Privacy Policy
The short version
- We collect what we need to run ISPilot for internet service providers and to answer enquiries. We do not sell personal data.
- If you buy internet from an ISP that uses ISPilot, that ISP decides how your data is used. We process it for them. Contact your ISP first.
- We use only the cookies needed to keep you signed in and secure. There are no advertising cookies.
- You have rights under Ghana's Data Protection Act, 2012 (Act 843), including access, correction and objection, and you can complain to the Data Protection Commission.
1. Who we are
ISPilot is a product of Cricket Telecommunication Ltd ("ISPilot", "we", "us"), a company registered in the Republic of Ghana under number C298642017, which owns and operates the ISPilot billing and network operations platform. Our registered office is at BM 166, Coffee Street, GK-0025-6129, Tema, Ghana. We are registered with the Data Protection Commission of Ghana as a data controller under registration number .
For privacy questions or to exercise your rights, contact our data protection contact at sales@crickettel.com.
2. What this policy covers
This policy explains how we handle personal data when we act as a data controller, that is, when we decide why and how the data is used. That covers:
- visitors to our website at ispilot.network;
- people who request a demo, contact sales or support, or sign up for a trial;
- the owners, staff and contacts of internet service providers that use ISPilot (our "Customers"), for managing our relationship, billing and payouts.
It does not cover data that our Customers put into their own ISPilot workspaces about their subscribers and staff. For that data, the Customer is the data controller and we are its data processor, acting only on its instructions under our Data Processing Terms. See section 10.
3. What we collect
Information you give us
- Enquiries and demo requests: name, company, email address, phone number, the size of your network and your message.
- Account sign-up: business name, contact person, email, phone, the workspace address you choose and your password (stored only as a secure hash).
- Billing: plan, invoices and payment references. Card and mobile money payments are handled by our payment processor (currently Paystack), so we do not receive your full card number. We receive a reference, the payment status and, for saved cards, a token and the card's last four digits.
- Payouts (ISPilot Pay): the mobile money wallet or bank account you register, the account name, and the verification information and documents we need for anti-money-laundering and fraud checks, such as business registration details and identification for directors or owners.
- Support: the content of your messages, chats and tickets, and any attachments.
Information collected automatically
- Technical and log data: IP address, browser and device type, pages requested, date and time, and error information, recorded by our servers for security and troubleshooting.
- Account activity: sign-ins, administrative actions and audit records in the platform dashboard.
Information from others
- Payment confirmations and transfer statuses from our payment processor.
- Results of verification checks from service providers and public registers, where we carry them out.
4. How and why we use it
The Data Protection Act, 2012 (Act 843) requires us to have a lawful reason for processing. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and workspace, providing the Service, and support | Performance of our contract with you, or steps you asked us to take before entering it |
| Billing, collecting Fees, operating ISPilot Pay and making payouts | Performance of our contract; compliance with legal obligations |
| Verifying identity and preventing fraud and money laundering | Compliance with legal obligations, including the Anti-Money Laundering Act, 2020 (Act 1044); our legitimate interest in preventing fraud |
| Keeping the Service secure and investigating misuse | Our legitimate interests in protecting the Service and our customers; legal obligations, including under the Cybersecurity Act, 2020 (Act 1038) |
| Answering enquiries and demo requests, and following up on them | Our legitimate interest in responding to people who contact us; steps before a contract |
| Sending service and account notices | Performance of our contract |
| Sending product news and offers | Your consent, or our legitimate interest for existing customers, always with an easy way to opt out |
| Improving the Service using aggregated, de-identified statistics | Our legitimate interest in developing our products |
| Keeping accounting and tax records, and responding to lawful requests | Compliance with legal obligations |
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
5. Who we share it with
We do not sell or rent personal data. We share it only with:
- Service providers who process it for us under contract and confidentiality: hosting and infrastructure, payment processing (Paystack), email and SMS delivery, and professional advisers such as accountants, auditors and lawyers;
- Mobile money operators and banks, to make payouts you have asked for;
- Authorities, where the law requires it, for example in response to a court order or a lawful request from a regulator, the Financial Intelligence Centre, the Ghana Revenue Authority or law enforcement, or to protect the rights, property or safety of our users or others;
- A buyer or successor, if our business is reorganised, sold or merged, subject to this policy.
