Asta ("Asta," "we," "us," "our"), based in Accra, Ghana, values your privacy. This Policy explains how we collect, use, share, and protect your personal information across our website (asta.homes), our web and mobile apps (including app.asta.homes and Asta Build), and related services.
Although we serve the Ghanaian market, we knowingly offer services to the Ghanaian diaspora, including people in the EU and UK. The EU and UK General Data Protection Regulation (GDPR) can therefore apply to us, alongside Ghana's Data Protection Act, 2012 (Act 843). Where we decide why and how your data is used we are a "controller"; where we process it for a partner we are a "processor".
Who We Are & How to Contact Us
The data controller is Asta, based in Accra, Ghana. For any privacy question, or to exercise your rights, contact us at hello@asta.homes.
We have not appointed a statutory Data Protection Officer; privacy is handled by our team at the address above. We have not currently appointed an EU/UK Article 27 representative and are assessing whether one is required.
Personal Data We Collect
Account & Identity
- Name, email, phone number, and a hashed password
- Your role (buyer, seller, agent) and profile details
Listings, Content & Location
- Property details, photos (which may include location metadata), and documents you upload
- Property coordinates you provide, and device geolocation only where you grant permission
- Messages you send us
Usage & Device
- Pages viewed, actions taken, approximate location from your IP, device and browser type
- Analytics identifiers — set only after you consent (see Cookies & Analytics)
We do not intentionally collect special-category data (such as health or religion). Please do not include it in listings or messages. Where a paid plan involves payment, it is handled by a third-party payment provider; we do not store full card numbers.
How We Use It & Our Lawful Bases
To provide the service
Running your account and delivering listings, risk/price/groundwater intelligence and Asta Build — on the basis of performance of a contract.
To secure & improve it
Preventing fraud and abuse, keeping records, and improving reliability — on the basis of our legitimate interests, balanced against your rights.
Analytics & marketing
Understanding usage (Google Analytics) and sending product updates — on the basis of your consent, which you can withdraw at any time.
Legal obligations
Complying with applicable law — on the basis of legal obligation.
Cookies & Analytics
We use strictly-necessary cookies to run the service (for example, to keep you signed in). We use Google Analytics to understand usage. Analytics and advertising storage are set to denied by default using Google Consent Mode v2 — no analytics cookies are written until you choose "Accept" on our consent banner. You can decline, or change your choice at any time.
Who We Share It With
We do not sell your personal data. We share it with vetted service providers who process it on our behalf under data-processing agreements:
- Supabase — database, authentication and file storage
- Google — Analytics (after consent), Gemini AI processing, and Cloud hosting
- Mapbox — maps and geocoding
- Twilio — WhatsApp messaging
- Resend & Loops — transactional and lifecycle email
- Netlify — marketing-site hosting
We may also disclose data where required by law, or in connection with a corporate transaction, with appropriate safeguards.
International Data Transfers
Our infrastructure and several providers are in the United States. When we transfer EU/UK personal data outside the EEA/UK, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses and/or the EU-US and UK Data Privacy Framework where a provider is certified.
How Long We Keep It
We keep personal data only as long as needed, then delete or anonymise it. Typically:
- Account data — for the life of your account, then up to 90 days after deletion
- Listings and documents — while active, then a limited archival period
- Analytics data — per Google Analytics retention (currently up to 14 months)
- Support communications — up to 24 months
Your Rights
Subject to applicable law, you have the right to access your data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise any right, email hello@asta.homes; we will respond within the time the law requires (generally one month under GDPR) and will verify your identity first.
Automated Processing & Profiling
Asta computes risk scores, fair-price estimates and similar intelligence using algorithms and AI. These are decision-support tools shown to you; they do not produce legal or similarly significant effects about you through solely automated means within the meaning of GDPR Article 22.
Security, Children & Changes
Security. We use technical and organisational measures including encryption in transit, access controls, database row-level security, and least-privilege credentials. No system is perfectly secure; we maintain a process to detect and respond to incidents.
Children. Asta is not intended for children under 16, and we do not knowingly collect their data.
Changes. We may update this Policy; we will post the new version here, update the date above, and notify you of material changes where required.
Complaints
Please contact us first with any concern. You also have the right to complain to a supervisory authority: in the EU, your local Data Protection Authority; in the UK, the Information Commissioner's Office (ICO); in Ghana, the Data Protection Commission.
Questions about your privacy, or want to exercise a right?
Email hello@asta.homes