Privacy Policy

ASH Glo REFER (“ASH Glo”, “we”, “us”) operates a digital marketplace and referral platform available at https://growrefer.app and as the mobile app “ASH Glo” (bundle ID app.growrefer.ashglo).

• Data controller: ASH Glo REFER, Douala, Cameroon.
• Privacy contact: privacy@growrefer.app
• Support: https://growrefer.app

This policy explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have.

This policy covers:

• the ASH Glo web app and the iOS and Android apps;
• account creation, marketplace browsing, bookings, messaging and reviews;
• the referral programme and commission ledger;
• wallet balances, payment collection and payouts.

It does not cover third-party sites or services you reach from ASH Glo (for example a provider’s own social media), or how a service provider you book handles information you give them offline.

3.1 Data you give us

3.2 Collected automatically

3.3 From third parties

• Social sign-in (Google, Apple): your name, email and a provider user ID, if you sign in that way. Apple’s “Hide My Email” relay is supported.
• Payment processors: transaction status, reference, amount, currency, masked payment identifiers, payout status.
• No data brokers. We do not buy personal data, and we do not run third-party advertising SDKs.

3.4 What we never store

We never receive or store your Mobile Money PIN, your full card number, CVV or your bank login. Card details are entered directly with our payment processor. We only receive a reference and a status.

3.5 Children

ASH Glo is not intended for anyone under 18. We do not knowingly collect data from children. If we learn we have, we delete it — contact privacy@growrefer.app.

We do not use your data for automated decisions that produce legal effects on you. Commission calculation is a deterministic rule (level 1 / 2 / 3 amounts), not profiling.

Because ASH Glo moves money, some processing is unavoidable and is described here explicitly:

1. Activation. A one-time activation fee unlocks earning. We create a payment reference and pass your phone number and amount to our Mobile Money processor.
2. Verification. The processor confirms the payment through a signed server-to-server callback. We verify that signature before crediting anything. Unverified callbacks are rejected and logged.
3. Ledger entry. Each verified payment writes an immutable ledger record: amount, currency, reference, status, timestamp and the account it belongs to.
4. Commission attribution. When your account activates, the system walks up to three levels of the referral chain and writes a commission entry for each eligible upline member. Referrers must themselves be active to earn.
5. Payout review. Withdrawal requests are reviewed by an authorised administrator before payment. Reviewers see the amount, destination and account history — enough to detect fraud, and no more.
6. Retention. Financial records are retained for the statutory accounting period even after you close your account (see section 9).

Your network is not public. Members see aggregate counts and earnings for their own branches; member identities below level 1 are not exposed.

We do not sell your personal data. We share it only with:

Between users: when you book a provider (or a client books you), the other party sees your display name, avatar, the booking details and your messages. Reviews you publish are visible to everyone, attributed to your display name.

Our processors operate outside Cameroon. Where data leaves Cameroon or the EEA we rely on the processor’s contractual safeguards (including Standard Contractual Clauses where applicable) and on their published security certifications. Contact us for details on a specific transfer.

• Encryption in transit (TLS) and at rest.
• Row-level security on every database table: policies restrict each record to its owner, the counterparty in a booking, or an authorised administrator. Privileged database functions are restricted to service roles.
• Passwords are hashed by our authentication provider; we never see them.
• Private storage buckets for avatars and portfolio media, served through short-lived signed URLs with per-object visibility checks.
• Signature verification on every payment webhook; replayed or unsigned callbacks are rejected.
• Rate limiting on public endpoints and storefronts.
• A security audit log for privileged and financial actions, plus automated regression tests confirming anonymous users cannot read protected tables.
• Role-based admin access; administrative roles are stored separately from user profiles to prevent privilege escalation.

No system is perfectly secure. If a breach affects your rights we will notify you and the competent authority without undue delay.

You can:

• Access the data we hold about you;
• Correct inaccurate data (most fields are editable in Settings);
• Delete your account — Settings → Delete account. This removes your profile, listings, media and messages. Financial ledger entries are retained in pseudonymised form for the statutory period, and pending withdrawals must be settled first;
• Export your data in a portable format;
• Object to or restrict processing based on legitimate interests;
• Withdraw consent at any time (location and notification permissions in your device settings; marketing via the unsubscribe link);
• Complain to the competent Cameroonian authority (the data protection authority designated under Law No. 2024/017) or, for EEA/UK users, your local supervisory authority.

Requests: privacy@growrefer.app. We respond within 30 days and may ask you to verify your identity.

• Strictly necessary storage: session tokens, your language (EN/FR) and theme (light/dark) preference. No consent required.
• No advertising cookies. No cross-site tracking. No third-party ad SDKs.

The mobile app uses local storage for the same purposes and does not use the advertising identifier (IDFA/AAID).

For Apple’s App Privacy and Google Play’s Data Safety forms, ASH Glo declares:

• Linked to you: contact info (name, email, phone), user content (photos, messages, reviews), identifiers (account ID), financial info (transaction history, payout destination), coarse location (optional), usage data, diagnostics.
• Used for tracking across apps or sites: none.
• Purposes: app functionality, analytics, and fraud prevention/security only.
• Data deletion: in-app account deletion is provided, plus a web request path at privacy@growrefer.app.
• Data encrypted in transit: yes.

We will post any change here and update the “Last updated” date. For material changes we will notify you in the app or by email before they take effect.

• ASH Glo REFER, Douala, Cameroon
• Email: privacy@growrefer.app
• Support: https://growrefer.app