Privacy Policy

Last updated: October 7, 2026

This policy explains what personal data Asterisks collects through our website, dashboard and USSD runtime, what we do with it, who we share it with and how long we keep it. We follow the Ghana Data Protection Act, 2012 (Act 843). If you are covered by another data protection law, such as the GDPR, you also have the rights that law gives you.

1. Our role

For your account and your use of the dashboard, Asterisks is the data controller. For the callers who use the USSD apps you build, you are the data controller and we process their data on your behalf, only to run your apps. If you need a data processing agreement, email privacy@useasterisks.com.

2. What we collect

Account: your phone number, name, email address and profile photo if you add them, when you signed up and last signed in, and when you accepted these terms. If you use passkeys, we store each passkey's public key and a device name; the private key never leaves your device. We keep a record of the sign-in codes we send.
Your apps: your flows and their versions, change history, deployments, and the email addresses of people you invite to collaborate.
Callers' session data (processed for you): the caller's phone number and network, the session ID, each screen your app showed, what the caller typed, session variables, and whatever your flow sends to or receives from the APIs you connect.
Billing: your plan and the dates it runs for, each plan invoice and payment with its amount, date and Paystack reference, how many AI drafts you use each month, your session balance and a record of each top-up and session charge, with its Paystack reference. You enter card or mobile money details on Paystack's page; we never see or store them.
Support: bug reports you send, including any screenshots and your browser's user agent.
Newsletter: your email address, if you subscribe.
Technical data: IP address, browser and request details in our server logs, and error reports from the website and dashboard.
Usage analytics: on the website, only if you accept cookies (see section 9). In the dashboard, the pages you visit and features you use, while you're signed in.

3. Why we use it

To run the Service: sign you in, run your apps, bill your plan and your sessions, and send the emails and texts you need (sign-in codes, collaboration invites, and notices such as a low session balance or a plan about to end). This is necessary for our contract with you.
To keep the Service secure and working: stop fraud and abuse, and find and fix errors. This is our legitimate interest.
To keep financial records, as the law requires.
To understand how visitors use the website, and to send the newsletter, if you have agreed. You can withdraw consent at any time.

We do not sell personal data, and we do not use your data or your callers' data to train AI models.

4. Who we share it with

We use these service providers, and share with each only what it needs:

Vercel: hosts the website and dashboard.
Render: hosts our API servers, where USSD sessions run and live session state is held.
Neon: our PostgreSQL database, in London, United Kingdom.
The aggregator you connect (Hubtel, Nalo Solutions, Arkesel or Africa's Talking): carries your app's USSD traffic.
Arkesel: sends sign-in codes by SMS.
Brevo: sends our emails.
Paystack: processes top-up payments and plan payments.
Cloudinary: stores images you upload, such as profile photos and bug report screenshots.
Cloudflare Turnstile: checks that sign-in and sign-up requests come from a person.
OpenAI, Google (Gemini), Anthropic or OpenRouter: whichever powers the AI assistant receives the descriptions you type into it.
Sentry (data stored in Germany): error reports, and recordings of a sample of browser sessions (see section 9).
Better Stack: stores our server logs.
Google Analytics and PostHog: usage analytics.

Your apps also send data to any API, payment provider or webhook you configure in a flow; that's your choice and under your control. We disclose data to authorities only when the law requires it.

5. Where it's stored

Our database is in the United Kingdom, and several of the providers above are based in the United States or the European Union, so your data is stored and processed outside Ghana. We use providers that protect data under their own data processing terms.

6. How long we keep it

Callers' session data: what callers typed and the screens they saw are deleted after 90 days, and so is the caller's phone number. We keep an anonymous record that the session happened, for usage counts and billing.
Your account and apps: until you delete your account. When you delete a single app it stops running straight away, but its data is kept until you delete your account; email us if you want it removed sooner.
Financial records (top-ups, session charges, plan invoices and plan payments): kept after you delete your account, as financial records. They contain amounts, dates and references, not your contact details.
Server logs and error reports: kept by Better Stack and Sentry for the retention period of our plan with them, then deleted.
Newsletter: until you unsubscribe using the link in any newsletter email.

7. Deleting your account

Delete your account from Settings → Profile in the dashboard. This immediately and permanently removes your profile, passkeys, sign-in records, every app you own with its flows, deployments and session data, your place on apps shared with you, your session balance, and your notifications. Changes you made to other people's apps stay in their history, under "Deleted user".

8. Your rights

You can ask to see the personal data we hold about you, correct it, delete it, object to or restrict how we use it, or get a copy, and you can withdraw consent at any time. Email privacy@useasterisks.com and we will reply within 30 days. If you are a caller of an app built on Asterisks, contact the business that runs that app first, since it controls your data. You can also complain to the Data Protection Commission of Ghana (dataprotection.org.gh) or your local regulator.

9. Cookies, analytics and session recording

Dashboard sign-in: HttpOnly cookies hold your session. They are needed for the dashboard to work.
Website: nothing is tracked until you choose. If you accept, Google Analytics measures visits and Sentry records about 1 in 10 visits, plus any visit where an error happens, so we can fix problems; what you type into forms is hidden from recordings. If you decline, neither runs. Your choice is saved in your browser, and you can change it with Cookie settings in the footer.
Dashboard: while you're signed in, Google Analytics and PostHog measure how the product is used, and Sentry reports errors and records about 1 in 10 sessions, plus any session where an error happens. In dashboard recordings all text is masked and images are blocked, so your data, your callers' numbers and your API keys aren't captured.

10. Security

See Data Security for how we protect your data. If you find a vulnerability, report it to security@useasterisks.com.

11. Children

The Service is for people aged 18 and over, and we don't knowingly collect data from children. If you think a child has given us personal data, contact us and we'll delete it.

12. Changes

We will update the date at the top when this policy changes, and email account holders before a material change.

13. Contact

Privacy questions and requests: privacy@useasterisks.com. Post: Asterisks, Accra, Ghana.

Legal Hub