Privacy Policy

Version 2.8 — Effective October 21, 2026

This Privacy Policy describes how Skofa ("Skofa", "we", "us", "our") collects, uses, stores, and protects information in connection with the Skofa platform (the "Service"). It applies together with the Terms of Service.

1. Information we collect

2. Why we collect it and how we use it

We collect and use information to: create and maintain your account; run the AI agents and workflows you configure; process billing and payment; provide customer support; detect, investigate, and prevent fraud, abuse, and security incidents; and maintain and improve the reliability of the Service. We do not use your business's data to train models for, or otherwise benefit, another business on the platform, and we do not sell your personal or business information.

3. Tenant isolation

Your business's data is logically isolated from every other business on the platform at the application and database level. Skofa's platform administrators do not have standing access to a business's operational data (customers, documents, agent activity); access for support purposes requires an explicit, individually justified, audit-logged support session.

4. Third-party processors and services

We share information with the following categories of third-party processors, only as needed to provide the Service:

Connecting a third-party integration of your own choosing (for example, an accounting system) means Skofa processes data from that system on your instruction, using credentials you control and can revoke at any time from the integrations page — this is distinct from, and in addition to, the infrastructure processors listed above. The full, current list of Skofa's own subprocessors, by name and purpose, is kept up to date on the separate Subprocessors page.

5. Data storage and security

Stored third-party credentials (API keys, OAuth tokens) are encrypted at rest. Data in transit is encrypted via HTTPS. We enforce role-based access control within your business account and maintain audit logs of sensitive actions (billing changes, permission changes, data deletion requests, and administrative access). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data retention and deletion

We retain your information for as long as your account is active, and as needed to comply with legal, tax, and accounting obligations after that. You may request deletion of your business's account and data at any time from account settings. Deletion begins a real grace period (currently 14 days) during which you may cancel the request; after the grace period elapses, your business's operational data is permanently deleted, subject to what we are legally required to retain (for example, billing records needed for tax purposes).

7. Cookies

Skofa uses only two cookies, both strictly necessary for the Service to function — neither requires opt-in consent under applicable law, and Skofa does not set analytics, advertising, or tracking cookies of any kind.

Cookie Purpose Duration
skofa_session Keeps you signed in between requests. Required to use the product at all. 30 days, or until you sign out
skofa_oauth_state Protects against cross-site request forgery while you connect a third-party integration. Only set during that specific action. 10 minutes

Both cookies are httpOnly (unreadable by page JavaScript) and sent only over HTTPS in production. If Skofa ever introduces a cookie that is not strictly necessary — for analytics or marketing, for example — this policy and the product itself will be updated to ask for your consent before it is set, not after.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise export and deletion rights directly from account settings; for any other request, contact us through the in-app support channel and we will respond within a reasonable time.

9. International data considerations

Skofa's infrastructure and the third-party processors listed in Section 4 may store or process data outside the country where you or your business are located. Where this occurs, we rely on the safeguards those processors themselves provide (including their own contractual and security commitments) for cross-border processing.

10. Children's data

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children, and Skofa should not be used to submit a child's personal data as business data without a lawful basis for doing so.

11. Changes to this policy

We may update this policy from time to time. When we publish a new version, we present it for renewed acceptance before it takes effect for your account, and your acceptance of each version you agreed to remains on record, tracked separately from later versions.

12. Operating entity

Skofa is operated by Skofa Agent Systems, a registered business in the Republic of Ghana. Sections 1 to 14 of this Privacy Policy have been reviewed by legal counsel and approved for use. Section 15 (Connected platforms) was added on October 10, 2026 and updated on October 15, 2026, and has not yet been reviewed by counsel; the Video Studio entry in Section 4 was added on October 15, 2026 and has not yet been reviewed by counsel. On October 17, 2026 the list of AI model providers in Section 4 was updated (adding Moonshot AI and DeepSeek) and Section 15 was extended to YouTube, X, Pinterest and Telegram; these changes have not yet been reviewed by counsel. On October 20, 2026 Section 4 and Section 15 were updated to cover flyers, text posts and AI employees that a business allows to post on its own; these changes have not yet been reviewed by counsel. On October 20, 2026, Section 1, Section 4 and Section 15 were updated to cover talking with a workspace's AI CEO on WhatsApp; these changes have not yet been reviewed by counsel. On October 21, 2026, Section 4 and Section 15 were updated to cover converting customers' voice notes on WhatsApp, Messenger and Instagram to text and reading the photos and documents they send; these changes have not yet been reviewed by counsel.

13. Data Processing Agreement and Data Protection Officer

For business customers that require one, a separate Data Processing Agreement sets out the terms under which Skofa processes personal data on that customer's behalf as a processor. Skofa has not yet appointed a formal Data Protection Officer; until one is appointed, privacy inquiries should be directed to admin@skofa.systems, and this section will be updated with a named DPO's contact details once one is designated.

14. Contact

Questions about this policy, or requests to exercise a privacy right not directly available in account settings, can be sent through the in-app support channel, available to every account holder from within the Service, or to admin@skofa.systems.

15. Connected platforms (TikTok, Meta, WhatsApp and others)

A business can choose to connect accounts it holds on other platforms, such as TikTok, WhatsApp Business (Meta), Google, and accounting or point-of-sale systems. Nothing is connected unless an owner or administrator of that business connects it, and each connection asks, on the platform's own permission screen, only for the permissions its features need. Skofa never receives the password of a connected account.

