Privacy Policy

Esper Global LLC (“EsperWorks”, “we”, “us”) is committed to protecting the privacy of our users. This policy explains what data we collect, how we use it, and what rights you have. We apply GDPR-level standards across all our operations, and comply with the Ghana Data Protection Act, 2012 (Act 843).

For detailed information on our technical and organisational security measures, see our Data Protection Policy.

We collect the following types of information:

• Account information: name, email address, phone number, password (bcrypt hashed, never stored in plain text)
• Business information: business name, address, logo, industry, tax identification number
• Financial data: invoices, expenses, payment records, bank account details for payouts
• Client data: names, email addresses, and contact details you add for your clients
• Usage data: pages visited, features used, device type, browser, IP address
• API usage data: if you use our developer API, we log request counts, timestamps, and key identifiers (never the full key)

We use your data to:

• Provide and operate the EsperWorks platform
• Process invoices, payments, and contracts on your behalf
• Send transactional emails (invoice delivery, payment confirmations, reminders)
• Deliver real-time notifications via Pusher
• Improve the platform based on anonymised usage patterns (PostHog analytics)
• Monitor errors and performance (Sentry)
• Provide customer support
• Comply with legal and tax obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Your data is stored on Railway-hosted servers and Cloudflare R2 for file storage. All data in transit is encrypted with TLS 1.2+. Passwords are hashed with bcrypt. API keys are stored as SHA-256 hashes. Access to production data is restricted to authorised personnel only.

See our Data Protection Policy for the full list of technical security measures.

We use the following third-party services that may process your data:

• Paystack, payment processing (Nigeria/Global)
• Flutterwave, payment processing (Nigeria/Global)
• Resend, transactional email delivery (USA)
• Cloudflare R2, file and PDF storage (Global CDN)
• Pusher, real-time notifications (USA/EU)
• Sentry, error monitoring (USA)
• Railway, application hosting (USA)
• PostHog, product analytics, anonymised (USA/EU)

We only share the minimum data necessary for these services to function.

If you use our developer API, we collect API key usage metadata (request counts, last used timestamp, endpoint accessed). We do not log request or response bodies. Webhook delivery attempts are logged including the target URL, event type, HTTP status code, and timestamp, this data is visible to you in your dashboard and retained for 90 days.

If you embed our payment or contract widgets on your website, your end users' payment interactions are processed directly by Paystack or Flutterwave and subject to their respective privacy policies.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate information in your account
• Delete your account and associated data
• Export your data in a machine-readable format (available from account settings)
• Withdraw consent for optional data processing
• Object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@tryesperworks.com. We will respond within 30 days.

We retain your data for as long as your account is active. On account deletion, personal data is removed within 30 days. Financial records may be retained for up to 7 years for tax and legal compliance. Security logs are retained for 90 days.

We use essential session cookies to authenticate your account. We use PostHog analytics cookies (anonymised, no cross-site tracking). We do not use advertising cookies or sell cookie data.

We may update this policy from time to time. Significant changes will be communicated via email or in-platform notification at least 14 days before taking effect. Your continued use of the Platform after changes take effect constitutes acceptance.

This policy is governed by the laws of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843). If you are in the EEA, you may also lodge a complaint with your local data protection authority.

Privacy enquiries: privacy@tryesperworks.com
Esper Global LLC, Nii Nortey Palm Crescent, North Legon, Accra, Ghana.