6. International transfers
Our servers and some service providers may be located outside Ghana. When personal data is transferred abroad, we make sure it is protected as Ghanaian law requires, for example because the destination country provides adequate protection, or because the recipient is bound by contractual safeguards to protect it to the standard of Act 843.
7. How long we keep it
- Account and workspace data: while your subscription is active, then for 30 days after cancellation so you can reactivate or export, before deletion.
- Financial, payout and verification records: for as long as tax and anti-money-laundering laws require, generally at least five to six years after the transaction or the end of our relationship.
- Enquiries and demo requests that do not lead to an account: up to 24 months after our last contact, unless you ask us to delete them sooner.
- Server and security logs: usually up to 12 months, longer only if needed to investigate an incident.
When data is no longer needed, we delete or anonymise it. Backups are overwritten in their normal rotation cycle.
8. Security
We protect personal data with measures that include encryption in transit, encryption of stored secrets, hashed passwords, separation of each customer's data, access controls, login rate limiting, logging, hardened servers and regular security testing. No system is completely secure. If a breach affects you and the law requires it, we will notify you and the Data Protection Commission without undue delay.
9. Your rights
Under the Data Protection Act, 2012 (Act 843), and similar laws in other African countries where they apply to you, you have the right to:
- be informed about how your data is used, as this policy does;
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate, incomplete or out of date;
- ask us to delete or destroy data we are no longer authorised to keep;
- object to processing, including processing based on our legitimate interests;
- stop direct marketing at any time, by using the unsubscribe link or telling us;
- withdraw consent where processing is based on consent, without affecting earlier processing; and
- complain to the Data Protection Commission (see section 14).
To exercise a right, email sales@crickettel.com. We may need to confirm your identity first. We will respond within the time the law requires, and in any case within 21 days, telling you if we need longer. We do not charge for reasonable requests. Some rights have legal limits; for example, we must keep certain financial records even if you ask us to delete them, and we will explain if that applies.
10. If you are a customer of an ISP that uses ISPilot
If you buy internet access from an internet service provider that uses ISPilot (for example, through a hotspot login page, voucher or home broadband account), that ISP is responsible for your personal data. It decides what it collects (such as your name, phone number, usage, IP address and the devices you connect) and how it uses it, and its own privacy notice applies.
We process that data only on the ISP's behalf, to provide the platform it uses, under a contract that requires us to keep it confidential and secure. Please direct requests about your data, such as access, correction or deletion, to your ISP. If you contact us, we will pass your request on to the ISP and help it respond.
Payments you make through an ISP's portal may be collected by ISPilot on the ISP's behalf ("ISPilot Pay") and processed by Paystack. In that case, we use your payment details only to process and reconcile the payment, prevent fraud and meet our legal obligations.
11. Cookies
Our website and platform use only cookies that are strictly necessary to provide them: session cookies that keep you signed in and protect forms against cross-site attacks, and a cookie that remembers a signed-in session. They are not used for advertising or to track you across other websites.
Our web pages load fonts from Google Fonts, which means your browser connects to Google's servers and Google receives your IP address. Google's handling of that data is described in its own privacy policy. Payment pages are provided by Paystack, which may set its own cookies for security and fraud prevention.
12. Children
ISPilot is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 for our own purposes. ISPs using ISPilot are responsible for their own subscribers, including any obligations relating to minors.
13. Changes to this policy
We may update this policy from time to time. The "last updated" date shows when it last changed. If we make significant changes, we will tell Customers by email or in the platform before they take effect.
14. Contact and complaints
Data protection contact: sales@crickettel.com
Post: Cricket Telecommunication Ltd, BM 166, Coffee Street, GK-0025-6129, Tema, Ghana
If you are not satisfied with our response, you can complain to the Data Protection Commission, Accra, Ghana (www.dataprotection.org.gh). If you live in another country, you may also contact your local data protection authority, such as the Nigeria Data Protection Commission, Kenya's Office of the Data Protection Commissioner or South Africa's Information Regulator.
This policy should be read together with our Terms of Service, which include our Data Processing Terms for data we handle on behalf of ISPs.