Privacy Policy — Pratick Auth
Last updated: 20 July 2026
This Privacy Policy explains how PRATICK ("Pratick", "we") collects, uses, stores, and protects personal data in connection with the Pratick Auth platform, portal, mobile application, and API (the "Services"). We process personal data in accordance with Togolese Law No. 2019-014 on the protection of personal data, applicable ECOWAS frameworks, and, where applicable to our clients, the EU General Data Protection Regulation (GDPR).
1. Who this policy covers
- Client representatives: people who register and operate business accounts on behalf of our clients.
- End recipients: individuals whose phone numbers our clients submit through the API in order to receive one-time passwords or transactional messages. For this data, our client is the data controller and Pratick acts as a processor (see Section 7).
2. Data we collect
Account and KYC data (from client representatives): organization name, representative name, email address, phone number, password (stored only as a salted bcrypt hash), tax identifiers, billing address, and identity and business registration documents submitted for verification.
Operational data: wallet balance and transaction ledger, payment references and metadata from our payment partners (we do not store full card or mobile-money credentials), API usage records, activity logs, message dispatch and delivery records.
End-recipient data (on behalf of clients): phone numbers, message dispatch metadata, delivery status, and the verification codes themselves, which are stored only in hashed form and cleared upon verification or expiry.
Technical data: IP addresses, device and browser information, and log data generated when you use the portal or API.
3. Why we process data
- To provide the Services: account management, message dispatch, verification, billing.
- To meet legal and regulatory obligations: business verification (KYC), fraud and abuse prevention, accounting.
- To secure the platform: authentication, rate limiting, abuse detection, audit logging.
- To communicate with you: service notifications, verification emails, support.
- With your consent where required: product news and marketing communications, which you can withdraw at any time.
We do not sell personal data. We do not use end-recipient phone numbers for our own marketing.
4. Storage and security
Data is hosted with our infrastructure providers in the European Union (database and file storage located in the eu-west-3 / Paris region). Security measures include: encryption in transit (HTTPS/TLS); passwords stored as bcrypt hashes; verification codes stored only as hashes and purged after use or expiry; KYC documents held in private storage accessible only to authorized personnel through authenticated administrative systems; API keys masked in logs; and access controls separating production systems by function.
No system is perfectly secure. In the event of a personal data breach creating risk for individuals, we will notify the competent authority and affected parties as required by applicable law.
5. Retention
- Account and KYC data: for the life of the account and thereafter as required by commercial, tax, and anti-fraud obligations.
- Message and activity logs: retained for operational, billing, and audit purposes for a limited period, after which they are deleted or anonymized.
- Hashed verification codes: cleared upon successful verification or expiry.
- Payment records: retained as required by accounting law.
Specific retention periods are available on request.
6. Sharing with third parties
We share data only as needed to operate the Services:
- Messaging and carrier partners (for message delivery to the destination network);
- Payment partners (currently FedaPay; additional partners and bank-transfer processing as introduced) for wallet top-ups;
- Infrastructure providers (hosting, database, storage, email delivery);
- Authorities where disclosure is required by law.
Our providers are bound by contractual confidentiality and data protection obligations.
7. Our role for end-recipient data
When clients submit end-recipient phone numbers through the API, the client determines the purpose of processing and is the data controller. Pratick processes this data solely to dispatch and verify messages on the client's documented instructions, applying the security measures in Section 4. Our Data Processing Terms govern this relationship. End recipients seeking information about why they received a message should contact the business that sent it; we will nonetheless assist with security concerns reported to us.
8. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; and withdraw consent where processing is based on consent. Requests can be sent to management@pratick.net. We may need to verify your identity before acting on a request, and some data must be retained where the law requires it. You also have the right to lodge a complaint with the Togolese data protection authority (IPDCP) or your local supervisory authority.
9. International transfers
Where data is transferred outside your jurisdiction (for example, to our EU-hosted infrastructure or delivery partners in destination countries), we implement appropriate safeguards consistent with applicable data protection law.
10. Children
The Services are for businesses and are not directed at children. We do not knowingly collect data from minors.
11. Changes
We may update this policy from time to time. Material changes will be announced via the portal or email. The "Last updated" date reflects the current version.
12. Contact
Privacy inquiries: management@pratick.net PRATICK — Lomé, Togo