Privacy Policy

Effective 11 September 2026 · Last updated 29 September 2026

In short: you send a photo or a text on WhatsApp, we read the numbers and names off it, ask you to confirm before saving anything, and write the confirmed record into your own Google Sheet. Your financial records are never pooled into one shared database across businesses — each business's Sheet is its own. We don't score you or your customers for credit, and we don't sell or advertise with your data.

1. Who this covers

This policy covers ScoopCnote, a product built by Scoopc Technologies Ent, a company registered in Ghana. ScoopCnote is used by independent businesses — currently shops and schools, in Ghana and a small number of other countries as we expand — each communicating with us over their own dedicated WhatsApp number and recording confirmed transactions into their own Google Sheet. It applies to any business (“tenant”) using the service, and to everyone whose information appears in a tenant's records as a result (customers, suppliers, staff, parents).

2. What we collect

From the business owner, at signup and while using the service:

  • Business name, the vertical (shop or school), country/city/region, and a preferred currency for their own records
  • An email address, used only to share their Google Sheet with them
  • Their WhatsApp number(s) authorized to message us on the business's behalf
  • Optionally, contact/address/bank details, if they choose to generate receipts or invoices through us

Sent to us over WhatsApp, as part of normal use:

  • Photos of mobile money (MoMo) payment alerts, receipts, and invoices
  • Text messages — cash sale reports, stock and staff entries, corrections, confirmations, replies to disambiguation prompts
  • Names and amounts for a tenant's own customers, suppliers, or staff, when the owner records them (e.g. tracking who owes them money, or who they owe) — this is the one place a third party's name (not the WhatsApp sender's) enters the system directly as typed text, not from a photo
  • Any name printed inside a submitted photo — typically the payer's MoMo-registered name, which may be a parent or customer rather than the account holder

If a business upgrades to a paid plan:

  • Payment is handled entirely by Paystack, our payment processor. Card or mobile money details are entered directly on Paystack's own secure checkout page — they never pass through our servers, and we never see or store them
  • We keep a record of the transaction reference, amount, plan, and date, so we can verify a payment was genuinely made

We don't read messages sent to any other WhatsApp number, and we don't access a business owner's personal contacts, chats, or any WhatsApp data beyond what's sent to our business number.

3. How we use it

A submitted photo is read by an AI vision model (Google's Gemini, our primary provider) to extract an amount, counterparty name, date, and reference number. If that service is briefly unavailable, we fall back to Anthropic's Claude API for that one request — never because of a low-confidence read, only an actual outage. Nothing is saved at this point — we reply on WhatsApp with what we read and ask the owner to reply YES to confirm, or send a correction. Only a confirmed record is written to the Sheet. Text-based entries (a cash sale, stock movement, a customer credit record) skip extraction entirely and go through the same confirm-before-write step where the record affects the business's financial picture.

4. Where it's stored

Confirmed financial records live in a Google Sheet owned by each business, under that business's own Google account (or shared to it) — not in a central database we run across every tenant. Every row that comes from a photo links back to the original image as evidence.

Account information — business name, contact details, WhatsApp numbers, vertical, region, plan and billing status — is kept in our own operator-side database (hosted on Supabase), so we can route messages to the right business and keep the service running. This is account/administrative information, not a copy of any business's financial transactions, which stay in that business's own Sheet as described above.

We don't keep a separate copy of submitted photos outside of what WhatsApp and Google Drive already store on the business's behalf.

5. Who else sees it

  • Meta — delivers the WhatsApp message itself, under Meta's own WhatsApp Business Platform terms. We only ever use Meta's official WhatsApp Cloud API, never an unofficial or third-party automation route.
  • Google — provides Gemini, the AI model that reads a submitted photo's content to extract the fields described above, and stores each business's confirmed records in their own Google Sheet and evidence photos in Google Drive, under that business's own Google account.
  • Anthropic — used only as a backup if Google's extraction service has an outage, under Anthropic's standard commercial API terms (message content sent to the API is not used to train models).
  • Paystack — processes payment when a business chooses to upgrade to a paid plan. See “What we collect” above for what this involves; Paystack has its own privacy policy governing payment data it handles directly.
  • Supabase — hosts our own account/administrative database described in “Where it's stored” above, in an access-controlled database we manage.

We don't sell, rent, or otherwise share this data with any other party. No parent, customer, lender, or advertiser receives it without the business owner's explicit, separate consent.

6. What we deliberately don't do

  • We don't score anyone's creditworthiness or make lending decisions — even where a business tracks who owes them money, that stays a record for their own use, never a score or report shared with a lender or credit bureau
  • We don't run ads, ad tracking, or any marketing use of this data
  • We don't message customers, parents, or staff as a group broadcast — reports, where they exist, go out individually, and one business's data is never visible to another
  • We don't write anything to a Sheet without the owner's confirmation first

7. Retention and control

Each business owner controls their own Google Sheet directly and can edit or delete any row, or revoke our access to it, at any time. WhatsApp media links expire per Meta's own retention policy, independent of us. To have your business's account information removed from our own database, or to ask what's held about a specific transaction, contact us using the details below.

8. Your rights

Scoopc Technologies Ent is registered in Ghana, and we aim to handle personal data consistently with Ghana's Data Protection Act, 2012 (Act 843). As we begin serving businesses in other countries, we intend to honor the core data rights those countries' laws typically provide — knowing what's recorded about you, correcting it, and having it deleted — even where we haven't yet completed a formal compliance review for that specific country. If you're a customer, supplier, parent, or staff member named in a record and want to know what's recorded about you, ask the business owner directly, since it's their Sheet; if you'd rather reach us, use the contact below and we'll help however we can.

9. Changes and contact

This policy is revised as the product changes — most recently to reflect self-serve signup, a second business type (shops, alongside schools), payment collection, and support for businesses outside Ghana. We'll update the date at the top when it changes again. Questions or concerns:

[email protected]