Privacy policy

Last updated 2026-09-04 · Applies to Huupa, a service of JBKlutse Ventures, Ghana.

1. Who we are

Huupa is operated by JBKlutse Ventures, a business based in Ghana ("we", "us"). We are the data controller for the personal data described here. Contact details are at the bottom of this page.

2. What we collect

• Contact and account details — your name, email address, phone number and company name, given when you request a free scan, send an enquiry, subscribe, or are invited to a team workspace.
• Website information — the URLs you add, and the results of the scans we run against them (security headers, TLS, DNS, exposed files, malware findings, SEO and performance data). Scans of a public website read only what any visitor could.
• Access you grant — control-panel or server credentials, Cloudflare and Google (Search Console / Analytics) authorisations, and WordPress plugin pairings. These are stored encrypted at rest in a vault and every use is logged.
• Billing records — plan, invoices, wallet balance and payment references. Card and mobile-money details are handled by Paystack; we never see or store your card number.
• Technical data — IP address, browser, the pages you visit in the portal and sign-in events, kept for security and abuse prevention.

3. Why we use it

• To deliver the service you bought: monitoring, scanning, reporting, fixes, migrations and support.
• To bill you and to prevent fraud.
• To send you service messages: sign-in links, invitations, reports, renewal problems, and notice when we change these terms.
• To follow up after a free scan (at most a few messages, and you can stop them with one click).
• To keep the service secure and to investigate abuse.

We do not sell personal data and we do not use it for third-party advertising.

4. Automated analysis and AI

Some findings — for example a suspicious file or database entry, or a page's title and description — are sent to third-party AI model providers so we can explain them or draft a fix. We send the smallest excerpt that does the job, we redact anything that looks like a password, key or token before it leaves our systems, and nothing an AI proposes is applied to your website without a check by our tooling and, where the change is risky, by a person. We do not use your data to train models.

5. Who else sees it

We share data only with processors that help us run the service, under their own terms: Paystack (payments), Amazon Web Services (email delivery and encrypted backups), Cloudflare (network and DNS, where you connect a zone), Google (Search Console and Analytics, only for properties you authorise; and Safe Browsing, which receives the addresses of pages we scan so we can tell you whether Google lists them as harmful), and the AI providers described above. We may disclose data where the law requires it.

6. Cookies and local storage

We use a small number of strictly necessary cookies: a session cookie so you stay signed in, a cross-site-request-forgery token, and a cookie remembering which workspace you last used. Your light/dark theme preference is kept in your browser's local storage. We do not use advertising or cross-site tracking cookies, which is why there is no cookie banner.

7. How long we keep it

• Account, billing and audit records: for as long as you have an account, then up to 6 years for accounting and legal purposes.
• Scan results and monitoring history: up to 400 days; server metrics 90 days; job logs 30 days; the record of SMS alerts we sent you (number and message) 90 days.
• Credentials and access tokens: until you disconnect the site or close the account, when they are revoked and deleted.
• Free-scan leads who never sign up: up to 12 months.

8. Your rights

You can ask us to show you the personal data we hold, correct it, export it, or delete your account and data. Write to the address below; we answer within 30 days. Ghana's Data Protection Act, 2012 (Act 843) applies; if you are elsewhere, your local law may give you additional rights and we will honour them.

9. Security

Traffic is encrypted in transit. Credentials are encrypted at rest with a key that is not stored alongside the data or in backups. On servers we host, each website runs under its own isolated system account, so a problem on one site cannot read another site's files or database credentials. Privileged actions on your website run through a single audited path, take a restore point first where they change files or a database, and are logged. No system is perfectly secure, and we will tell you promptly if we learn of a breach affecting your data.

10. Changes

If we change this policy in a way that matters, we will email account holders before the change takes effect and update the date at the top of this page.