WelfLinkTogether. Support. Thrive.

WelfLink · Your trust matters

Privacy Policy

Last updated: November 2026

How we handle the information behind your community, and the choices available to you.

Who this policy covers

WelfLink is operated by Supatech IT Solutions, based in Accra, Ghana. This policy explains how Supatech IT Solutions handles personal information when you visit our website, create an account or use an organisation workspace. WelfLink is software for membership, welfare, contributions, finance and governance records; it is not a bank or custodian of member welfare funds.

An organisation normally decides why its member records are collected, who may access them and how its own welfare and governance rules apply. WelfLink processes those workspace records to provide the service. The operator also determines the purposes of account administration, service security, subscription and support processing. The responsibilities in a particular arrangement depend on applicable law and the agreed service terms.

Information we collect

Account and profile information includes your email address, display name, contact details where supplied, password hash, verification status and session records. We receive a password when you submit an authentication form and store a hash rather than a readable password.

Organisation and member records can include organisation identity, member contact and membership details, roles, invitations, standing, officer notes, attendance and participation records. Administrators or other authorised people may provide information about you.

Operational records can include recurring dues, one-time contributions, obligations, arrears, payment amounts and references, receipts, refunds, welfare categories, eligibility assessments, requests, decisions and disbursements. Welfare requests or attachments may reveal health, family or other sensitive circumstances. Governance, announcement, voting and support records can contain personal information. Ballot visibility depends on the configured voting/privacy rules; this policy does not promise universal ballot anonymity.

We process service and security information such as session/device identifiers, registered push tokens where enabled, timestamps, IP addresses where recorded for security, request/error metadata and audit events. Private attachments are processed only where that capability is enabled. We do not ask you to put card PINs, card security codes or payment-provider passwords into ordinary records or support messages.

Why information is used

We use information to create and secure accounts, verify email, manage sessions, deliver invitations and recovery instructions, provide organisation workflows, maintain records, administer subscriptions, answer support requests and operate the service. Authorised organisations use their records to administer membership, collect and account for dues/contributions, assess support requests and make governance decisions.

Security and audit processing helps detect misuse, investigate incidents and preserve the integrity of financial and decision history. Processing must have an appropriate basis under applicable law, which may include an agreed service, a legal requirement, a legitimate operational purpose or valid consent where required. A member’s participation does not authorise an administrator to collect unrelated sensitive information.

Organisation administrators and sharing

Administrators are responsible for giving members appropriate notices, having authority to supply their information, collecting only necessary records, keeping them accurate, assigning appropriate roles and handling member requests. Obtain any required consent or other lawful authority before providing sensitive welfare or third-party information.

Information is visible according to organisation membership, role permissions, workflow and voting settings. Authorised platform staff may process account, subscription, security and support information for their assigned responsibilities; a support case does not give general access to unrelated organisation records. Exports or copies made by authorised users are subject to their own handling responsibilities.

Service providers and international processing

The staging/hosting stack uses Render for application hosting, Aiven PostgreSQL for database hosting and Resend for transactional email. These providers receive the information necessary for the services they perform; email providers necessarily receive recipients and message contents, including requested action links. Configured storage, push or future payment services may process additional information when enabled and disclosed. Selecting a provider does not mean every optional integration is active.

Hosting and provider systems may be outside Ghana or your country. Relevant locations, contractual protections, provider access and lawful transfer requirements need to be addressed for the organisation’s deployment. Ask the operator for current deployment/provider details. We may disclose information where lawfully required or necessary to address fraud, security incidents or legal claims, subject to applicable protections.

Email and notifications

Account verification, password recovery and invitations use transactional email. Eligible organisation, welfare, contribution, financial, governance, billing or support notices may appear in-app or be queued for configured email/push delivery. Availability depends on the deployment, user preferences, eligibility and provider configuration; essential account/security messages are part of operating an account.

Delivery to an external provider is not a guarantee of inbox or device receipt. Device tokens are used for authorised delivery where push is configured. Do not forward private action links or tokens. No advertising newsletter is created by registering for the service.

Cookies, sessions and theme preferences

The web application uses a refresh-session cookie to maintain sign-in. In production it is Secure, HttpOnly and SameSite=Strict, with a restricted authentication path. Browser access tokens are held in application memory rather than deliberately saved in browser local storage. Native clients use the application’s configured secure credential storage.

The public-site theme preference is saved locally under welflink-public-theme. System colour preference can be used without storing a manual choice. Storage restrictions may prevent persistence. The reviewed public implementation does not add advertising pixels, behavioural analytics or non-essential tracking cookies. Provider operations may generate their own service logs. Cookie blocking can prevent sign-in or session refresh.

Security and your responsibilities

WelfLink uses authentication and permission checks, organisation-scoped access, audit records, protected financial workflows and encryption for sensitive queued-delivery payloads. Production deployments require HTTPS/TLS and server-side secret configuration. These safeguards reduce risk but do not guarantee that every incident can be prevented.

Keep credentials private, use a strong unique password, review authorised sessions and notify support of suspected misuse. Administrators should restrict exports and attachments, review roles and avoid including unnecessary sensitive material in announcements or support messages.

Retention and account deactivation

Records are retained for the service purpose, organisation instructions and applicable legal, financial, audit, security or dispute needs. There is no single automatic deletion period for every record type. Operational copies, backups and provider records may follow different retention/recovery processes, which the operator must manage.

Account deactivation revokes access/sessions but does not automatically erase required financial, governance, audit or support history, or the organisation’s records about you. Some administrator accounts require responsibility transfer or operator review before deactivation. Requests for deletion, restriction or correction are reviewed against the record’s purpose and applicable obligations; deletion is not promised where retention is required.

Your choices and rights

Depending on applicable law and circumstances, you may request information about processing, access to your personal information, correction of inaccurate records, objection or restriction, withdrawal of consent where consent is the relevant basis, or deletion where appropriate. Requests may require proportionate identity verification. Ask your organisation administrator about workspace records and contact WelfLink about operator-controlled processing or unresolved issues.

For Ghana, the Data Protection Act, 2012 (Act 843) and oversight by the Data Protection Commission may apply. This policy is not a certification or guarantee of compliance, and does not remove statutory rights or the ability to contact the Commission. Other countries may provide additional mandatory rights. Contact details and current guidance are available from Ghana’s Data Protection Commission at dpc.gov.gh.

Children and sensitive information

WelfLink accounts are intended for people with capacity and authority to use the service. The service is not marketed directly to children. Organisations that keep records about minors must establish the appropriate legal authority, safeguards and any required parent/guardian involvement; creating an organisation account is not blanket consent to process children’s information. Contact the operator if information about a child may have been supplied without authority.

Policy changes

We may update this policy as the service, providers or legal requirements change. The updated version and date will be published here. Material changes will be communicated through appropriate service channels where required. Continued use does not waive rights or replace any consent required by law.