Privacy Policy

The MOSAK Foundation(“MOSAK”, “we”, “us”) is a Ghanaian foundation that funds and supports underprivileged students through scholarships, vocational training, leadership formation, and community projects. We operate mosakfoundation.org and the applicant, scholar, and administrator portals that sit behind it.

For the purposes of the Data Protection Act, 2012 (Act 843), the data controller is [Registered entity name — to be completed], registered in Ghana under number [Registration number — to be completed], with its registered office at [Registered address — to be completed] (Accra, Ghana). Our registration with the Data Protection Commission is [Data Protection Commission registration — to be completed].

This policy covers everyone who uses the platform: visitors to the public site, scholarship applicants, Ade-Ena Scholars, donors, volunteers, partners, referees, and people who simply subscribe to opportunity alerts.

The full policy below is the one that counts, but here is the honest summary:

• We collect a lot from scholarship applicants — including financial and household detail — because a need-based scholarship cannot be assessed without it.
• Application text is sent to OpenAI’s GPT-4o model for an automated first-pass evaluation. We say so plainly in section 5. No application is ever decided by AI alone; a human being makes every final decision.
• We never sell your data, we never share it with advertisers, and the site carries no advertising or analytics trackers. The only cookie we set is the one that keeps you signed in.
• Card and mobile-money details are handled entirely by Stripe and Paystack. They never touch MOSAK servers.
• You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email info@mosakfoundation.org.

3.1 Account information

When you register, we collect your name, email address, an optional telephone number, an optional profile photograph, and a password. Passwords are never stored as you typed them — we store only a one-way bcrypt hash. If you sign in with a third-party provider instead, we receive the basic profile that provider releases to us. We also record your role on the platform (applicant, scholar, volunteer, partner, or administrator) and when your email address was verified.

3.2 Scholarship application information

An application to the Ade-Ena Scholars Program asks for substantially more, because a need-based award cannot be judged without it. We collect:

• Personal details — full name, date of birth, gender, nationality, region of Ghana, telephone number, and home address.
• Academic details — your institution, programme, year of study, WASSCE subjects and grades, CGPA where you have one, and a transcript you upload.
• Financial details — annual household income, the number of dependents in your household, a written statement of your financial circumstances, and any supporting documents you upload (for example payslips, fee statements, a death certificate, or a letter from a community leader).
• Your personal statement — the essay in which you tell us your story in your own words.
• Referee information — the name, email address, organisation, and relationship of the referees you nominate, and the reference each of them writes about you. Referees write their reference through a private, single-use link and do not need an account.
• Correspondence — the messages you and our review team exchange about your application, interview arrangements, and the outcome.

Some of this is sensitive personal data under Act 843. We treat it accordingly: it is visible only to the small number of administrators who review applications, and it is never published.

3.3 Donation records

When you give, we record the donor name and email address you provide, the amount and currency, the campaign or project you chose, whether the gift is recurring, the payment provider used (Stripe or Paystack), the provider’s transaction reference, the payment status, and whether you asked to appear on the public donor wall. We do not receive or store your card number, CVV, bank details, or mobile-money PIN — see section 6.

3.4 Portal and learning activity

If you are a scholar or an enrolled learner, we record which courses you are enrolled in, which lessons you have completed and your overall progress through a course, notes you write against a lesson, assignments and files you submit, the grades and feedback your reviewer gives, your quiz attempts and scores, certificates issued to you, your leadership pledge, and disbursement records for the funds paid on your behalf.

3.5 Opportunities Portal preferences

If you subscribe to opportunity alerts, we store the categories, education levels, fields of study, and countries you care about, plus how often you want to hear from us. We also store the opportunities you save so you can return to them.

3.6 Communications and notifications

We keep a log of the transactional emails we send you — the template used, the recipient address, and whether the send succeeded — so that our team can tell whether an important message (an interview invitation, a decision letter, a donation receipt) actually arrived. We also store your in-app notifications and any messages you send through the scholar network or volunteer features.

3.7 Technical information

Our hosting provider records standard server logs, and we record a short-lived count of requests against sensitive endpoints in order to rate-limit abuse. We do not build advertising profiles and we do not run third-party analytics or advertising scripts.

