivery, disputes, reversals, subscriptions and payouts; provide support; enforce plan limits; satisfy tax and legal duties; and improve platform reliability.
Depending on the activity and applicable law, processing is necessary to perform a contract, take requested pre-contract steps, comply with a legal obligation, protect users and the platform, pursue legitimate operational and security interests, or act with consent. Consent can be withdrawn for processing that relies on consent, without affecting earlier lawful processing.
Buyers' fulfilment details are shared with the seller responsible for that order. Seller storefront content is public when published. Data may be provided to payment, banking, hosting, storage, email, messaging, security, analytics, identity-verification, and professional service providers only as needed for their function. TrustCart may also disclose information where legally required or necessary to protect users and the platform. TrustCart does not sell personal information.
Current service categories include Paystack and participating financial institutions for payments and settlement; Meta for WhatsApp messaging; hosting and database infrastructure; Cloudinary or equivalent media storage; and configured email-delivery providers. These providers may process data under their own terms where they act independently, such as when a buyer supplies payment credentials directly to a payment provider.
Paystack handles card and supported payment credentials. TrustCart stores transaction references and status information, not full card numbers or Mobile Money PINs. KYC and dispute evidence receive restricted access but may need to be retained for compliance, fraud prevention, or legal claims.
When breached-password screening is enabled, TrustCart converts the proposed password into a one-way SHA-1 value and sends only the first five characters of that value to the Have I Been Pwned password-range service. The password and complete hash are not sent. TrustCart also records authentication failures, session activity, administrative actions, and security-setting changes to prevent abuse and investigate incidents.
Some providers may process or store information outside Ghana. Where this occurs, TrustCart uses appropriate contractual, organisational, and technical safeguards and considers the nature of the information, the destination, and applicable Ghanaian data-protection requirements.
Retention depends on the record and purpose. Account preferences may be removed after closure, while transaction, tax, payout, KYC, audit, fraud, and dispute records may be retained for statutory periods or while a claim, investigation, chargeback, or legal obligation remains.
Subject to the Data Protection Act, 2012 (Act 843) and applicable exceptions, individuals may ask whether TrustCart processes their information and request access, correction, objection, restriction, cessation of direct marketing, or deletion where appropriate. TrustCart may request information needed to verify identity and locate the relevant records. Users may also raise a concern with Ghana's Data Protection Commission.
TrustCart uses role-based access, authentication, transport encryption, password hashing, optional authenticator verification, rate limits, audit records, session revocation, and provider controls, but no online system is risk-free. Seller accounts are not intended for anyone under 18. TrustCart does not knowingly invite children to create independent seller accounts. Privacy requests go to hello@trustcart.app; security reports go to security@trustcart.app.