What we receive from and send to TikTok. When a business connects a TikTok account, Skofa requests three permissions: user.info.basic, to read the account's basic profile (its identifier, display name and profile picture); video.list, to read the list of videos the account has published and their details (such as title, description, link and engagement counts); and video.publish, to post a video to the account. Skofa posts to TikTok only when a person in the business presses Post on a specific video, after seeing a preview, choosing who can view it and the interaction settings, and confirming. Skofa never posts automatically, does not edit or delete existing TikTok videos, and does not read private messages.

What we receive from and send to Meta (Facebook and Instagram). When a business connects a Facebook Page or an Instagram professional account, Skofa receives the messages people send to that Page or account and the comments people leave on its posts, and sends the replies the business's people write and its agents prepare, under the business's own approval settings. A reply can be a photo from the business's own Video Studio library, or a private message answering a comment; a person in the business can also hide a comment from everyone but its writer. When someone sends a voice message, photo or file to the Page or account, Skofa fetches it from Meta and handles it as described for WhatsApp above. Skofa also publishes a video as a Facebook Page Reel or an Instagram Reel when a person in the business presses Post on that video, after seeing a preview and confirming, or when an AI employee the business has allowed to post on its own does so within the limits the business set.

Posting through our posting partner. A business can instead connect its TikTok, Instagram, Facebook, YouTube, X or Pinterest accounts, or its Telegram channel, through Upload-Post, a posting service that holds its own approvals from those platforms. For Telegram, the business creates its own Telegram bot and gives Skofa the bot's token and its channel; Skofa passes them to Upload-Post once and does not store them. The business connects its accounts on Upload-Post's page, and Upload-Post then holds the access to those accounts. When a person in the business presses Post, or when an AI employee the business has allowed to post on its own does so, Skofa sends Upload-Post the video or image (as a time-limited link) or the text, the caption and the chosen settings, and Upload-Post publishes it. Skofa keeps only the name of the business's posting profile and the result of each post.

AI employees posting on their own. This is off by default. Only an owner or admin of a business can allow one of its AI employees to post on its own, and they choose which connected platforms, which kinds of content, how many posts a day, quiet hours and the settings a platform requires. The AI employee posts only content it made after the permission was given. Before every post, Skofa checks the platform's rules and limits and does not post when a rule would be broken. Posts to TikTok are always made by a person, because TikTok requires the account holder to confirm each post. Skofa records every post against the AI employee that made it and shows it to the business's owners and admins. The business can withdraw the permission at any time and remains responsible for what is posted from its accounts. If the person who gave the permission is no longer an owner or admin of the business, the permission stops.

Talking with your CEO on WhatsApp. This is off unless you turn it on, and only for yourself. Any person in a workspace can link their own WhatsApp number to talk with that workspace's AI CEO on Skofa's own WhatsApp number; to prove the number is theirs, they send a one-time code from it. The CEO then sends that person a daily briefing if they choose it, notices of work waiting for approval, progress on the business's objectives and answers to their questions, drawn from the business's records in Skofa, and tells them only what their role in the workspace already lets them see. Approving work on WhatsApp needs a PIN the person sets in Skofa; payments, refunds, cancelled orders, employee data, exporting data and connecting systems are only ever approved in Skofa itself. When a person sends a voice note, Skofa fetches it from WhatsApp, has it converted to text, keeps the text and does not keep the audio. A person can unlink their number at any time, in Skofa or by sending STOP; the link also ends when they leave the workspace or their access is removed. Messages to Skofa's WhatsApp number from people who have not linked their number are handled as messages to Skofa's own customer support.

What we receive from other platforms. For WhatsApp Business: messages customers send to the business's WhatsApp number, the business's replies, and delivery and read statuses. When a customer sends a voice note, Skofa fetches it from WhatsApp, converts it to text so the business's people and AI employees can read and answer it, keeps the text with the message, and does not keep the audio. When a customer sends a photo or document, Skofa keeps it with the business's documents and has it read by AI; the reading is kept with the message and labelled as Skofa's reading. The cost of converting and reading them is part of the business's AI usage. For accounting, inventory and point-of-sale systems: the records the business chooses to sync, such as products, invoices and sales.

How we use it. Only to provide the features the business has turned on: showing and organising its own account and content, preparing reports and recommendations for that business, and carrying out actions the business authorises under its own approval settings. We do not sell data from connected platforms, use it for advertising, or use one business's data for another business. We do not use it to train AI models. When the business uses AI features, the relevant data is processed by the AI providers listed in Section 4, only to produce results for that business.

How we protect it. Access tokens are encrypted at rest. Each business's data is isolated from every other business. Actions taken with a connected account are recorded in the business's audit log.

How long we keep it.

Disconnecting and deletion. A business can disconnect any platform at any time from Integrations in Skofa. Skofa then deletes the stored access tokens, asks the platform to revoke Skofa's access where the platform supports it (TikTok does; for accounts connected through Upload-Post, Skofa asks Upload-Post to remove the account), and deletes the records it copied from that platform. You can also remove Skofa's access from the platform's own settings (for example TikTok's or Meta's app permissions); if you do, also disconnect the platform in Skofa so the copied records are deleted. To ask for the deletion of any other data Skofa received from a connected platform, contact us through the in-app support channel or at admin@skofa.systems. We respond within 30 days.

Questions about this document

Skofa Agent System

Block 6, Tangerine street, Tema C12, Greater Accra-Ghana

Email: admin@skofa.systems

Customers can also open a support request from inside Skofa (Support in the menu), which keeps the conversation with your workspace.