• To run your account and keep it secure — necessary for the performance of our agreement with you, and for our legitimate interest in preventing fraudulent access.
• To assess your scholarship application — you consent to this when you submit an application, and it is necessary in order to take steps at your request before entering into a scholarship agreement. Assessing financial need is the entire purpose of the programme; we cannot process an application without this information.
• To contact your referees and verify what you have told us — necessary to assess your application, and in our legitimate interest in awarding funds fairly.
• To process donations and issue receipts — necessary to perform the transaction you asked for, and to meet our legal accounting and audit obligations.
• To deliver the learning portal and issue certificates — necessary for the performance of our agreement with scholars and enrolled learners.
• To send opportunity alerts and announcements — with your consent, which you can withdraw at any time from your alert preferences or by using the unsubscribe link.
• To report on our impact — our legitimate interest in accounting to donors and the public. Impact reporting uses aggregate figures. We publish a scholar’s name, photograph, or story only with that scholar’s specific, separate, written consent, and a donor’s name on the donor wall only where the donor asked for it.
• To comply with the law — where we must retain records or respond to a lawful request.

We want to be completely straightforward about this, because it matters.

When you submit a scholarship application, the platform sends the text of your application — your personal statement, your financial statement, your academic record, and the structured answers you gave — to OpenAI’s GPT-4o model for an automated first-pass evaluation. The model produces a score, a written report against our published criteria (financial need, academic merit, leadership potential, and the coherence of your story), and a recommendation. We store that score, that report, and a log of which model produced it alongside your application.

The evaluation also includes an assessment of whether your personal statement reads as genuinely your own writing. We built that check to be fair to Ghanaian applicants: natural features of Ghanaian English are treated as signs of authenticity, never as faults.

OpenAI processes this text as our service provider in order to return the evaluation to us. Under OpenAI’s API terms, data sent through the API is not used to train their models. If we ever switch to a different provider or model, we will update this section and tell affected applicants. If no AI provider is configured, the platform falls back to a deterministic scoring routine that runs entirely on our own servers and sends nothing anywhere.

We do not sell personal information, and we do not share it with advertisers. We share it only with the service providers that make the platform work, and only with what they need:

• OpenAI — receives scholarship application text for the automated evaluation described in section 5, and the text of opportunity listings we curate. It does not receive your password, your payment details, or your uploaded documents themselves.
• ZeptoMail (Zoho) — sends our transactional email. It receives your name, email address, and the contents of the message being sent to you.
• Stripe and Paystack — process donations. You enter your card or mobile-money details directly with them on their own hosted checkout. Card and mobile-money credentials never reach MOSAK servers and we never see them. We receive only the confirmation, the amount, and a transaction reference. Each provider handles your payment data under its own privacy policy.
• Namecheap — hosts our database and uploaded files and runs the application. They store and serve the data described in this policy on our instructions.
• Your referees — receive your name and the fact that you have named them as a referee, so they can write a reference. They do not see your financial information or the rest of your application.
• Auditors, professional advisers, and authorities — where we are legally obliged to disclose, or where disclosure is necessary to protect someone’s safety.

Within MOSAK, access is limited by role. Administrators see applications and donations; scholars see their own records; volunteers and partners see only their own areas. Nobody sees more than their work requires.

This site sets one category of cookie: the authentication session cookie. It is set when you sign in, it identifies your session so the portal knows who you are, and it is strictly necessary for the service to function. It expires when your session ends or when you sign out.

We do not set advertising cookies. We do not run Google Analytics, Meta pixels, or any third-party behavioural tracker. We do not track you across other websites. Because the only cookie we use is strictly necessary, no consent banner is required — and we would rather not subject you to one.

Blocking cookies in your browser will prevent you from signing in to the portal, but the public site will still work.

We keep information only as long as we have a reason to, then delete or anonymise it. The periods below are our working policy and are marked for legal confirmation: [Retention periods — to be confirmed].

• Account records — for as long as your account is open, and for 12 months after you close it, so that we can resolve any dispute that arises.
• Unsuccessful applications — 3 years from the decision. Applicants may reapply in a later cycle, and keeping the file lets us see your progress rather than judge you from scratch. You may ask us to delete it sooner.
• Successful applications and scholar records — for the duration of the award and 7 years afterwards, to meet our audit and reporting obligations to donors and regulators.
• Supporting documents you upload — deleted on the same schedule as the application they belong to.
• Donation records — 7 years, as required for financial and tax record-keeping. This obligation means we generally cannot delete a donation record on request, though we can remove your name from the public donor wall immediately.
• Learning progress and certificates — for as long as your account is open. Issued certificates are retained so that their verification code keeps working.
• AI evaluation logs — kept with the application they relate to, and deleted with it.
• Email send logs — 24 months.
• Alert preferences and saved opportunities — until you unsubscribe or delete them.

