Privacy Policy

SmeXpress (“SmeXpress”, “we”, “us”) runs an online platform at smexpress.app that helps small and medium-sized businesses in Ghana apply for, track and manage business loans. Loans are made by licensed partner financial institutions (“partner lenders”) whose products are offered on SmeXpress.

For the information you give us on the platform, SmeXpress is the data controller. When your application is passed to a partner lender, that lender is also responsible for the information it receives and uses to make and manage your loan, under its own privacy notice.

You can reach us at info@smexpress.app, on 055 858 5858, or at our office in Airport City, Accra.

We only ask for what we need to verify you, assess your business and manage your loan.

Your account

• Your name and email address, and whether you’ve verified the email address.
• Your password, which we store only as a one-way hash — we can never see it.

Your personal details and identity

• Phone number, date of birth, gender, place of birth, hometown, nationality, and postal and residential addresses.
• Your ID type and number (Ghana Card, passport or driver’s licence), a photo of you holding it, a passport photo and a utility bill.

Your business

• Business name, description, type, sector and registration number.
• Your registration certificate and other registration documents.
• Monthly and annual revenue, and six months of bank or mobile money statements.

Your loan applications

• The product, amount, term and purpose of each loan, how you plan to use it, and any existing loan balance.
• Supporting documents such as statements and post-dated cheques.
• What happens next: review notes, the decision, collateral received, disbursement date and repayment schedule.

Your guarantor

• Their full name, phone number, Ghana Card number, passport photo, business registration documents and bank statements.

Technical and usage information

• Your IP address and request details, which our servers log and use to keep the platform secure and limit abuse.
• A sign-in cookie that keeps you logged in (see Cookies).
• The emails and in-app notifications we send you, and any messages you send us.

We use your information for these purposes, each with a lawful reason under Act 843:

• To run your account — creating it, signing you in, verifying your email and resetting your password. Needed to provide the service you asked for.
• To review your business profile — checking your identity and business before you can apply. Needed for the service, and required by know-your-customer and anti-money-laundering laws.
• To assess your loan applications — our credit team reviews each application, and approved applications go to the partner lender. Needed for the service you asked for.
• To manage your loan — tracking collateral and disbursement, working out your repayment dates and reminding you before each one. Needed for the service and your loan agreement.
• To keep you updated — emails and notifications when your profile or application changes, and repayment reminders. These are part of the service, so you can’t switch them off while you have an application or loan with us.
• To keep SmeXpress safe — preventing fraud, misuse and unauthorised access. Our legitimate interest in protecting you, our partners and the platform.
• To meet our legal duties — keeping records and responding to lawful requests from regulators and law enforcement.

Decisions about your profile and your loans are made by people — our credit team and the partner lender — not by an automated system alone. We don’t send marketing emails; if we ever want to, we’ll ask you first.

We never sell your personal information. We share it only with:

• The partner lender for your loan product. When your application is approved, we send the lender your application details, and they may receive the documents they need to disburse and manage your loan. The lender may carry out its own checks, including with credit reference bureaus, under its own privacy notice.
• SmeXpress staff — loan officers and administrators who need it to review and manage your profile and applications. Access depends on their role.
• Service providers who run the platform for us, under contracts that only let them use your information to provide their service: Vercel (hosting and document storage), Neon (database), Hostinger (email delivery) and Upstash (security and rate limiting).
• Authorities such as courts, regulators and law enforcement, when the law requires it or to protect people from fraud or harm.
• A future owner of SmeXpress’s business, if it is sold or merged — and only under this policy’s protections.

Some of our service providers store or process information on servers outside Ghana, including in Europe and the United States. When that happens we rely on providers with strong security commitments and contracts that protect your information to a standard consistent with Act 843.

• Everything you send us travels over encrypted (HTTPS) connections.
• Passwords are stored as one-way hashes, and sign-in sessions use an encrypted cookie. Resetting your password signs you out on every device.
• Documents you upload are kept in private storage and are only shown to you and to authorised staff through the platform.
• Staff accounts are given only the access their role needs, and can be deactivated immediately.
• We limit repeated attempts to sign in, reset passwords and send emails, to block automated attacks.

No system is perfectly secure. If we discover a breach that puts your information at risk, we’ll tell you and the Data Protection Commission as the law requires.

• While your account is open, we keep your profile and applications so you can use the service.
• Loan and identity records are kept after a loan closes, or after you close your account, for as long as Ghana’s financial, tax and anti-money-laundering laws require — typically several years.
• Accounts that never applied for a loan can be deleted on request; see Your rights.
• Sign-in links for verification and password resets expire within hours to days and can only be used once.

When we no longer need information, we delete it or make it anonymous.

Under Act 843 you can ask us to:

• Access the personal information we hold about you and get a copy.
• Correct anything that’s inaccurate or out of date. You can update most of your profile yourself in the app.
• Delete your information, unless we must keep it by law or to manage a loan that’s still open.
• Object to how we use it, or withdraw consent where we rely on consent.

Email info@smexpress.app or call 055 858 5858. We may need to confirm your identity first, and we’ll respond within one month.

If you’re unhappy with how we’ve handled your information, you can complain to the Data Protection Commission of Ghana.

We use one essential cookie, which keeps you signed in. It’s encrypted, can’t be read by scripts on the page and is removed when you sign out. Without it you can browse the public pages, but you can’t use your account.

We don’t use advertising or analytics cookies. Our pages and emails load the Hanken Grotesk font from Google Fonts, so Google receives your IP address when that font loads.

When you give us someone else’s information — such as your guarantor’s — you confirm that they’ve agreed to it and that you’ve told them about this policy. We use their information only to assess and manage the loan they’re guaranteeing, and they have the same rights described in Your rights.

SmeXpress is for businesses and the adults who run them. You must be at least 18 to create an account, and we don’t knowingly collect information about children.

We’ll update this policy when our services or the law change. We’ll post the new version here with a new date, and if a change significantly affects how we use your information, we’ll email you before it takes effect.