Under Act 843 you have the right to know what we hold about you, to have it corrected, to object to how we use it, to withdraw consent where we relied on it, and to ask us to delete it. Specifically, you may:

• Access — ask for a copy of the personal information we hold about you, and for an explanation of how it has been used, including how your application was evaluated.
• Correct — update your own name, email, phone number, and photograph at any time from your profile page in the portal. For anything you cannot edit yourself — a detail in a submitted application, for example — write to us and we will correct it.
• Export — request a machine-readable export of your account data, your application, your donation history, and your learning records. We will send it to your registered email address.
• Delete — request deletion of your account. When we delete an account we remove your profile, applications, uploaded documents, learning records, notes, messages, and alert preferences. We must retain donation records for the statutory period described in section 8, and we will tell you exactly what has been kept and why.
• Object or restrict — tell us to stop a particular use of your information, or to hold it without using it while a dispute is resolved.
• Withdraw consent — unsubscribe from opportunity alerts and non-essential email from your alert preferences or the unsubscribe link in any such email. Withdrawing consent does not affect anything we did before you withdrew it.

To exercise any of these rights, email info@mosakfoundation.org (or our data protection contact, [Data protection contact — to be completed]) from the address on your account. We respond within 30 days and we never charge for a first request. We may ask you to confirm your identity before we release or delete anything — that protection is for your benefit.

If you are not satisfied with how we have handled your request, you may complain to Ghana’s Data Protection Commission: [Supervisory complaint route — to be completed].

The platform is intended for people aged 18 and over. Applicants under 18 may apply only with the knowledge and consent of a parent or legal guardian, and we may ask for written confirmation of that consent before we assess an application. We do not knowingly create accounts for children under 13. If you believe a child has registered without appropriate consent, tell us and we will remove the account.

A scholarship application necessarily contains information about other people — your parents or guardians, your siblings, your dependents, and your referees. Some of those people are minors. By submitting an application you confirm that you have the authority to share that information with us, and that you have told those people (or, for a child, their parent or guardian) that you have done so and why.

We use household information solely to assess financial need. We never contact your dependents, we never publish their names, and we keep this information under the same access restrictions as the rest of your application. A parent, guardian, or referee may contact us at any time to ask what we hold about them.

• Passwords are stored only as one-way bcrypt hashes. We cannot read your password, and no member of our team can retrieve it — a forgotten password can only be reset, never recovered.
• All traffic between your device and the platform is encrypted in transit with TLS, and data is encrypted at rest by our database and storage providers.
• Access is controlled by role. Administrator functions are restricted to named administrator accounts, enforced both at the network edge and again inside every page and action that touches sensitive data.
• Sessions are held in signed tokens, sensitive endpoints are rate-limited, and referee links are single-purpose and time-limited.
• Administrative actions on applications — status changes, score overrides, notes — are logged with the person who made them.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Commission without undue delay, tell you what happened, and tell you what to do about it.

MOSAK is based in Ghana, but several of our service providers — OpenAI, ZeptoMail, Stripe, and Namecheap — operate infrastructure outside Ghana, principally in the European Union and the United States. This means your information may be stored or processed abroad.

Where that happens, we rely on the contractual protections in each provider’s data processing agreement, which oblige them to protect your information to a standard consistent with Act 843 and to process it only on our instructions. Paystack processes Ghanaian payments regionally.

We will update this policy when what we do changes — for example if we add a service provider, change AI models, or introduce a new feature that collects something new. When we do, we will change the “last updated” date at the top of this page.

If the change is significant — a new category of data, a new purpose, a new recipient of your information — we will email registered users and place a notice in the portal at least 14 days before it takes effect, so that you have time to object, withdraw consent, or close your account.

Questions, requests, and complaints about privacy are welcome and are read by a person.

• General and privacy — info@mosakfoundation.org
• Applications and scholars — scholars@mosakfoundation.org
• Data protection contact — [Data protection contact — to be completed]
• Telephone — +233 XX XXX XXXX
• Post — [Registered address — to be completed], Accra, Ghana

See also our Terms of Service.